February 2024 - Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2024:0769: tcpdump security update (Moderate)
by AlmaLinux Errata Notifications 12 Feb '24

12 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-02-12 Summary: The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces. Security Fix(es): * tcpslice: use-after-free in extract_slice() (CVE-2021-41043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0769.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0748: container-tools:4.0 security update (Important)
by AlmaLinux Errata Notifications 12 Feb '24

12 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-02-12 Summary: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: file descriptor leak ("Leaky Vessels") (CVE-2024-21626) A AlmaLinux Security Bulletin which addresses further details about the Leaky Vessels flaw is available in the References section. * golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326) * golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0748.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0752: container-tools:rhel8 security update (Important)
by AlmaLinux Errata Notifications 12 Feb '24

12 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-02-12 Summary: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: file descriptor leak (CVE-2024-21626) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0752.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0768: libmaxminddb security update (Moderate)
by AlmaLinux Errata Notifications 12 Feb '24

12 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-02-12 Summary: The libmaxminddb package contains the MaxMind DB library. Security Fix(es): * libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0768.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0675: gimp security update (Important)
by AlmaLinux Errata Notifications 10 Feb '24

10 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-02-09 Summary: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: dds buffer overflow RCE (CVE-2023-44441) * gimp: PSD buffer overflow RCE (CVE-2023-44442) * gimp: psp integer overflow RCE (CVE-2023-44443) * gimp: psp off-by-one RCE (CVE-2023-44444) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0675.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0670: runc security update (Important)
by AlmaLinux Errata Notifications 07 Feb '24

07 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-02-06 Summary: The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * runc: file descriptor leak (CVE-2024-21626) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0670.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0647: rpm security update (Moderate)
by AlmaLinux Errata Notifications 02 Feb '24

02 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2024-02-01 Summary: The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Security Fix(es): * rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) * rpm: races with chown/chmod/capabilities calls during installation (CVE-2021-35938) * rpm: checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0647.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0602: thunderbird security update (Important)
by AlmaLinux Errata Notifications 01 Feb '24

01 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-02-01 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.7.0. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure to update user input timestamp (CVE-2024-0742) * Mozilla: Crash when listing printers on Linux (CVE-2024-0746) * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747) * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750) * Mozilla: Privilege escalation through devtools (CVE-2024-0751) * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753) * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0602.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0603: firefox security update (Important)
by AlmaLinux Errata Notifications 01 Feb '24

01 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2024-02-01 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.7.0 ESR. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure to update user input timestamp (CVE-2024-0742) * Mozilla: Crash when listing printers on Linux (CVE-2024-0746) * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747) * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750) * Mozilla: Privilege escalation through devtools (CVE-2024-0751) * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753) * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2024-0603.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:0609: thunderbird security update (Important)
by AlmaLinux Errata Notifications 01 Feb '24

01 Feb '24

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2024-02-01 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.7.0. Security Fix(es): * Mozilla: Out of bounds write in ANGLE (CVE-2024-0741) * Mozilla: Failure to update user input timestamp (CVE-2024-0742) * Mozilla: Crash when listing printers on Linux (CVE-2024-0746) * Mozilla: Bypass of Content Security Policy when directive unsafe-inline was set (CVE-2024-0747) * Mozilla: Phishing site popup could show local origin in address bar (CVE-2024-0749) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2024-0750) * Mozilla: Privilege escalation through devtools (CVE-2024-0751) * Mozilla: HSTS policy on subdomain could bypass policy of upper domain (CVE-2024-0753) * Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7 (CVE-2024-0755) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-0609.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0