ALBA-2026:39332 Copyright 2026 AlmaLinux OS 0 1 None

kernel bug fix and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Bug Fix(es) and Enhancement(s): * XFS data corruption using reflink [almalinux-9.8.z] (JIRA:AlmaLinux-193937) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.26.1.el9_8.aarch64.rpm 64c862ac76ff3d149757ba94ec5d7061b73d75f2c05ece96c306562db340e3c1 kernel-cross-headers-5.14.0-687.26.1.el9_8.aarch64.rpm 82572d8138443ee582d57e8b1026d7a59577377d33b52e5f2ffd1e23e0b08bcc libperf-5.14.0-687.26.1.el9_8.aarch64.rpm b5c553ec8a7b18244dad655c948a48776fadc7a0d7daf85e789f88e2a6a8f1c6 ALSA-2022:5249 Copyright 2022 AlmaLinux OS 0 1 Important

An update for kernel-cross-headers is now available for AlmaLinux 9.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012) * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966) * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643) * SR-IOV performance > 50% degradation (BZ#2074830) * fix data corruption caused by dm-integrity (BZ#2082187) * SCTP client-side peeloff issues [almalinux-9] (BZ#2084044) * TCP connection fails in a asymmetric routing situation (BZ#2085480) * Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963) * spec: Fix separate tools build (BZ#2090852) * call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered (BZ#2092255) * Mark ThunderX NIC driver as unmaintained (BZ#2092638) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default kernel-core-5.14.0-70.17.1.el9_0.aarch64.rpm 1973204a12f772cabbbf6f828d44270c0aebfa76cde8e0bb13478a6a9cf15cc1 kernel-devel-5.14.0-70.17.1.el9_0.aarch64.rpm 24264b2d6eb85e23df8faf7bac42fe19928e5e37c6ebfbc0741da102fa392aa2 kernel-debug-modules-5.14.0-70.17.1.el9_0.aarch64.rpm 2459f9c5274396bee3933ccab6349d2de9cb32cd4d37f1e7c5156d53bd9e752f kernel-cross-headers-5.14.0-70.17.1.el9_0.aarch64.rpm 3755ecc0139e5e5b73e1114ae3642e345f52b1a329dd5b433e7afbc8bd26007e kernel-tools-libs-5.14.0-70.17.1.el9_0.aarch64.rpm 3b48d28230eab4f6042d0b1b8865421f7c6dac7111ccb3c04f6eccb4706e9d3c perf-5.14.0-70.17.1.el9_0.aarch64.rpm 414a934a4a0755bbd611979f739f7b292603fd145bdb2c06c2ea7450879356f2 kernel-devel-matched-5.14.0-70.17.1.el9_0.aarch64.rpm 4663351dd15bd542878824e76fc535f2760aed8b63790d6bd5196b9c374e1dea kernel-modules-5.14.0-70.17.1.el9_0.aarch64.rpm 488bd1cc7ba1150569a6c8f0dfd472a927a64166d0ebc53c5a3131e9c71fe016 kernel-modules-extra-5.14.0-70.17.1.el9_0.aarch64.rpm 61c72357ca827002864b8c3b0741503f26b4f1e6fafe53a6d947532aa2432e8e kernel-abi-stablelists-5.14.0-70.17.1.el9_0.noarch.rpm 6c1459fb8b333303c7d981e116ccc0720c4f02c49ad9b933a93cdd2a4dc0f103 kernel-debug-devel-matched-5.14.0-70.17.1.el9_0.aarch64.rpm 70c139630107375863d21b843fc7d8ed0642dd5c4a1ea911849b457995124dfb kernel-debug-5.14.0-70.17.1.el9_0.aarch64.rpm 7be3a3dc1dd85e34d430a444dc5c9c306e9d6085804059de7d2c8becb3ff965b kernel-tools-libs-devel-5.14.0-70.17.1.el9_0.aarch64.rpm 7e450e4be54e447fe989840e1f62239b9eb70b320a08440afcbc49086b4f38ed kernel-doc-5.14.0-70.17.1.el9_0.noarch.rpm 809a6a2193762c20c65675927231f196c18a5b97e6832f1fe1714467a5b785ca kernel-5.14.0-70.17.1.el9_0.aarch64.rpm 864d2631ed16b69edfa9eacea9bf3d39cc4cbd5a73125183836651f5a1a96bd0 python3-perf-5.14.0-70.17.1.el9_0.aarch64.rpm 90ddf05e5e061db41b9bcd34be991c624da18a2649b9c68840517db936eb4120 kernel-debug-devel-5.14.0-70.17.1.el9_0.aarch64.rpm 92e55cc526633d6c580bae63f800f10ae544f445249c1e5f47980a6122e7e905 kernel-debug-modules-extra-5.14.0-70.17.1.el9_0.aarch64.rpm 97d17f1ac6000c8a8872492a11abae29868487e40b17979780b73778ed8176b8 kernel-headers-5.14.0-70.17.1.el9_0.aarch64.rpm b36fdf835203dca1c5b0d554fbb96a0ff27937e4998a0a09393b21ff88981195 bpftool-5.14.0-70.17.1.el9_0.aarch64.rpm d20599cdde45282d6f9c799120e1587445299d8effecf93b1c458403f41ddec8 kernel-tools-5.14.0-70.17.1.el9_0.aarch64.rpm e650469c4d74b601aa2ae274418123b726638d26e32c46b127bcb6265acf9fef kernel-debug-core-5.14.0-70.17.1.el9_0.aarch64.rpm f7c7b0da3e8d1846170717a17cf7f70131df1667f5f4ae0af86f6526a6256674 ALSA-2022:5252 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libarchive-devel is now available for AlmaLinux 9.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: an out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default libarchive-3.5.3-2.el9_0.aarch64.rpm 155491dded2a1576be137bef4d2289693ab1d1c706e03d83f00bf898869f39cd bsdtar-3.5.3-2.el9_0.aarch64.rpm 28d76814b85119baadaa92702e877cfb0daa48561d26af6a240197b14d39bfbf libarchive-devel-3.5.3-2.el9_0.aarch64.rpm f1df8b4c8417ba417697bb6b9c4f8a33753d157a95ab2dd613d568bf8c689bb0 ALSA-2022:5257 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libinput-devel is now available for AlmaLinux 9.

