Most recent entries from osv_almalinux

ALSA-2026:74464 — Moderate: ghostscript security update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:10: ghostscript, AlmaLinux:10: ghostscript-doc, AlmaLinux:10: ghostscript-tools-dvipdf, AlmaLinux:10: ghostscript-tools-fonts, AlmaLinux:10: ghostscript-tools-printing, AlmaLinux:10: libgs, AlmaLinux:10: libgs-devel

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74457 — Moderate: ghostscript security update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:9: ghostscript, AlmaLinux:9: ghostscript-doc, AlmaLinux:9: ghostscript-tools-dvipdf, AlmaLinux:9: ghostscript-tools-fonts, AlmaLinux:9: ghostscript-tools-printing, AlmaLinux:9: ghostscript-x11, AlmaLinux:9: libgs, AlmaLinux:9: libgs-devel

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74442 — Important: libpcap security update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:10: libpcap, AlmaLinux:10: libpcap-devel

The libpcap packages provide a portable framework for low-level network monitoring. The libpcap library provides network statistics collection, security monitoring, and network debugging.

Security Fix(es):

* libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access (CVE-2026-0799)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74441 — Important: libpcap security update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:9: libpcap, AlmaLinux:9: libpcap-devel

The libpcap packages provide a portable framework for low-level network monitoring. The libpcap library provides network statistics collection, security monitoring, and network debugging.

Security Fix(es):

* libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access (CVE-2026-0799)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74424 — Important: libvirt security, bug fix, and enhancement update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:9: libvirt, AlmaLinux:9: libvirt-client, AlmaLinux:9: libvirt-client-qemu, AlmaLinux:9: libvirt-daemon, AlmaLinux:9: libvirt-daemon-common, AlmaLinux:9: libvirt-daemon-config-network, AlmaLinux:9: libvirt-daemon-config-nwfilter, AlmaLinux:9: libvirt-daemon-driver-interface, AlmaLinux:9: libvirt-daemon-driver-network, AlmaLinux:9: libvirt-daemon-driver-nodedev and 22 more

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

* libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917)

Bug Fix(es) and Enhancement(s):

* Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z] (JIRA:AlmaLinux-224986) * Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74370 — Important: gvfs security update

Thu, 01 Oct 2026 00:00:00 +0000

Affected: AlmaLinux:9: gvfs, AlmaLinux:9: gvfs-client, AlmaLinux:9: gvfs-devel, AlmaLinux:9: gvfs-fuse, AlmaLinux:9: gvfs-goa, AlmaLinux:9: gvfs-gphoto2, AlmaLinux:9: gvfs-mtp, AlmaLinux:9: gvfs-smb

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer.

Security Fix(es):

* gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74133 — Moderate: kernel security, bug fix, and enhancement update

Wed, 30 Sep 2026 00:00:00 +0000

Affected: AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: net/liquidio: drop cached VF pci_dev LUT (CVE-2026-72329) * kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)

Bug Fix(es) and Enhancement(s):

* [AlmaLinux 8.10] "kernel BUG at lib/list_debug.c:28!": list_add corruption in register_trace_event AlmaLinux 8.10 (JIRA:AlmaLinux-214136) * request_key_auth use-after-free on every request-key upcall since 4.18.0-553.165.1 (regression from CVE-2026-63823 backport) (JIRA:AlmaLinux-270349)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74132 — Moderate: kernel-rt security, bug fix, and enhancement update

Wed, 30 Sep 2026 00:00:00 +0000

Affected: AlmaLinux:8: kernel-rt, AlmaLinux:8: kernel-rt-core, AlmaLinux:8: kernel-rt-debug, AlmaLinux:8: kernel-rt-debug-core, AlmaLinux:8: kernel-rt-debug-devel, AlmaLinux:8: kernel-rt-debug-modules, AlmaLinux:8: kernel-rt-debug-modules-extra, AlmaLinux:8: kernel-rt-devel, AlmaLinux:8: kernel-rt-modules, AlmaLinux:8: kernel-rt-modules-extra

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

Bug Fix(es) and Enhancement(s):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ALSA-2026:74095 — Important: rsync security, bug fix, and enhancement update

Wed, 30 Sep 2026 00:00:00 +0000

Affected: AlmaLinux:8: rsync, AlmaLinux:8: rsync-daemon

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.

Security Fix(es):

* rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460) * rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789) * rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790) * rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458) * rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464) * rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803) * rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784) * rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463) * rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452) * rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795) * rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456) * rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793) * rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453) * rsync: rsync: Information disclosure and denial o…

ALSA-2026:74084 — Critical: webkit2gtk3 security update

Wed, 30 Sep 2026 00:00:00 +0000

Affected: AlmaLinux:8: webkit2gtk3, AlmaLinux:8: webkit2gtk3-devel, AlmaLinux:8: webkit2gtk3-jsc, AlmaLinux:8: webkit2gtk3-jsc-devel

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

* chromium-browser: skia: chromium-browser: skia: Inappropriate implementation in Skia (CVE-2023-4860) * chromium-browser: angle: Out of bounds memory access in ANGLE (CVE-2024-7532) * chromium-browser: skia: chromium-browser: skia: Out of bounds memory access in Skia in Google Chrome allows a remote attacker who had compromised the renderer process to perform out of bounds memory access via a crafted HTML page (CVE-2024-7966) * chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8193) * chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8198) * chromium: skia: chromium: skia: Heap buffer overflow in Skia (CVE-2024-8636) * chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia in Google Chrome (CVE-2024-9123) * chromium-browser: skia: chromium-browser: skia: Integer overflow in Skia (CVE-2025-0436) * chromium-browser: skia: chromium-browser: skia: Use after free in Skia (CVE-2025-0444) * chromium-browser: angle: ANGLE Out-of-Bounds Write Vulnerability (CVE-2025-8901) * chromium-browser: angle: Use after free in ANGLE (CVE-2025-9478) * chromium-browser: angle: Heap buffer overflow in ANGLE (CVE-2025-10502) * chromium-browser: angle: Use after free in ANGLE (CVE-2026-0908) * chromium-browser: angle: Integer overflow in ANGLE (CVE-2026-3536) * chromium-browser: skia: chromium-browser…