- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:57252: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:AlmaLinux-181065) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-9.8.z] (JIRA:AlmaLinux-224549) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-9.8.z] (JIRA:AlmaLinux-235811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-57252.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:59152: gstreamer1-plugins-good security update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fix(es): * gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296) * gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298) * gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299) * GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-59152.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:58982: grafana security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-08-26 Summary: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) Bug Fix(es) and Enhancement(s): * Avoid unbounded memory growth [almalinux-9.8.z] (JIRA:AlmaLinux-242865) * Limit the size of the request body before processing it (JIRA:AlmaLinux-242866) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-58982.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:59490: nginx:1.24 security update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-59490.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:58936: sqlite security update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-58936.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:59387: mod_http2 security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-08-26 Summary: The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913) * httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Bug Fix(es) and Enhancement(s): * address CVE-2026-43951 and CVE-2026-48913 in mod_http2 [almalinux-9] (JIRA:AlmaLinux-190583) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-59387.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:59362: nginx security update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-59362.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:58897: firefox security update (Important)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-08-26 Summary: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983) * firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934) * firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987) * firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948) * firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943) * firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component (CVE-2026-74971) * firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941) * firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965) * firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946) * firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973) * firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949) * firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990) * firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940) * firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960) * firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969) * firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976) * firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974) * firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957) * firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967) * firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939) * firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972) * firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945) * firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-74944) * firefox: Integer overflow in the Graphics component (CVE-2026-74964) * firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962) * firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-58897.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:59347: httpd security update (Low)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Low Release date: 2026-08-25 Summary: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-59347.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:60329: mingw-openssl security update (Low)
by AlmaLinux Errata Notifications 26 Aug '26

26 Aug '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Low Release date: 2026-08-26 Summary: The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. This package contains Windows (MinGW) libraries and development tools. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-60329.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0