- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:95194: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2026-85049) * chromium-browser: skia: Skia: Cross-origin data disclosure via use-after-free vulnerability (CVE-2026-91747) * chromium-browser: skia: Skia in chromium-browser: Information disclosure via improper state validation (CVE-2026-91733) * chromium-browser: skia: Google Chrome: Cross-origin data disclosure due to uninitialized resource in Skia (CVE-2026-91740) * chromium-browser: skia: Google Chrome Skia: Cross-origin data disclosure via improper state validation (CVE-2026-93387) * chromium-browser: skia: chromium-browser: Uninitialized resource in Skia (CVE-2026-102325) * chromium-browser: skia: Integer overflow in Skia (CVE-2026-103629) * chromium-browser: skia: Uninitialized resource in Skia (CVE-2026-106379) * chromium-browser: skia: Out of bounds read in Skia (CVE-2026-106399) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-113106) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118348) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118351) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118340) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-118354) * chromium-browser: skia: Memory corruption in Skia (CVE-2026-118319) * chromium-browser: skia: Use after free in Skia (CVE-2026-119271) * chromium-browser: skia: Improper input validation in Skia (CVE-2026-119261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-95194.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:95086: tesseract security update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fix(es): * tesseract: Tesseract: Heap out-of-bounds write/read leading to information disclosure via crafted data (CVE-2026-88048) * tesseract: Tesseract: Stack buffer overflow via crafted .traineddata file (CVE-2026-88047) * tesseract: Tesseract: Heap out-of-bounds write allows arbitrary code execution or denial of service (CVE-2026-88049) * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata model (CVE-2026-88051) * tesseract: Tesseract: Heap out-of-bounds write leads to heap corruption via crafted data file (CVE-2026-88053) * tesseract: Tesseract: Heap out-of-bounds write can lead to arbitrary code execution (CVE-2026-88052) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-95086.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94629: dpdk security update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561) * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562) * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563) * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565) * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566) * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567) * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845) * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846) * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847) * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848) * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849) * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856) * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683) * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-94629.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86033: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86033.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86033: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86033.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:95212: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-04 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) * kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541) * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488) Bug Fix(es) and Enhancement(s): * AlmaLinux8.10 - s390/smp: Remove conditional emergency signal usage (JIRA:RHEL-298849) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-95212.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:95281: xorg-x11-server-Xwayland security update (Moderate)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-04 Summary: Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-95281.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:95100: kernel-rt security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 05 Nov '26

05 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-04 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) * kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (CVE-2026-64541) * kernel: sctp: clear new_transport when removing a peer (CVE-2026-74586) * kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864) * kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863) * kernel: openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488) Bug Fix(es) and Enhancement(s): * AlmaLinux8.10 - s390/smp: Remove conditional emergency signal usage (JIRA:RHEL-298849) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-95100.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94500: fence-agents security update (Critical)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-11-04 Summary: The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-94500.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94533: cockpit security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147) * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-94533.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93975: gimp security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062) * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257) * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258) * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260) * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93975.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93617: opentelemetry-collector security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93617.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91580: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-03 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) * chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) * chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) * chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91580.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88421: qemu-kvm security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080) Bug Fix(es) and Enhancement(s): * qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [almalinux-9.8.z] (JIRA:AlmaLinux-164549) * live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails. [almalinux-9.8.z] (JIRA:AlmaLinux-280223) * Fix pending QEMU issues for L1VH GA - QEMU [almalinux-9.8.z] (JIRA:AlmaLinux-283121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88421.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94501: fence-agents security update (Critical)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-11-04 Summary: The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94501.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94630: dpdk security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561) * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562) * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563) * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565) * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566) * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567) * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845) * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846) * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847) * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848) * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849) * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856) * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683) * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94630.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94514: freerdp security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) * freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676) * freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838) * freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830) * freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) * freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833) * freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839) * freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378) * freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379) * freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381) * freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382) * freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) * freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045) Bug Fix(es) and Enhancement(s): * Rebase FreeRDP to 3.32.2 or newer [rhel-10.2.z] (JIRA:RHEL-277442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94514.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93596: opentelemetry-collector security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93596.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89758: firefox security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-03 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704) * firefox: Use-after-free in the XML component (CVE-2026-109718) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715) * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706) * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724) * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709) * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716) * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719) * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723) * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717) * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707) * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720) * firefox: Use-after-free in the SVG component (CVE-2026-109726) * firefox: Integer overflow in the Graphics component (CVE-2026-109730) * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727) * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725) * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712) * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722) * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728) * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721) Bug Fix(es) and Enhancement(s): * Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175166) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89758.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94510: freerdp security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-04 Summary: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) * freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) * freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-94510.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94749: python-dns security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-04 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * dnspython: dnspython: Denial of Service via excessive DNS compression pointer traversal (CVE-2026-114605) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-94749.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94519: raptor2 security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-04 Summary: Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling (CVE-2025-71436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-94519.