- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:85239: python3 security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-20 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-85239.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85306: bubblewrap security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-20 Summary: Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-85306.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85773: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-20 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * gfs2 filesystem withdrawal rework [AlmaLinux-8] (JIRA:AlmaLinux-129363) * Batch: z-stream xfrm - almalinux-8.10.z (NST-Core-26W38) (JIRA:AlmaLinux-256684) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-85773.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85774: kernel-rt security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-20 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: sctp: keep chunk->transport in step with the list it is queued on (CVE-2026-74588) * kernel: sctp: validate cookie AUTH state before use (CVE-2026-74752) * kernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631) * kernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * gfs2 filesystem withdrawal rework [AlmaLinux-8] (JIRA:AlmaLinux-129363) * Batch: z-stream xfrm - almalinux-8.10.z (NST-Core-26W38) (JIRA:AlmaLinux-256684) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-85774.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84744: gimp:2.8 security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-19 Summary: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file (CVE-2026-90947) * gimp: gimp: heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions (CVE-2026-90948) * gimp: integer overflow when generating a thumbnail preview for a PSD file (CVE-2026-92248) * gimp: gimp: out-of-bounds write in GIMPressionist plugin via crafted preset file (CVE-2026-97185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-84744.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84721: wireshark security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-20 Summary: The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76879) * wireshark: Wireshark: Denial of Service via X.509IF protocol dissector crash (CVE-2026-76928) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-84721.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85191: xorg-x11-server-Xwayland security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-20 Summary: Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-85191.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:85308: bubblewrap security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-20 Summary: Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-85308.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84753: glibc security update (Moderate)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-19 Summary: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-84753.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84591: emacs security update (Important)
by AlmaLinux Errata Notifications 20 Oct '26

20 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-19 Summary: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: GNU Emacs: Heap over-read leading to information disclosure via crafted image (CVE-2026-77219) * emacs: emacs: Command injection via crafted filenames in TRAMP (CVE-2026-79992) * emacs: Emacs: arbitrary code execution in Flymake mode (CVE-2026-96442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-84591.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0