- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:93464: podman security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * podman: Arbitrary file write when importing OCI archive (CVE-2025-11395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93464.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93461: util-linux security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-02 Summary: The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: TOCTOU in the mount program when setting up loop devices (CVE-2026-27456) * util-linux: util-linux: heap use-after-free in libblkid nested partition probing (CVE-2026-13595) * util-linux: TOCTOU in the mount program via ancestor directory swap on target path (CVE-2026-53613) * util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes (CVE-2026-53612) * util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2 (CVE-2026-53614) * util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks (CVE-2026-76642) * util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority (CVE-2026-78408) * util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection (CVE-2026-78410) * util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser (CVE-2026-53615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93461.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:54343: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-01 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: perf/aux: Fix page UAF in map_range() (CVE-2026-64300) * kernel: af_unix: set gc_in_progress to true in unix_gc() (CVE-2026-53361) Bug Fix(es) and Enhancement(s): * netfilter: CVE backports for AlmaLinux 10.2.z (JIRA:AlmaLinux-185311) * tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-10.2.z] (JIRA:AlmaLinux-214436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-54343.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93443: thunderbird security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-02 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764) * firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109783) * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704) * firefox: Use-after-free in the XML component (CVE-2026-109718) * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715) * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706) * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724) * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782) * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709) * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705) * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738) * firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757) * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729) * firefox: Other issue in the DOM: File component (CVE-2026-109744) * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716) * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719) * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753) * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723) * firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734) * firefox: Mitigation bypass in the File Handling component (CVE-2026-109763) * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708) * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717) * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752) * firefox: Race condition in the XPCOM component (CVE-2026-109776) * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707) * firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760) * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720) * firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777) * firefox: Use-after-free in the SVG component (CVE-2026-109726) * firefox: Integer overflow in the Graphics component (CVE-2026-109730) * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737) * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766) * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732) * firefox: Site isolation issue in the Networking component (CVE-2026-109759) * firefox: Privilege escalation in the WebExtensions component (CVE-2026-109778) * firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762) * firefox: Race condition, use-after-free in the Graphics: Text component (CVE-2026-109765) * firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754) * firefox: Information disclosure in the Networking component (CVE-2026-109751) * firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725) * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712) * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711) * firefox: Frame poisoning in the Layout component (CVE-2026-109736) * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722) * firefox: Information disclosure in the Networking component (CVE-2026-109767) * firefox: Denial-of-service in the WebRTC component (CVE-2026-109775) * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728) * firefox: Denial-of-service in the Printing: Output component (CVE-2026-109781) * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-109710) * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-109731) * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721) * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743) Bug Fix(es) and Enhancement(s): * Thunderbird ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93443.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93414: kernel security update (Critical)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-11-02 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93414.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93415: kernel-rt security update (Critical)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-11-02 Summary: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93415.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93440: python-jwt security update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-93440.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:5264: virt:rhel and virt-devel:rhel security and bug fix update (Important)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-11-02 Summary: Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware platforms. The virt:rhel module contains packages which provide user-space components used to run virtual machines using KVM. The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service (CVE-2023-3354) * NTFS-3G: buffer overflow issue in NTFS-3G can cause code execution via crafted metadata in an NTFS image (CVE-2022-40284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * "No bootable device" with OS boot disk interface VirtIO-SCSI and with more than 9 VirtIO disks. (BZ#2228485) Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-5264.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:3821: ruby:2.7 security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (2.7). (BZ#2189465) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-3821.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2023:7025: ruby:2.5 security update (Moderate)
by AlmaLinux Errata Notifications 02 Nov '26

02 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-02 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2023-7025.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0