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91636: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) * chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) * chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) * chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-91636.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:23663: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: webkitgtk: Use-after-free due to improper memory management (CVE-2025-43529) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43501) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43531) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43535) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43536) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-23663.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94485: cockpit security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-03 Summary: Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147) * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235) Bug Fix(es) and Enhancement(s): * [cockpit] Overview page should not try to read insights-client.json anymore (JIRA:RHEL-246964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-94485.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93925: bind security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) Bug Fix(es) and Enhancement(s): * random named crashes on different AlmaLinux 8.10 resolvers after of installing bind-9.11.36-16.el8_10.14 (RHSA-2026:54654) (JIRA:RHEL-257162) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93925.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:7541: redis:6 security, bug fix, and enhancement update (Low)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Low Release date: 2026-11-03 Summary: Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. The following packages have been upgraded to a later upstream version: redis (6.2.7). (BZ#1999873) Security Fix(es): * redis: Code injection via Lua script execution environment (CVE-2022-24735) * redis: Malformed Lua script can crash Redis (CVE-2022-24736) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-7541.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94011: bind9.16 security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-94011.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93471: perl-YAML:1.24 security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: he perl-YAML package provides the pure-Perl implementation of the YAML (YAML Ain't Markup Language) data serialization standard. It allows developers to serialize Perl data structures into formatted YAML text and deserialize YAML data back into native Perl structures, making it widely used for configuration files, data exchange, and human-readable data storage in Perl applications. Security Fix(es): * perl-yaml: perl-yaml: Arbitrary code execution via unrestricted package variable assignment (CVE-2019-25777) * perl-yaml: perl-yaml: Arbitrary destructor method execution via crafted YAML document (CVE-2017-20285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93471.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85917: perl:5.32 security update (Moderate)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-03 Summary: Perl is a high-level programming language that is commonly used for system administration utilities and web programming. Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-85917.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93924: qt5-qtbase security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93924.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89756: firefox security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-03 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704) * firefox: Use-after-free in the XML component (CVE-2026-109718) * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715) * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706) * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724) * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782) * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709) * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738) * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729) * firefox: Other issue in the DOM: File component (CVE-2026-109744) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716) * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719) * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753) * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733) * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717) * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752) * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707) * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720) * firefox: Use-after-free in the SVG component (CVE-2026-109726) * firefox: Integer overflow in the Graphics component (CVE-2026-109730) * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737) * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732) * firefox: Information disclosure in the Networking component (CVE-2026-109751) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725) * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712) * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711) * firefox: Frame poisoning in the Layout component (CVE-2026-109736) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722) * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728) * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721) * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743) Bug Fix(es) and Enhancement(s): * Firefox ESR 153 rebase [rhel-8.10.z] (JIRA:RHEL-175143) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89756.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93592: freerdp security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-03 Summary: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) * freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) * freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93592.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93930: kernel security update (Moderate)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-11-03 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (CVE-2026-63987) * kernel: ethtool: cmis: require exact CDB reply length (CVE-2026-63996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93930.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93439: libXi security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-03 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090) * libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93439.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93911: kernel security update (Moderate)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ethtool: cmis: require exact CDB reply length (CVE-2026-63996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93911.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93442: pipewire security update (Moderate)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: PipeWire is a multimedia server for Linux and other Unix like operating systems. Security Fix(es): * pipewire: Pulse Server alloca Stack Overflow (CVE-2026-14330) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93442.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93441: libXi security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-02 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090) * libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93441.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93610: bind security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-02 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93610.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93469: tomcat security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-02 Summary: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93469.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93436: kernel security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283) * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787) * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93436.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93978: ghostscript security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: Reintroduction of .charkeys -dSAFER bypass in AlmaLinux 8 (CVE-2026-112177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93978.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93438: libXi security update (Important)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Arbitrary code execution via oversized DEVICE_ENABLE reply (CVE-2026-109090) * libXi: libXi: Arbitrary code execution via DEVICE_RESOLUTION heap-based buffer overflow (CVE-2026-109089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93438.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86594: .NET 8.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 03 Nov '26

03 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-11-02 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 (JIRA:AlmaLinux-277790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-86594.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93670: kernel-rt bug fix and enhancement update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es) and Enhancement(s): * gfs2: gfs2_glock_hold() assertion failure [AlmaLinux-8] (JIRA:RHEL-291229) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93670.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93627: wireshark security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93627.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93437: kernel-rt security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283) * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787) * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93437.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93464: podman security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93464.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93461: util-linux security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-02 Summary: The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456) * util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595) * util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613) * util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612) * util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614) * util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642) * util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408) * util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410) * util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93461.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:54343: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-01 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-54343.