- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:16484: gimp security update (Important)
by AlmaLinux Errata Notifications 14 May '26

14 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-05-14 Summary: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP:Memory disclosure and denial of service via specially crafted PCX image (CVE-2026-4887) * gimp: GIMP: Remote Code Execution via XPM File Parsing Integer Overflow (CVE-2026-4154) * gimp: GIMP: Remote Code Execution via ANI File Parsing Integer Overflow (CVE-2026-4151) * gimp: GIMP: Remote Code Execution via malicious JP2 file parsing (CVE-2026-4152) * GIMP: GIMP: Arbitrary code execution via specially crafted PSD file (CVE-2026-4150) * gimp: GIMP: Remote Code Execution via PSP file parsing (CVE-2026-4153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-16484.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:16693: jq security update (Important)
by AlmaLinux Errata Notifications 14 May '26

14 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-05-14 Summary: jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-16693.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

Fragnesia (CVE-2026-46300) patched kernels available in AlmaLinux testing
by Jonathan Wright 14 May '26

14 May '26

Hi everyone, Here we go again. A third local-root flaw in the Linux kernel has been disclosed today in the same code area as Copy Fail and Dirty Frag. The bug, named "Fragnesia" by researcher William Bowling of the V12 security team, is tracked as CVE-2026-46300, and a working proof-of-concept is already public. Fragnesia is a logic flaw in the core socket-buffer code (skb_try_coalesce loses the SKBFL_SHARED_FRAG marker) that the XFRM ESP-in-TCP receive path then turns into in-place AES-GCM decryption over page-cache pages an unprivileged user controls. The end result is arbitrary byte writes into read-only files such as /usr/bin/su, i.e. immediate local root. All supported AlmaLinux releases (8, 9, 10) are affected through esp4 / esp6, which ship in the standard kernel package. AlmaLinux 9 and 10 are additionally affected through rxrpc, but only on systems that have installed the kernel-modules-partner package from the Devel repository. AlmaLinux 8 does not build rxrpc. The AlmaLinux core team has built patched kernels using the upstream skbuff fix, ahead of any Red Hat update, with ALESCo approval. They are available in the almalinux-testing repository today and will move to production once the community has helped verify them. AlmaLinux 8: kernel-4.18.0-553.124.2.el8_10 AlmaLinux 9: kernel-5.14.0-611.54.4.el9_7 AlmaLinux 10: kernel-6.12.0-124.56.2.el10_1 A dedicated Kitten 10 build will follow shortly. If you run AlmaLinux anywhere untrusted users can get a shell (multi-tenant hosts, container build farms, CI runners, shared developer boxes), please install the patched kernel from testing and help us verify it, or apply the one-line modprobe blacklist mitigation in the blog post. The same mitigation already used for Dirty Frag (esp4 / esp6 / rxrpc) also blocks Fragnesia, so if you applied that one you are already covered. Full write-up, install steps, NVRs, and the mitigation command: https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/ References: NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46300 Red Hat: https://access.redhat.com/security/cve/CVE-2026-46300 PoC: https://github.com/v12-security/pocs/tree/main/fragnesia Please report any problems with the patched kernel in https://chat.almalinux.org or on https://bugs.almalinux.org so we can get this into the production repositories quickly. -- Jonathan Wright AlmaLinux OS Foundation Mattermost: chat <https://chat.almalinux.org/almalinux/messages/@jonathan>

1 0

[Security Advisory] ALSA-2026:13644: corosync security update (Moderate)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-05-13 Summary: The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-13644.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:15969: glib2 security update (Moderate)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-05-13 Summary: GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-15969.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:14790: libpng security update (Moderate)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-05-13 Summary: The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-14790.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:16014: freerdp security update (Moderate)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-05-13 Summary: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997) * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) * FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982) * FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-16014.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:14791: libpng security update (Moderate)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-05-13 Summary: The libpng packages contain a library of functions for creating and manipulating Portable Network Graphics (PNG) image format files. Security Fix(es): * libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-14791.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:15887: openexr security update (Important)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-05-13 Summary: OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-15887.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:15892: thunderbird security update (Important)
by AlmaLinux Errata Notifications 13 May '26

13 May '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-05-13 Summary: Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) * firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) * firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) * firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) * firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) * firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) * firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) * firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) * firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) * firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) * firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) * firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) * firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) * firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) * firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) * firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) * firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-15892.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0