- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:84798: pcs security update (Important)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-19 Summary: The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields (CVE-2026-82397) * python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVE-2024-14029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-84798.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84583: webkit2gtk3 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-19 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596) * chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500) * chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654) * chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621) * chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE (CVE-2026-87512) * chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free (CVE-2026-87648) * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87602) * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87586) * chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read (CVE-2026-87604) * chromium-browser: angle: chromium-browser: Improper input validation in ANGLE (CVE-2026-91738) * chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE (CVE-2026-91720) Bug Fix(es) and Enhancement(s): * webkit2gtk3 2.54.0 regression breaks Eclipse IDE WebKit-based views on CentOS Stream 9 [almalinux-9.8.z] (JIRA:AlmaLinux-274394) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-84583.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84588: perl-URI security update (Moderate)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-19 Summary: This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-84588.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:83156: kernel security update (Important)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-19 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-83156.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84577: python3.14-urllib3 security update (Important)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-19 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-84577.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84594: environment-modules security update (Moderate)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-19 Summary: The environment-modules packages provide dynamic modification of user environment using module files. Each module file contains the information needed to configure the shell for an application. Once the package is initialized, the environment can be modified on a per-module basis using the "module" utility, which interprets module files. Security Fix(es): * environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters (CVE-2026-85013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-84594.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84578: python3.14-urllib3 security update (Important)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-19 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689) * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-84578.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84587: perl-URI security update (Moderate)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-10-19 Summary: This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-84587.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84590: perl-URI security update (Moderate)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-10-19 Summary: This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 (and updated by RFC 2732). Security Fix(es): * URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization (CVE-2026-19953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-84590.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:84584: webkit2gtk3 security, bug fix, and enhancement update (Critical)
by AlmaLinux Errata Notifications 19 Oct '26

19 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-19 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via out-of-bounds read (CVE-2026-87596) * chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page (CVE-2026-87500) * chromium-browser: angle: Chromium: Arbitrary code execution via buffer overflow in ANGLE (CVE-2026-87654) * chromium-browser: angle: Google Chrome (ANGLE): Arbitrary Code Execution vulnerability (CVE-2026-87621) * chromium-browser: angle: Chromium-browser: Arbitrary code execution via use-after-free vulnerability in ANGLE (CVE-2026-87512) * chromium-browser: angle: ANGLE: Arbitrary code execution in Google Chrome due to use-after-free (CVE-2026-87648) * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87602) * chromium-browser: angle: ANGLE in Google Chrome: Information disclosure via crafted HTML page (CVE-2026-87586) * chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via out-of-bounds read (CVE-2026-87604) * chromium-browser: angle: chromium-browser: Improper input validation in ANGLE (CVE-2026-91738) * chromium-browser: angle: chromium-browser: Uninitialized resource in ANGLE (CVE-2026-91720) Bug Fix(es) and Enhancement(s): * webkit2gtk3 2.54.0 regression breaks Eclipse IDE WebKit-based views on CentOS Stream 9 [almalinux-8.10.z] (JIRA:AlmaLinux-274406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-84584.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0