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93443: thunderbird security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-02 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764) * firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109783) * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704) * firefox: Use-after-free in the XML component (CVE-2026-109718) * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715) * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706) * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724) * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782) * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709) * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738) * firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757) * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729) * firefox: Other issue in the DOM: File component (CVE-2026-109744) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716) * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719) * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753) * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723) * firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109763) * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717) * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752) * firefox: Race condition in the XPCOM component (CVE-2026-109776) * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707) * firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760) * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720) * firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777) * firefox: Use-after-free in the SVG component (CVE-2026-109726) * firefox: Integer overflow in the Graphics component (CVE-2026-109730) * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766) * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732) * firefox: Site isolation issue in the Networking component (CVE-2026-109759) * firefox: Privilege escalation in the WebExtensions component (CVE-2026-109778) * firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762) * firefox: Race condition, use-after-free in the Graphics: Text component (CVE-2026-109765) * firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754) * firefox: Information disclosure in the Networking component (CVE-2026-109751) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725) * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712) * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711) * firefox: Frame poisoning in the Layout component (CVE-2026-109736) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722) * firefox: Information disclosure in the Networking component (CVE-2026-109767) * firefox: Denial-of-service in the WebRTC component (CVE-2026-109775) * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728) * firefox: Denial-of-service in the Printing: Output component (CVE-2026-109781) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-109710) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-109731) * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721) * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743) Bug Fix(es) and Enhancement(s): * Thunderbird ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93443.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93414: kernel security update (Critical)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-11-02 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93414.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93415: kernel-rt security update (Critical)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-11-02 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93415.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93440: python-jwt security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93440.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:5264: virt:rhel and virt-devel:rhel security and bug fix update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service (CVE-2023-3354) * NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image (CVE-2022-40284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * "No bootable device" with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks. (BZ#2228485) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-5264.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:3821: ruby:2.7 security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-3821.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7025: ruby:2.5 security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7025.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2757: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790) * QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165) * ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value (CVE-2022-30784) * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate (CVE-2022-30786) * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc (CVE-2022-30788) * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array (CVE-2022-30789) * tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-2757.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:5826: mariadb:10.5 security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: crash at my_decimal::operator= (CVE-2022-27380) * mariadb: crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: crash in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Don't use less parallelism if not necessary (BZ#2096934) * Links in galera package description are bad (BZ#2096935) * [Tracker] Rebase to Galera 26.4.11 (BZ#2096936) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-5826.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:1763: An update for the python39:3.9 and python39-devel:3.9 modules is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-1763.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:1557: An update for the mariadb:10.5 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.5.13), galera (26.4.9). (BZ#2050546) Security Fix(es): * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2154) * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2166) * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2372) * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2389) * mysql: InnoDB unspecified vulnerability (CPU Oct 2021) (CVE-2021-35604) * mariadb: Integer overflow in sql_lex.cc integer leading to crash (CVE-2021-46667) * mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref (CVE-2021-46657) * mariadb: save_window_function_values triggers an abort during IN subquery (CVE-2021-46658) * mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries (CVE-2021-46662) * mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause (CVE-2021-46666) * mariadb: No password masking in audit log when using ALTER USER <user> IDENTIFIED BY <password> command (BZ#1981332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * mariadb-10.5-module: /etc/security/user_map.conf getting overwritten with mariadb-server upgrade (BZ#2050515) * mariadb-server:10.5 in centos8 stream is not shipping wsrep_sst_rsync_tunnel (BZ#2050524) * Galera doesn't work without 'procps-ng' package MariaDB-10.5 (BZ#2050542) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-1557.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:3061: An update for the virt:rhel and virt-devel:rhel modules is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * QEMU: msix: OOB access during mmio operations may lead to DoS (CVE-2020-13754) * hivex: Buffer overflow when provided invalid node key length (CVE-2021-3504) * QEMU: net: an assert failure via eth_get_gso_type (CVE-2020-27617) * QEMU: net: infinite loop in loopback mode may lead to stack overflow (CVE-2021-3416) * qemu: out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * cannot restart default network and firewalld: iptables: No chain/target/match by that name. (BZ#1958301) * RHEL8.4 Nightly[0322] - KVM guest fails to find zipl boot menu index (qemu-kvm) (BZ#1975679) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-3061.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:1556: An update for the mariadb:10.3 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.32), galera (25.3.34). (BZ#2050543) Security Fix(es): * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2154) * mysql: Server: DML unspecified vulnerability (CPU Apr 2021) (CVE-2021-2166) * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2372) * mysql: InnoDB unspecified vulnerability (CPU Jul 2021) (CVE-2021-2389) * mysql: InnoDB unspecified vulnerability (CPU Oct 2021) (CVE-2021-35604) * mariadb: Integer overflow in sql_lex.cc integer leading to crash (CVE-2021-46667) * mariadb: Crash in get_sort_by_table() in subquery with ORDER BY having outer ref (CVE-2021-46657) * mariadb: save_window_function_values triggers an abort during IN subquery (CVE-2021-46658) * mariadb: Crash in set_var.cc via certain UPDATE queries with nested subqueries (CVE-2021-46662) * mariadb: Crash caused by mishandling of a pushdown from a HAVING clause to a WHERE clause (CVE-2021-46666) * mariadb: No password masking in audit log when using ALTER USER <user> IDENTIFIED BY <password> command (BZ#1981332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * mariadb:10.3/mariadb: /etc/security/user_map.conf getting overwritten with mariadb-server upgrade (BZ#2050514) * MariaDB logrotate leads to "gzip: stdin: file size changed while zipping" (BZ#2050532) * Crash: WSREP: invalid state ROLLED_BACK (FATAL) (BZ#2050533) * Galera doesn't work without 'procps-ng' package MariaDB-10.3 (BZ#2050550) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-1556.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:2587: An update for the ruby:2.5 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.5.9). (BZ#1952626) Security Fix(es): * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845) * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201) * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255) * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663) * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933) * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) * ruby: HTTP response splitting in WEBrick (CVE-2019-16254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-2587.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:1762: An update for the virt:rhel and virt-devel:rhel modules is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-25637) * QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c (CVE-2020-27821) * QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443) * QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure (CVE-2020-11947) * QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c (CVE-2020-16092) * QEMU: infinite loop in e1000e_write_packet_to_guest() in hw/net/e1000e_core.c (CVE-2020-25707) * QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c (CVE-2020-25723) * QEMU: e1000e: infinite loop scenario in case of null packet descriptor (CVE-2020-28916) * QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets (CVE-2020-29129, CVE-2020-29130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-1762.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:2588: An update for the ruby:2.6 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.6.7). (BZ#1952627) Security Fix(es): * rubygem-bundler: Insecure permissions on directory in /tmp/ allows for execution of malicious code (CVE-2019-3881) * ruby: NUL injection vulnerability of File.fnmatch and File.fnmatch? (CVE-2019-15845) * ruby: Regular expression denial of service vulnerability of WEBrick's Digest authentication (CVE-2019-16201) * ruby: Code injection via command argument of Shell#test / Shell#[] (CVE-2019-16255) * rubygem-json: Unsafe object creation vulnerability in JSON (CVE-2020-10663) * ruby: BasicSocket#read_nonblock method leads to information disclosure (CVE-2020-10933) * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) * ruby: HTTP response splitting in WEBrick (CVE-2019-16254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Resolv::DNS: ruby:2.6/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1954968) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-2588.