- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2023:2162: qemu-kvm security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 12 May '23

12 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2023-05-11 Summary: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. The following packages have been upgraded to a later upstream version: qemu-kvm (7.2.0). (BZ#2111769, BZ#2135806) Security Fix(es): * QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165) * QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record (CVE-2022-4172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2162.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2148: kernel-rt security and bug fix update (Important)
by AlmaLinux Errata Notifications 12 May '23

12 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-11 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896) * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461) * hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341) * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655) * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462) * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789) * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882) * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196) * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663) * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028) * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435) * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522) * memory leak in ipv6_renew_options() (CVE-2022-3524) * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566) * data races around sk->sk_prot (CVE-2022-3567) * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619) * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623) * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625) * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628) * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640) * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707) * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128) * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129) * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141) * lockdown bypass using IMA (CVE-2022-21505) * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388) * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743) * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188) * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189) * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674) * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703) * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720) * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721) * Denial of service in beacon protection for P2P-device (CVE-2022-42722) * memory corruption in usbmon driver (CVE-2022-43750) * NULL pointer dereference in traffic control subsystem (CVE-2022-47929) * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394) * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590) * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195) * denial of service in tipc_conn_close (CVE-2023-1382) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2148.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

AlmaLinux 9.2 - Now Available
by Jonathan Wright 11 May '23

11 May '23

Hello Сommunity! The AlmaLinux OS Foundation is proud to announce the general availability of AlmaLinux OS 9.2 <https://mirrors.almalinux.org/isos.html> codenamed “Turquoise Kodkod”! Installation ISOs are available on the mirrors now for all 4 architectures: - Intel/AMD (x86_64) <https://mirrors.almalinux.org/isos/x86_64/9.2.html> - ARM64 (aarch64) <https://mirrors.almalinux.org/isos/aarch64/9.2.html> - IBM PowerPC (ppc64le) <https://mirrors.almalinux.org/isos/ppc64le/9.2.html> - IBM Z (s390x) <https://mirrors.almalinux.org/isos/s390x/9.2.html> Torrents are available as well at: - Intel/AMD (x86_64) <https://repo.almalinux.org/almalinux/9.2/isos/x86_64/AlmaLinux-9.2-x86_64.t…> - ARM64 (aarch64) <https://repo.almalinux.org/almalinux/9.2/isos/aarch64/AlmaLinux-9.2-aarch64…> - IBM PowerPC (ppc64le) <https://repo.almalinux.org/almalinux/9.2/isos/ppc64le/AlmaLinux-9.2-ppc64le…> - IBM Z (s390x) <https://repo.almalinux.org/almalinux/9.2/isos/s390x/AlmaLinux-9.2-s390x.tor…> ISOs, Live Images, Cloud and Containers AlmaLinux also offers a variety of Cloud, Container and Live Images. The builds for these get kicked off as soon as the public repository is ready. *The following images are expected to be available shortly.* We will post a separate “Images Update” announcement soon, to keep the community informed. - Docker <https://wiki.almalinux.org/containers/docker-images.html#about-almalinux-do…> images including Platform and UBIs alternatives. We provide a wide variety of containers for your use. Please see our Docker Official Image <https://hub.docker.com/_/almalinux> as well as all AlmaLinux images <https://hub.docker.com/u/almalinux>. *IMPORTANT!* Starting from AlmaLinux 9.2 Docker’s “latest” and “minimal” tags will point to the latest 9 version. If you’re using these tags and want to stay on AlmaLinux 8 please update your Dockefiles. - LXC/LXD <https://images.linuxcontainers.org/images/almalinux/> - Live Media <https://wiki.almalinux.org/LiveMedia.html> for GNOME, GNOME-mini, KDE, XFCE, MATE and more. - Cloud Images - AWS AMIs <https://wiki.almalinux.org/cloud/AWS.html> for x86_64 and Graviton Instances - Azure <https://wiki.almalinux.org/cloud/Azure.html> Images for in standard and HPC flavors for x86_64 and aarch64 - Google Cloud <https://wiki.almalinux.org/cloud/Google.html> - Generic Cloud/Cloud-init <https://wiki.almalinux.org/cloud/Generic-cloud-on-local.html> for all 4 architectures - Open Nebula <https://wiki.almalinux.org/cloud/OpenNebula.html> for all 4 architectures - Oracle Cloud Infrastructure <https://wiki.almalinux.org/cloud/OCI.html> for x86_64 and aarch64 - Vagrant Boxes <https://app.vagrantup.com/almalinux>: - Libvirt - VirtualBox - Hyper-V - VMWare - Parallels - Raspberry Pi <https://wiki.almalinux.org/documentation/raspberry-pi.html> - Windows Subsystem for Linux <https://wiki.almalinux.org/documentation/wsl.html> Release Notes and More Information AlmaLinux 9.2 provides enhancements and features to the hybrid cloud’s foundation and helps deliver workloads, applications and services for multiple environments faster and with less effort. This release includes security updates such as the realmd system role, a SCAP profile, and Ansible content for enhanced system checks to simplify managing security and compliance. Improvements to application streams provide compilers, runtime languages, databases and web server updates. Enhancements to the web console and new system roles make it easier to automate and standardize systems. As for containers, new capabilities allow the development and management of containerized deployments more easily. You can read more about this release by checking out the Release Notes <https://wiki.almalinux.org/release-notes/9.2.html>. Join us on Mastodon! Have you jumped on Mastodon yet? Follow us! @almalinux@fosstodon.org <https://fosstodon.org/@almalinux> Pitch In Join us in the AlmaLinux Community Chat <https://chat.almalinux.org> to get any assistance you need and help others. You can also post a question on our 9.2 Forum <https://almalinux.discourse.group/c/devel/9-2-stable/40>, on our AlmaLinux Community on Reddit <https://reddit.com/r/almalinux> or catch us on Twitter <https://twitter.com/almalinux>. Please report any bugs you may see on the Bug Tracker <https://bugs.almalinux.org/>. Enjoy the release and have fun! *Happy Hacking!* -- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2023:2127: samba security update (Important)
by AlmaLinux Errata Notifications 06 May '23

