- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2023:7151: python3 security update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7151.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6944: protobuf-c security update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: The protobuf-c packages provide C bindings for Google's Protocol Buffers. Security Fix(es): * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6944.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7256: dotnet7.0 security update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.114 and .NET Runtime 7.0.14. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7256.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7258: dotnet6.0 security update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.125 and .NET Runtime 6.0.25. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7258.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7077: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-11-23 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208) * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436) * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975) * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594) * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640) * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388) * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952) * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982) * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895) * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456) * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887) * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458) * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590) * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597) * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073) * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074) * kernel: hid: Use After Free in asus_remove (CVE-2023-1079) * kernel: use-after-free in drivers/media/rc/ene_ir.c (CVE-2023-1118) * kernel: hash collisions in the IPv6 connection lookup table (CVE-2023-1206) * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252) * kernel: denial of service in tipc_conn_close (CVE-2023-1382) * kernel: Use after free bug in btsdio_remove due to race condition (CVE-2023-1989) * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998) * kernel: ext4: use-after-free in ext4_xattr_set_entry (CVE-2023-2513) * kernel: fbcon: shift-out-of-bounds in fbcon_set_font (CVE-2023-3161) * kernel: out-of-bounds access in relay_file_read (CVE-2023-3268) * kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params (CVE-2023-3772) * kernel: smsusb: use-after-free caused by do_submit_urb (CVE-2023-4132) * kernel: Race between task migrating pages and another task calling exit_mmap (CVE-2023-4732) * Kernel: denial of service in atm_tc_enqueue due to type confusion (CVE-2023-23455) * kernel: mpls: double free on sysctl allocation failure (CVE-2023-26545) * kernel: Denial of service issue in az6027 driver (CVE-2023-28328) * kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow (CVE-2023-28772) * kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible (CVE-2023-31084) * kernel: net: qcom/emac: race condition leading to use-after-free in emac_remove (CVE-2023-33203) * kernel: saa7134: race condition leading to use-after-free in saa7134_finidev (CVE-2023-35823) * kernel: dm1105: race condition leading to use-after-free in dm1105_remove.c (CVE-2023-35824) * kernel: r592: race condition leading to use-after-free in r592_remove (CVE-2023-35825) * kernel: net/tls: tls_is_tx_ready() checked list_entry (CVE-2023-1075) * kernel: use-after-free bug in remove function xgene_hwmon_remove (CVE-2023-1855) * kernel: Use after free bug in r592_remove (CVE-2023-3141) * kernel: gfs2: NULL pointer dereference in gfs2_evict_inode (CVE-2023-3212) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7077.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6919: edk2 security and bug fix update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6919.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:6961: qt5-qtsvg security update (Low)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Low Release date: 2023-11-23 Summary: Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices. Security Fix(es): * qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-6961.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7166: tpm2-tss security and enhancement update (Low)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Low Release date: 2023-11-23 Summary: The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices Security Fix(es): * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7166.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7265: open-vm-tools security update (Important)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-11-23 Summary: The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: SAML token signature bypass (CVE-2023-34058) * open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper (CVE-2023-34059) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7265.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7207: c-ares security update (Moderate)
by AlmaLinux Errata Notifications 27 Nov '23

27 Nov '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2023-11-23 Summary: The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217) * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7207.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0