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:2584: An update for the ruby:2.7 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.7.3). (BZ#1951999) Security Fix(es): * ruby: Potential HTTP request smuggling in WEBrick (CVE-2020-25613) * ruby: XML round-trip vulnerability in REXML (CVE-2021-28965) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Resolv::DNS: ruby:2.7/ruby: timeouts if multiple IPv6 name servers are given and address contains leading zero [almalinux-8] (BZ#1952000) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-2584.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2020:5500: An update for the mariadb:10.3 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: mariadb (10.3.27), galera (25.3.31). (BZ#1899082, BZ#1899086) Security Fix(es): * mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep (CVE-2020-15180) * mysql: InnoDB unspecified vulnerability (CPU Oct 2019) (CVE-2019-2938) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2019) (CVE-2019-2974) * mysql: C API unspecified vulnerability (CPU Apr 2020) (CVE-2020-2752) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2760) * mysql: Server: DML unspecified vulnerability (CPU Apr 2020) (CVE-2020-2780) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Apr 2020) (CVE-2020-2812) * mysql: InnoDB unspecified vulnerability (CPU Apr 2020) (CVE-2020-2814) * mariadb-connector-c: Improper validation of content in a OK packet received from server (CVE-2020-13249) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14765) * mysql: InnoDB unspecified vulnerability (CPU Oct 2020) (CVE-2020-14776) * mysql: Server: FTS unspecified vulnerability (CPU Oct 2020) (CVE-2020-14789) * mysql: Server: Locking unspecified vulnerability (CPU Oct 2020) (CVE-2020-14812) * mysql: C API unspecified vulnerability (CPU Jan 2020) (CVE-2020-2574) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * FTBFS: -D_GLIBCXX_ASSERTIONS (BZ#1899009) * Queries with entity_id IN ('1', '2', …, '70000') run much slower in MariaDB 10.3 than on MariaDB 10.1 (BZ#1899017) * Cleanup race with wsrep_rsync_sst_tunnel may prevent full galera cluster bootstrap (BZ#1899021) * There are undeclared file conflicts in several mariadb and mysql packages (BZ#1899077) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2020-5500.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:1809: An update for the httpd:2.4 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199) * httpd: mod_proxy_uwsgi buffer overflow (CVE-2020-11984) * httpd: mod_http2 concurrent pool usage (CVE-2020-11993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-1809.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2020:4751: An update for the httpd:2.4 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236) Security Fix(es): * httpd: memory corruption on early pushes (CVE-2019-10081) * httpd: read-after-free in h2 connection shutdown (CVE-2019-10082) * httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097) * httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927) * httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196) * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197) * httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092) * httpd: mod_rewrite potential open redirect (CVE-2019-10098) * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2020-4751.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:9636: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-01 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: Use after free in ANGLE (CVE-2024-4558) * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-40789) * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780) * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779) * webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782) * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866) * webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271) * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820) * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838) * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2024-27851) * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187) * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44185) * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44244) * webkitgtk: webkit2gtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2024-44296) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-9636.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:3974: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-01 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-44192) * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-54467) * webkitgtk: Processing web content may lead to a denial-of-service (CVE-2024-54551) * webkitgtk: Loading a malicious iframe may lead to a cross-site scripting attack (CVE-2025-24208) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-24209) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-24216) * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-30427) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-3974.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:10481: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-01 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: data isolation bypass vulnerability (CVE-2024-44309) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-10481.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:4381: An update for GNOME is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-01 Summary: GNOME is the default desktop environment of AlmaLinux. The following packages have been upgraded to a later upstream version: gdm (40.0), webkit2gtk3 (2.32.3). (BZ#1909300) Security Fix(es): * webkitgtk: Use-after-free in AudioSourceProviderGStreamer leading to arbitrary code execution (CVE-2020-13558) * LibRaw: Stack buffer overflow in LibRaw::identify_process_dng_fields() in identify.cpp (CVE-2020-24870) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2020-27918) * webkitgtk: IFrame sandboxing policy violation (CVE-2021-1765) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-1788) * webkitgtk: Type confusion issue leading to arbitrary code execution (CVE-2021-1789) * webkitgtk: Access to restricted ports on arbitrary servers via port redirection (CVE-2021-1799) * webkitgtk: IFrame sandboxing policy violation (CVE-2021-1801) * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2021-1844) * webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1870) * webkitgtk: Logic issue leading to arbitrary code execution (CVE-2021-1871) * webkitgtk: Use-after-free in ImageLoader dispatchPendingErrorEvent leading to information leak and possibly code execution (CVE-2021-21775) * webkitgtk: Use-after-free in WebCore::GraphicsContext leading to information leak and possibly code execution (CVE-2021-21779) * webkitgtk: Use-after-free in fireEventListeners leading to arbitrary code execution (CVE-2021-21806) * webkitgtk: Integer overflow leading to arbitrary code execution (CVE-2021-30663) * webkitgtk: Memory corruption leading to arbitrary code execution (CVE-2021-30665) * webkitgtk: Logic issue leading to leak of sensitive user information (CVE-2021-30682) * webkitgtk: Logic issue leading to universal cross site scripting attack (CVE-2021-30689) * webkitgtk: Logic issue allowing access to restricted ports on arbitrary servers (CVE-2021-30720) * webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30734) * webkitgtk: Cross-origin issue with iframe elements leading to universal cross site scripting attack (CVE-2021-30744) * webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30749) * webkitgtk: Type confusion leading to arbitrary code execution (CVE-2021-30758) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30795) * webkitgtk: Insufficient checks leading to arbitrary code execution (CVE-2021-30797) * webkitgtk: Memory corruptions leading to arbitrary code execution (CVE-2021-30799) * webkitgtk: User may be unable to fully delete browsing history (CVE-2020-29623) * gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (CVE-2020-36241) * gnome-autoar: Directory traversal via directory symbolic links pointing outside of the destination directory (incomplete CVE-2020-36241 fix) (CVE-2021-28650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-4381.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7050: python38:3.8 and python38-devel:3.8 security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-01 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7050.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7042: python27:2.7 security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-01 Summary: Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL. Security Fix(es): * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7042.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7034: python39:3.9 and python39-devel:3.9 security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-01 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) * python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7034.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2021:4150: An update for the python36:3.6 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-01 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python-pygments: Infinite loop in SML lexer may lead to DoS (CVE-2021-20270) * python-pygments: ReDoS in multiple lexers (CVE-2021-27291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2021-4150.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90500: java-17-openjdk security update for AlmaLinux 9 (Important)
by AlmaLinux Errata Notifications 01 Nov '26

01 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-01 Summary: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance Image Processing (CVE-2026-91382) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90500.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89757: firefox security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 01 Nov '26

