- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:94500: fence-agents security update (Critical)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-11-04 Summary: The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-94500.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94533: cockpit security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Denial of Service in `cockpit-ws` due to URL-root handling without a trailing slash (CVE-2026-91147) * cockpit: Cockpit: Denial of Service via unbounded connection thread spawning (CVE-2026-91149) * cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via CockpitLang cookie in send_login_html (CVE-2026-76235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-94533.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93975: gimp security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: GIMP: heap buffer overflow in DDS loader on crafted DirectDraw Surface file (CVE-2026-106062) * gimp: gimp: heap out-of-bounds read/write in PSD thumbnail loader (load_resource_1033) (CVE-2026-112257) * gimp: gimp: use-after-free in XCF loader via PROP_LINKED and PROP_SELECTION on channels (CVE-2026-112258) * gimp: gimp: heap out-of-bounds read in XCF text-layer parasite parsing (CVE-2026-112260) * gimp: gimp: use-after-free in XCF loader via PROP_SELECTED_PATH (CVE-2026-112261) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93975.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93617: opentelemetry-collector security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93617.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:91580: webkit2gtk3 security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-03 Summary: WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * chromium-browser: angle: Use after free in ANGLE (CVE-2026-95325) * chromium-browser: angle: Out of bounds write in ANGLE (CVE-2026-95331) * chromium-browser: angle: Out of bounds read in ANGLE (CVE-2026-106304) * chromium-browser: angle: Buffer overflow in ANGLE (CVE-2026-106247) * chromium-browser: angle: Type confusion in ANGLE (CVE-2026-106293) * chromium-browser: angle: Uninitialized resource in ANGLE (CVE-2026-106245) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-91580.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88421: qemu-kvm security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-04 Summary: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080) Bug Fix(es) and Enhancement(s): * qemu-img can't create a qcow2 overlay with 'data_file' feature on top of a file without destroying the original image [almalinux-9.8.z] (JIRA:AlmaLinux-164549) * live migration of a VM with a scsi3pr to a node that previously held a reservation on that disk fails. [almalinux-9.8.z] (JIRA:AlmaLinux-280223) * Fix pending QEMU issues for L1VH GA - QEMU [almalinux-9.8.z] (JIRA:AlmaLinux-283121) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88421.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94501: fence-agents security update (Critical)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-11-04 Summary: The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance (CVE-2026-102266) * pyjwt: PyJWT: Authentication bypass via improper public key validation (CVE-2026-102268) * pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets (CVE-2026-102271) * pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects (CVE-2026-102267) * pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling (CVE-2026-102272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94501.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94630: dpdk security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: dpdk: Missing memory size validation before mmap in vhost memory region setup (CVE-2026-86561) * dpdk: dpdk: Control-queue descriptor double-fetch overflows host heap in DPDK vhost (VDUSE) (CVE-2026-86562) * dpdk: dpdk: Double offset bug in vhost log mapping calculation (CVE-2026-86563) * dpdk: dpdk: Guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write (CVE-2026-86565) * dpdk: dpdk: Guest with runt RX descriptors underflows copy length in vhost enqueue (split and packed rings) (CVE-2026-86566) * dpdk: dpdk: VDUSE handler fails to invalidate vring pointers when IOTLB is invalidated, leading to use-after-unmap (CVE-2026-86567) * dpdk: dpdk: Guest-triggered use-after-free and type confusion in vhost-crypto session cleanup (CVE-2026-86845) * dpdk: dpdk: Guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto (CVE-2026-86846) * dpdk: dpdk: Guest can trigger infinite loop in vhost-crypto writeback chain cleanup (CVE-2026-86847) * dpdk: dpdk: Time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto (CVE-2026-86848) * dpdk: dpdk: Integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto (CVE-2026-86849) * dpdk: dpdk: Stack and heap buffer overflow in nfp vDPA driver (CVE-2026-86856) * dpdk: dpdk: Guest-triggered out-of-bounds walk via vhost indirect descriptor length TOCTOU (CVE-2026-93683) * dpdk: dpdk: heap out-of-bounds read/write in GSO header copy (CVE-2026-100236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94630.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:94514: freerdp security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of Service via uninitialized progressive tile handling (CVE-2026-109242) * freerdp: FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (CVE-2026-109676) * freerdp: FreeRDP: Unauthenticated keystroke injection via premature input dispatch (CVE-2026-110838) * freerdp: freerdp: Denial of Service via file descriptor exhaustion in serial device handling (CVE-2026-110830) * freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding (CVE-2026-110837) * freerdp: freerdp: Denial of Service via unbounded memory consumption during RDPDR reassembly (CVE-2026-110833) * freerdp: FreeRDP: Denial of Service via grayscale JPEG clipboard conversion (CVE-2026-110839) * freerdp: freerdp: Denial of Service via memory exhaustion in NLA frame parser (CVE-2026-111378) * freerdp: FreeRDP: Arbitrary code execution via crafted persistent cache file (CVE-2026-111379) * freerdp: freerdp: Arbitrary code execution via crafted persistent cache file (CVE-2026-111381) * freerdp: freerdp: Arbitrary code execution via crafted display frames (CVE-2026-111382) * freerdp: freerdp: Denial of Service via heap out-of-bounds write in NTLM authentication (CVE-2026-111880) * freerdp: FreeRDP: heap buffer overflow in server rdpsnd via crafted audio formats (CVE-2026-114045) Bug Fix(es) and Enhancement(s): * Rebase FreeRDP to 3.32.2 or newer [rhel-10.2.z] (JIRA:RHEL-277442) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-94514.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93596: opentelemetry-collector security update (Important)
by AlmaLinux Errata Notifications 04 Nov '26

04 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-04 Summary: Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93596.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0