06 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-05 Summary: Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2127.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2122: libreswan security update (Important)
by AlmaLinux Errata Notifications 06 May '23

06 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-05-05 Summary: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: Malicious IKEv1 Aggressive Mode packets can crash libreswan (CVE-2023-30570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-2122.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Introducing AlmaLinux Accounts
by Jonathan Wright 05 May '23

05 May '23

Over the past few months, our infrastructure team <https://wiki.almalinux.org/sigs/Infrastructure.html> has been hard at work preparing our single sign-on system that will provide a unified login experience to nearly all AlmaLinux websites and properties. We are happy to announce the launch of https://accounts.almalinux.org! AlmaLinux Accounts <https://accounts.almalinux.org> will give you a single account to use across the array of sites and services offered by AlmaLinux! In addition it eases the process of onboarding new contributors through centralized groups and permissions. Why? Introducing our Single Sign-On (SSO) system offers numerous benefits for both users and the AlmaLinux OS Foundation. SSO enhances security, streamlines access, and simplifies user management across our ecosystem. With a single set of credentials, users can seamlessly navigate all AlmaLinux websites and services. This unified login experience ultimately boosts productivity, fosters collaboration, and provides a more cohesive and personalized experience for our community. Software Stack In the spirit of FOSS, it was only natural for us to stick with a free and open-source software stack. The chosen components should be familiar to anyone who has dealt with directory management or SSO in the Enterprise Linux space. We took inspiration from Fedora’s account system for some components. We have chosen the following FOSS components to power our SSO: - FreeIPA <https://www.freeipa.org> for directory and user management. - Noggin <https://github.com/fedora-infra/noggin>, a web front-end for user self-service. We’ve been doing work in the Fedora project to get noggin and its dependencies added to EPEL 9. This will benefit anyone looking to deploy noggin on RHEL 9 or RHEL 9 compatible distros. 1 - Keycloak <https://www.keycloak.org/>, an OpenID Connect system to sit between applications and LDAP. We’ve started contributing to a playbook mostly maintained by RHEL engineers to help ease the deployment of Keycloak on EL distros. 2 What About My Existing Account(s)? We have a transition plan for the next few weeks to get all systems fully supporting our AlmaLinux Accounts <https://accounts.almalinux.org> and all existing accounts transitioned into the system, or otherwise integrated. chat.almalinux.org (Mattermost) chat.almalinux.org is the single largest standalone user database we have to transition. Luckily this is a very easy and painless task for us as well as users. After you’ve created your AlmaLinux Account <https://accounts.almalinux.org>, navigate to the Profile -> Security section in Mattermost. [image: Step 1 of converting MatterMost account to use AlmaLinux Accounts] From here click on Edit next to Sign-in Method and then Switch to Using OpenID SSO and you can link your new AlmaLinux account. *Keep in mind that once you link your account you will always use your AlmaLinux account to sign in to chat.almalinux.org <http://chat.almalinux.org>.* [image: Step 2 of associating chat.almalinux.org account with AlmaLinux Accounts] On the next screen enter your current chat.almalinux.org (Mattermost) password. [image: Step 3 of associating chat.almalinux.org account with AlmaLinux Accounts]) Finally, log in using your AlmaLinux Account details. [image: Step 4 of associating chat.almalinux.org account with AlmaLinux Accounts] From now on when you log in to chat.almalinux.org you will use your AlmaLinux Account via the dedicated login button: [image: How to log in to chat.almalinux.org/Mattermost with AlmaLinux Accounts] bugs.almalinux.org All existing users on bugs.almalinux.org have been imported as AlmaLinux Accounts. You can gain access to the account by requesting a password reset at https://accounts.almalinux.org/forgot-password/ask using your username. git.almalinux.org git.almalinux.org was originally setup with only GitHub as an authentication source. This is now disabled and you must use your AlmaLinux Account to log in. If you wish to recover your previous git.almalinux.org account send an email to