01 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-31 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704) * firefox: Use-after-free in the XML component (CVE-2026-109718) * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715) * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706) * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724) * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782) * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709) * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738) * firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757) * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729) * firefox: Other issue in the DOM: File component (CVE-2026-109744) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716) * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719) * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753) * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723) * firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109763) * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717) * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752) * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707) * firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760) * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720) * firefox: Use-after-free in the SVG component (CVE-2026-109726) * firefox: Integer overflow in the Graphics component (CVE-2026-109730) * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737) * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732) * firefox: Site isolation issue in the Networking component (CVE-2026-109759) * firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762) * firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754) * firefox: Information disclosure in the Networking component (CVE-2026-109751) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725) * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712) * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711) * firefox: Frame poisoning in the Layout component (CVE-2026-109736) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722) * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728) * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721) * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743) Bug Fix(es) and Enhancement(s): * Firefox ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89757.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92430: .NET 9.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-10.2.z] (JIRA:RHEL-291728) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92430.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92428: .NET 8.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-10.2.z] (JIRA:RHEL-291718) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92428.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92438: .NET 10.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-10.2.z] (JIRA:RHEL-291745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92438.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90504: java-21-openjdk security update for AlmaLinux 10 (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-30 Summary: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server (CVE-2026-87291) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Improve ciphertext handling (CVE-2026-91333) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90504.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86168: .NET 8.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-10.2.z] (JIRA:AlmaLinux-277794) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-86168.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86172: .NET 9.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-10.2.z] (JIRA:AlmaLinux-277801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-86172.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86195: .NET 10.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-10.2.z] (JIRA:AlmaLinux-277809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-86195.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86169: .NET 8.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-9.8.z] (JIRA:AlmaLinux-277793) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86169.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93072: bind9.18 security update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-31 Summary: BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93072.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86193: .NET 10.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-9.8.z] (JIRA:AlmaLinux-277808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86193.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86171: .NET 9.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-9.8.z] (JIRA:AlmaLinux-277800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86171.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92427: .NET 9.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 (JIRA:RHEL-291723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92427.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92431: .NET 10.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 (JIRA:RHEL-291741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92431.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92420: .NET 8.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 (JIRA:RHEL-291714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92420.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92511: .NET 11.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-31 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 11.0.100~rc.3.26522.148 Runtime version: 11.0.0~rc.3.26522.148 Security Fix(es): * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 11 to RC 1 (JIRA:RHEL-260220) * Update .NET 11 to RC 2 (JIRA:RHEL-276919) * Update .NET 11 to RC 3 (JIRA:RHEL-292372) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92511.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92869: tomcat security update (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation (CVE-2026-65637) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92869.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93077: python-pillow security update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-30 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (CVE-2026-112393) * pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution (CVE-2026-112398) * pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE (CVE-2026-112900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93077.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86192: .NET 10.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 (JIRA:AlmaLinux-277805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-86192.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2022:1759: An update for the virt:rhel and virt-devel:rhel modules is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. The following packages have been upgraded to a later upstream version: qemu-kvm (6.2.0), libvirt (8.0.0), libvirt-python (8.0.0), perl-Sys-Virt (8.0.0), seabios (1.15.0), libtpms (0.9.1). (BZ#1997410, BZ#2012802, BZ#2012806, BZ#2012813, BZ#2018392, BZ#2027716, BZ#2029355) Security Fix(es): * QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748) * ntfs-3g: Out-of-bounds heap buffer access in ntfs_get_attribute_value() due to incorrect check of bytes_in_use value in MFT records (CVE-2021-33285) * ntfs-3g: Heap buffer overflow triggered by a specially crafted Unicode string (CVE-2021-33286) * ntfs-3g: Heap buffer overflow in ntfs_attr_pread_i() triggered by specially crafted NTFS attributes (CVE-2021-33287) * ntfs-3g: Heap buffer overflow triggered by a specially crafted MFT section (CVE-2021-33289) * ntfs-3g: Heap buffer overflow triggered by a specially crafted NTFS inode pathname (CVE-2021-35266) * ntfs-3g: Stack buffer overflow triggered when correcting differences between MFT and MFTMirror sections (CVE-2021-35267) * ntfs-3g: Heap buffer overflow in ntfs_inode_real_open() triggered by a specially crafted NTFS inode (CVE-2021-35268) * ntfs-3g: Heap buffer overflow in ntfs_attr_setup_flag() triggered by a specially crafted NTFS attribute from MFT (CVE-2021-35269) * ntfs-3g: NULL pointer dereference in ntfs_extent_inode_open() (CVE-2021-39251) * ntfs-3g: Out-of-bounds read in ntfs_ie_lookup() (CVE-2021-39252) * ntfs-3g: Out-of-bounds read in ntfs_runlists_merge_i() (CVE-2021-39253) * ntfs-3g: Integer overflow in memmove() leading to heap buffer overflow in ntfs_attr_record_resize() (CVE-2021-39254) * ntfs-3g: Out-of-bounds read ntfs_attr_find_in_attrdef() triggered by an invalid attribute (CVE-2021-39255) * ntfs-3g: Heap buffer overflow in ntfs_inode_lookup_by_name() (CVE-2021-39256) * ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap (CVE-2021-39257) * ntfs-3g: Out-of-bounds reads in ntfs_attr_find() and ntfs_external_attr_find() (CVE-2021-39258) * ntfs-3g: Out-of-bounds access in ntfs_inode_lookup_by_name() caused by an unsanitized attribute length (CVE-2021-39259) * ntfs-3g: Out-of-bounds access in ntfs_inode_sync_standard_information() (CVE-2021-39260) * ntfs-3g: Heap buffer overflow in ntfs_compressed_pwrite() (CVE-2021-39261) * ntfs-3g: Out-of-bounds access in ntfs_decompress() (CVE-2021-39262) * ntfs-3g: Heap buffer overflow in ntfs_get_attribute_value() caused by an unsanitized attribute (CVE-2021-39263) * libnbd: nbdcopy: missing error handling may create corrupted destination image (CVE-2022-0485) * hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622) * nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS (CVE-2021-3716) * libvirt: segmentation fault during VM shutdown can lead to vdsm hang (CVE-2021-3975) * QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c (CVE-2021-4145) * QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158) * QEMU: block: fdc: null pointer dereference may lead to guest crash (CVE-2021-20196) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2022-1759.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86170: .NET 9.0 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 (JIRA:AlmaLinux-277797) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-86170.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2020:1650: An update for the container-tools:rhel8 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Moderate)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921) * containers/image: Container images read entire image manifest into memory (CVE-2020-1702) * podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2020-1650.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2024:1828: java-21-openjdk security update (Moderate)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2024-1828.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2020:1926: An update for the container-tools:1.0 module is now available for AlmaLinux AlmaLinux Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. (Important)
by AlmaLinux Errata Notifications 31 Oct '26

31 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: Crafted input tar file may lead to local file overwrite during image build process (CVE-2020-10696) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * conflicting requests: failed to install container-tools:1.0 (BZ#1813776) * podman run container error with avc denied (BZ#1816541) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2020-1926.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92429: .NET 9.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.123 Runtime version: 9.0.22 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.123 and Runtime 9.0.22 [rhel-9.8.z] (JIRA:RHEL-291727) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92429.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92432: .NET 10.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.114 Runtime version: 10.0.14 Security Fix(es): * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.114 and Runtime 10.0.14 [rhel-9.8.z] (JIRA:RHEL-291744) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92432.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92492: .NET 8.0 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-30 Summary: .NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.133 Runtime version: 8.0.33 Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * dotnet8.0: dotnet9.0: dotnet11.0: dotnet10.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-114148) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.133 and Runtime 8.0.33 [rhel-9.8.z] (JIRA:RHEL-291717) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92492.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88349: java-21-openjdk security update for AlmaLinux 8 and 9 (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-30 Summary: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server (CVE-2026-87291) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Improve ciphertext handling (CVE-2026-91333) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88349.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92907: curl security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92907.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92458: aspell security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-30 Summary: GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92458.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91720: ignition security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-30 Summary: Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration. Security Fix(es): * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91720.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92419: bind security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-30 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) * bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) * bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) * bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92419.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92408: dogtag-pki security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-30 Summary: IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: * Certificate Authority (CA) * Key Recovery Authority (KRA) * Online Certificate Status Protocol (OCSP) Manager * Token Key Service (TKS) * Token Processing Service (TPS) * Automatic Certificate Management Environment (ACME) Responder * Enrollment over Secure Transport (EST) Responder Security Fix(es): * resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) * resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) * com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92408.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:22395: kernel security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ublk: make sure ubq->canceling is set when queue is frozen (CVE-2025-22068) * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2025-22395.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88349: java-21-openjdk security update for AlmaLinux 8 and 9 (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server (CVE-2026-87291) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Improve ciphertext handling (CVE-2026-91333) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-88349.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90915: gcc-toolset-15-gcc security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15. Security Fix(es): * gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90915.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92616: httpd:2.4 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_auth_digest: timing attack allows a bypass of digest authentication (CVE-2026-33006) * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) Bug Fix(es) and Enhancement(s): * mod_proxy_hcheck: passing health check does not recover worker from its standard error state (PROXY_WORKER_IN_ERROR) (JIRA:RHEL-256797) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92616.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92639: python-pillow security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pillow: Pillow: Denial of Service via unbounded recursion in PDF parser (CVE-2026-112391) * pillow: pillow: Denial of service via double free during image transformation (CVE-2026-112402) * pillow: pillow: Denial of Service via zero-size images in rank filters (CVE-2026-112392) * pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images (CVE-2026-112397) * pillow: Pillow: Denial of Service via null pointer dereference in Image.merge() (CVE-2026-112405) * pillow: pillow: Denial of Service via crafted multi-frame image conversion (CVE-2026-112894) * pillow: pillow: Denial of service via crafted PDF during append operations (CVE-2026-112895) * pillow: pillow: Denial of Service via infinite loop during PDF page rewriting (CVE-2026-112406) * pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640) * pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92639.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92615: aspell security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-30 Summary: GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fix(es): * aspell: aspell: Arbitrary code execution via crafted dictionary file (CVE-2026-103658) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92615.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:8246: kernel security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CVE-2024-43842) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-8246.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:16919: kernel security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-16919.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:21917: kernel security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-30 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: NFS: Fix a race when updating an existing write (CVE-2025-39697) * kernel: i40e: fix idx validation in config queues msg (CVE-2025-39971) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-21917.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91004: libXi security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91004.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:33482: mariadb:10.11 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261) Bug Fix(es) and Enhancement(s): * [AlmaLinux9][tracker] Rebase Galera to 26.4.27 MariaDB:10.11 (JIRA:AlmaLinux-140363) * Rebase MariaDB 10.11 to 10.11.18 in AlmaLinux9 (JIRA:AlmaLinux-183087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-33482.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92378: nodejs:24 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92378.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91365: libX11 security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91365.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91580: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) * chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) * chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) * chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91580.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91223: libXtst security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: X.Org X11 libXtst runtime library Security Fix(es): * libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91223.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91056: libXi security update (Moderate)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91056.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92145: cjose security update (Critical)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-29 Summary: CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-92145.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92376: nodejs:24 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911) * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) * nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074) * nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071) * nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481) * nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073) * nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072) Bug Fix(es) and Enhancement(s): * nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92376.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92474: python3.12-urllib3 security update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92474.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92368: curl security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 30 Oct '26

30 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) * curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) * curl: Information disclosure due to uncleared proxy authentication state (CVE-2026-8927) Bug Fix(es) and Enhancement(s): * Backport upstream curl PR #6852 ("h2: allow 100 streams by default") to AlmaLinux 8 libcurl (JIRA:RHEL-232829) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92368.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91057: libXrender security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: X.Org X11 libXrender runtime library Security Fix(es): * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91057.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91719: ignition security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration. Security Fix(es): * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91719.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89891: gcc-toolset-15-gcc security update (Moderate)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: The gcc-toolset-15-gcc package contains the GNU Compiler Collection version 15. Security Fix(es): * gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89891.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88347: java-25-openjdk security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-29 Summary: The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance Vector Processing (CVE-2026-87255) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server (CVE-2026-87291) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Improve ciphertext handling (CVE-2026-91333) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-88347.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91003: libXrender security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-29 Summary: X.Org X11 libXrender runtime library Security Fix(es): * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91003.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90895: thunderbird security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-29 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) Bug Fix(es) and Enhancement(s): * Thunderbird ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90895.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91138: yggdrasil security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-29 Summary: yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fix(es): * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91138.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:3507: valkey security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set. In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log. Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth. Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache. You can use Valkey from most programming languages also. Security Fix(es): * Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733) * valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-3507.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88347: java-25-openjdk security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Improve C2 loop transformations (CVE-2026-83378) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance Vector Processing (CVE-2026-87255) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance HTTP Server (CVE-2026-87291) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Improve ciphertext handling (CVE-2026-91333) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88347.