account-merge(a)almalinux.org from the address tied to your GitHub and AlmaLinux accounts and we can tie them together for you. lists.almalinux.org lists.almalinux.org has been tied into AlmaLinux Accounts <https://accounts.almalinux.org> for a few weeks now. Existing lists accounts can be linked to AlmaLinux Accounts seamlessly. Login option for new accounts: [image: Step 1 of associating lists.almalinux.org account with AlmaLinux Accounts] Tie your existing account to your AlmaLinux Account at https://lists.almalinux.org/accounts/social/connections/: [image: Step 2 of associating lists.almalinux.org account with AlmaLinux Accounts] pes.almalinux.org The Package Evolution Service (PES) will be updated with OIDC support, and subsequently AlmaLinux Account support soon. build.almalinux.org The AlmaLinux Build System (ALBS) will be updated with OIDC support, and subsequently AlmaLinux Account support soon. Other There are various other services used by contributors which are mostly tied into AlmaLinux Accounts already with a few to follow soon. Frequently Asked Questions *Q:* I configured 2FA/OTP at https://accounts.almalinux.org but *service/site XYZ* does not have a field for my OTP on the login page. *A:* All sites tied to AlmaLinux Accounts <https://accounts.almalinux.org> support your 2FA/OTP. Simply add it to the end of your password in the password field when logging in. For example if your password is hunter2 and your OTP is 123456 you would enter hunter2123456 into the password field. *Q:* Where should I go for help? *A:* The Infrastructure Channel on Mattermost <https://chat.almalinux.org/almalinux/channels/infrastructure>, IRC <https://web.libera.chat/#almalinux-infrastructure>, mailing list <https://lists.almalinux.org/mailman3/lists/infra.lists.almalinux.org/>. *Q:* Where can I use my AlmaLinux Account <https://accounts.almalinux.org>? *A: *See the table in the blog post <https://almalinux.org/blog/almalinux-accounts-launch/#frequently-asked-ques…> . ------------------------------ 1 *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-b0e8a9d618 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-b0e8a9d618>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-cfcb055a9f <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-cfcb055a9f>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-fdfb8a6342 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-fdfb8a6342>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-3b54948adb <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-3b54948adb>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-46e518d693 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-46e518d693>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-607e3d35c7 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-607e3d35c7>* *https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-6215554ad9 <https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2023-6215554ad9>* *https://bugzilla.redhat.com/show_bug.cgi?id=2174923 <https://bugzilla.redhat.com/show_bug.cgi?id=2174923>* 2 *https://github.com/ansible-middleware/keycloak/pull/73 <https://github.com/ansible-middleware/keycloak/pull/73>* --- Jonathan Wright AlmaLinux Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2023:2074: emacs security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-03 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (CVE-2023-28617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2074.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2078: libwebp security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-03 Summary: The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-2078.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:1909: java-1.8.0-openjdk security and bug fix update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2023-05-02 Summary: The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The RSAPSSSignature implementation works with RSA keys via the SunRSASign provider. However, it did not fully check that the RSA key could be used by the provider before attempting to do so, leading to the possibility of errors being returned with custom security providers. The implementation now validates RSA keys and will allow other providers to handle such keys where it cannot. (RHBZ#2188024) Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2023-1909.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:2076: libwebp security update (Important)
by AlmaLinux Errata Notifications 03 May '23

03 May '23

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2023-05-03 Summary: The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-2076.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0