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90812: cjose security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-29 Summary: CJose is C library implementing the Javascript Object Signing and Encryption (JOSE). Security Fix(es): * cjose: cjose: Heap buffer overflow in AES Key Wrap decryption leads to denial of service (CVE-2026-53938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90812.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92323: expat security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92323.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88352: java-17-openjdk security update for AlmaLinux 8 (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance PKCS5 padding (CVE-2026-83374) * JDK: Enhance TLS certificate handling (CVE-2026-83376) * JDK: Enhance LDAP logins (CVE-2026-83380) * JDK: Enhance SASL Authentication (CVE-2026-83381) * JDK: Enhance WebRowSets (CVE-2026-83387) * JDK: Enhance HTTP Client Response Handling (CVE-2026-83395) * JDK: Enhance XML Processing (CVE-2026-83400) * JDK: Enhance XPath Expressions (CVE-2026-87290) * JDK: Enhance Network Clients (CVE-2026-87292) * JDK: Enhance Certificate Name Checks (CVE-2026-87294) * JDK: Enhance Template Handling (CVE-2026-87367) * JDK: Enhance HTTP Client (CVE-2026-91332) * JDK: Enhance JPEG loading (CVE-2026-91334) * JDK: Enhance Image Handling (CVE-2026-91335) * JDK: Enhance TLS handshakes (CVE-2026-91373) * JDK: Enhance jstatd (CVE-2026-91374) * JDK: Enhance jmod handling (CVE-2026-91375) * JDK: Enhance JShell (CVE-2026-91379) * JDK: Enhance Preferences (CVE-2026-91380) * JDK: Enhance Image Processing (CVE-2026-91382) * JDK: Enhance HTTP client caching (CVE-2026-91394) * JDK: Enhance diagnostic sessions (CVE-2026-91397) * JDK: Enhance SOCKS5 support (CVE-2026-91398) * JDK: Enhance MIDI file handling (CVE-2026-91400) * JDK: Enhance zipfs (CVE-2026-91410) * JDK: Enhance font rendering (CVE-2026-91415) * JDK: Enhance GIF loading (CVE-2026-91418) * JDK: Enhance HTTP server parsing (CVE-2026-91451) * JDK: Enhance HTTP server (CVE-2026-91452) * JDK: Improve HTTP headers (CVE-2026-91453) * JDK: Enhance TLS Extensions (CVE-2026-91461) * JDK: Enhance krb5 tokens (CVE-2026-91462) * JDK: Enhance krb5 client (CVE-2026-91463) * JDK: Enhance Kerberos validation (CVE-2026-91464) * JDK: Enhance C2 comparisons (CVE-2026-91487) * JDK: Enhance Certificate Constraint Checking (CVE-2026-101516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Note that the OpenJDK RPMs use the system certificate store, so the eMudhra CVEs (CVE-2026-91403 & CVE-2026-114820) should be resolved by updating the ca-certificates package. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-88352.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90909: pki-deps:10.6 security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): * com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) * com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777) * com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON property names (CVE-2026-68498) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90909.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92209: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) Bug Fix(es) and Enhancement(s): * ipv4: ip_gre: make ipgre_header() robust (rhel-8.10.z) (JIRA:RHEL-271135) * ip6_gre: make ip6gre_header() robust (rhel-8.10.z) (JIRA:RHEL-271136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92209.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92157: mod_auth_openidc:2.3 security update (Critical)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-29 Summary: The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92157.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:15785: kernel security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-15785.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92208: kernel-rt security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) Bug Fix(es) and Enhancement(s): * ipv4: ip_gre: make ipgre_header() robust (rhel-8.10.z) (JIRA:RHEL-271135) * ip6_gre: make ip6gre_header() robust (rhel-8.10.z) (JIRA:RHEL-271136) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-92208.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:19447: kernel security update (Moderate)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: wifi: mac80211: check S1G action frame size (CVE-2023-53257) * kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets (CVE-2023-53226) * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-19447.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:11850: kernel security update (Moderate)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919) * kernel: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CVE-2022-49977) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-11850.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:13589: kernel security update (Moderate)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: can: peak_usb: fix use after free bugs (CVE-2021-47670) * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-13589.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2025:13961: kernel-rt security update (Moderate)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-29 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2025-13961.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:13537: thunderbird security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-13537.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:10766: firefox security update (Important)
by AlmaLinux Errata Notifications 29 Oct '26

29 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-29 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-10766.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91636: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-28 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) * chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) * chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) * chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-91636.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91294: libXtst security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-28 Summary: X.Org X11 libXtst runtime library Security Fix(es): * libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-91294.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91267: libXrender security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: X.Org X11 libXrender runtime library Security Fix(es): * libXrender: libXrender: Code injection via heap overflow in RenderQueryPictFormats (CVE-2026-88807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-91267.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91268: libXi security update (Moderate)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-27 Summary: X.Org X11 libXi runtime library Security Fix(es): * libXi: libXi: Denial of Service via out-of-bounds read in XI2 class parser (CVE-2026-93543) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-91268.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91565: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net: shaper: rework the VALID marking (again) (CVE-2026-64027) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (CVE-2026-64109) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CVE-2026-74631) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) Bug Fix(es) and Enhancement(s): * x86/microcode: Add platform mask to Intel microcode "old" list [AlmaLinux-10] [almalinux-10.2.z] (JIRA:AlmaLinux-212778) * net: NULL pointer deref kernel panic in fib6_walk_continue under heavy VRF churn [almalinux-10.2.z] (JIRA:AlmaLinux-245489) * backport fixes for lockdep issues reported with rt-debug [almalinux-10.2.z] (JIRA:AlmaLinux-259937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91565.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90887: emacs security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Arbitrary code execution upon opening a file (CVE-2026-96269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90887.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91366: libX11 security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: The libX11 packages contain the core X11 protocol client library. Security Fix(es): * libX11: libX11: Heap-based buffer overflow via malicious X server (CVE-2026-88806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91366.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91612: libXtst security update (Important)
by AlmaLinux Errata Notifications 28 Oct '26

28 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-28 Summary: X.Org X11 libXtst runtime library Security Fix(es): * libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser (CVE-2026-94286) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-91612.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90522: xdg-dbus-proxy security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90522.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90523: xdg-dbus-proxy security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-27 Summary: xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts. Security Fix(es): * xdg-dbus-proxy: xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape (CVE-2026-94422) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90523.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90800: emacs security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90800.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90913: thunderbird security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component (CVE-2026-92035) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100832) * firefox: Use-after-free in the Layout: Text and Fonts component (CVE-2026-100784) * firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component (CVE-2026-100794) * firefox: thunderbird: Privilege escalation in the Address Bar component (CVE-2026-100820) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100777) * firefox: thunderbird: Information disclosure in the Networking: JAR component (CVE-2026-100766) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100779) * firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-100807) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-100792) * firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component (CVE-2026-100797) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component (CVE-2026-100819) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100776) * firefox: thunderbird: Use-after-free in the Widget component (CVE-2026-100757) * firefox: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-100786) * firefox: thunderbird: Information disclosure in the Networking component (CVE-2026-96869) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100770) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-100769) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100791) * firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-100818) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-100782) * firefox: firefox: Sandbox escape via use-after-free in DOM component (CVE-2026-100811) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100772) * firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component (CVE-2026-100759) * firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component (CVE-2026-100778) * firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-100758) * firefox: thunderbird: Sandbox escape in the Graphics component (CVE-2026-100775) * firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-100781) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-100774) * firefox: thunderbird: Same-origin policy bypass in the WebExtensions component (CVE-2026-100803) * firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-100789) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100785) * firefox: thunderbird: Site isolation issue in the Panning and Zooming component (CVE-2026-100821) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-100788) * firefox: thunderbird: Undefined behavior in the DOM: Streams component (CVE-2026-100771) * firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component (CVE-2026-100762) * firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-100790) * firefox: thunderbird: Use-after-free in the Storage: IndexedDB component (CVE-2026-100773) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-100780) * firefox: thunderbird: Use-after-free in the Networking: Cache component (CVE-2026-100767) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-100756) * firefox: thunderbird: Uninitialized memory in the Audio/Video component (CVE-2026-100783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90913.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90365: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:AlmaLinux-257205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90365.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90449: brotli security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-27 Summary: Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90449.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90759: python-urllib3 security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-27 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90759.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90362: podman security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90362.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90495: brotli security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90495.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90494: python-urllib3 security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90494.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90424: buildah security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages (CVE-2026-56855) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90424.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90462: skopeo security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-27 Summary: The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-90462.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90501: brotli security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: Brotli is a generic-purpose lossless compression algorithm that compresses data using a combination of a modern variant of the LZ77 algorithm, Huffman coding and 2nd order context modeling, with a compression ratio comparable to the best currently available general-purpose compression methods. It is similar in speed with deflate but offers more dense compression. Security Fix(es): * brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90501.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89746: bind9.18 security update (Moderate)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89746.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89748: libreswan security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89748.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:87805: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) * kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) Bug Fix(es) and Enhancement(s): * RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-87805.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90492: libreswan security update (Important)
by AlmaLinux Errata Notifications 27 Oct '26

27 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-90492.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89905: freeipmi security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-10.2.z] (JIRA:AlmaLinux-279524) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89905.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89923: libreswan security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) * libreswan: Denial of Service via sending bogus X.509 certificates (CVE-2026-77205) * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89923.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89752: oci-seccomp-bpf-hook security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes. Security Fix(es): * net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89752.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89860: httpd security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: httpd: HTTP response smuggling via crafted Transfer-Encoding response in mod_proxy_uwsgi (CVE-2026-63718) * httpd: httpd: Denial of Service via integer overflow in mod_dav_fs (CVE-2026-93546) * httpd: httpd: Authentication state corruption via concurrent Digest authentication requests (CVE-2026-73637) * httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response (CVE-2026-63045) * httpd: httpd: Arbitrary code execution via oversized Host header in mod_vhost_alias (CVE-2026-63292) * httpd: httpd: mod_heartmonitor: Denial of Service via NULL pointer dereference (CVE-2026-46729) * httpd: httpd: Authentication bypass via credential replay in mod_auth_digest (CVE-2026-73636) * httpd: httpd: Denial of Service via charset conversion failure in mod_xml2enc (CVE-2026-63686) * httpd: httpd: Denial of service via forged Authorization headers in mod_auth_digest (CVE-2026-48005) * httpd: httpd: Denial of Service via mod_rewrite lookahead (CVE-2026-56154) * httpd: httpd: Denial of Service via heap-based buffer overflow in mod_charset_lite (CVE-2026-56153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89860.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:90328: bind security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-90328.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89732: grafana security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89732.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89849: flatpak security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89849.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89761: skopeo security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-89761.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:76738: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conncount: increase the connection clean up limit to 64 (CVE-2026-45860) * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357) * kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924) * kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922) * kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (CVE-2026-63918) * kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984) * kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992) * kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994) * kernel: netfilter: x_tables: add and use xtables_unregister_table_exit (CVE-2026-64078) * kernel: ipv6: ioam: refresh hdr pointer before ioam6_event() (CVE-2026-64132) * kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557) * kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255) * kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516) * kernel: packet: use consistent hard_header_len in non-ring send paths () * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669) * kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746) * kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) * kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921) * kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972) * kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227) * kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) Bug Fix(es) and Enhancement(s): * wifi card breaks using FIPS (JIRA:AlmaLinux-257457) * AlmaLinux10.0 - kernel: CPU hotplug unsupported by CPUMF [almalinux-10.2.z] (JIRA:AlmaLinux-270888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-76738.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89830: gcc security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if (CVE-2026-102010) * gcc: libstdc++ integer overflow in `new` operator (CVE-2026-95619) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89830.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89859: flatpak security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89859.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89083: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-8.10.z] (JIRA:AlmaLinux-280584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89083.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89082: kernel-rt security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-26 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tcp: restrict SO_ATTACH_FILTER to priv users (CVE-2026-53236) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CVE-2026-64378) * kernel: net: gro: fix double aggregation of flush-marked skbs (CVE-2026-68136) * kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: net/sched: serialize qdisc_rtab_list against concurrent get/put (CVE-2026-68138) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Backport 6785011f8b16 ("ipv4: validate checksum_start before completing checksum") [almalinux-8.10.z] (JIRA:AlmaLinux-280584) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-89082.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89745: bind security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89745.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89742: python3.9 security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89742.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89753: freeipmi security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89753.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89850: flatpak security update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89850.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89749: xz security update (Moderate)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-26 Summary: XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * xz: XZ Utils: Denial of Service via buffer overflow in index decoding (CVE-2026-34743) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89749.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89744: grafana security update (Critical)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-26 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Information disclosure vulnerability in Unified Alerting (CVE-2026-17183) * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89744.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:89755: lrzsz security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Oct '26

26 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-26 Summary: Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fix(es): * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841) Bug Fix(es) and Enhancement(s): * lrzsz: segfault with -s [almalinux-9.8.z] (JIRA:AlmaLinux-282108) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-89755.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0