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default libinput-1.19.3-2.el9_0.aarch64.rpm 7446f72679817160ab134136345579b5db0845ec21b65e2dc8eefce096940c2f libinput-devel-1.19.3-2.el9_0.aarch64.rpm 83b676e0c1946352dba5b6d36349bb5d1f80822acf98a2143c34bb8384250aa4 libinput-utils-1.19.3-2.el9_0.aarch64.rpm e9636a15a5931ae4a41782ce213794d9afcbbb130aafbffb9376618f2286af8e ALSA-2022:5695 Copyright 2022 AlmaLinux OS 0 1 Important

An update for java-11-openjdk-demo-fastdebug is now available for AlmaLinux 9.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084777) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-11] (BZ#2099915) * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-11] (BZ#2107866) * Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-11] (BZ#2107868) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-11-openjdk-static-libs-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 021e39f308968d922ebaa0545c2a756b90a012ac71e16ab6ed7a61a8dbe7026a java-11-openjdk-headless-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 08e564f853519dfb3785d62e9f3b54bc8392770528d5689fdb5f17d5cb2f9527 java-11-openjdk-headless-11.0.16.0.8-1.el9_0.aarch64.rpm 124bc56877f6a1b7adca954a2027908194f424b496498637e746e3c06421ab34 java-11-openjdk-jmods-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 1afaab660240cea1d982d19dfdff88780625b060ac40afbbc8ca773738123c15 java-11-openjdk-src-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 1c20b85ab21695ce04b9783864f586bd09ca1f20a7814017247d6acf5004a72f java-11-openjdk-static-libs-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 28e8a092370355f3eaed00446f7f8f527dfae185f64dd856601d9ff5db774022 java-11-openjdk-devel-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 49edc25edea0fe09f3eda8702c399ec61d20a0bc3040d32d7b2af46c3257c9ad java-11-openjdk-jmods-11.0.16.0.8-1.el9_0.aarch64.rpm 4aec530d59bd5ffde2b117ac2993c5c2ccf63347584e5e8c8772927a2d0d8f51 java-11-openjdk-static-libs-11.0.16.0.8-1.el9_0.aarch64.rpm 5dd0bd4bc5bf20159a3980049e4cefb2506b7df2918885686ebf13a0b0dd1e4a java-11-openjdk-headless-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 60d5f51f9ea3cb4a1d66d53d7ff570f03ceac17d057068ac14c8c0afe197c4a7 java-11-openjdk-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 65e60063b72b7bb2ec05bec64b8e351b61556f66d001c5f72c0622eada48e072 java-11-openjdk-devel-11.0.16.0.8-1.el9_0.aarch64.rpm 690d8d7f337dc0d293ecc1106f71a1e177e4466971258fde47e528cb664e8c55 java-11-openjdk-11.0.16.0.8-1.el9_0.aarch64.rpm 7f178f3b586ce1624d850c1450b29d13e1635697a6be7d43e044523d2a9f4587 java-11-openjdk-src-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 81d2e216cabc56e78154add60556d04aaddd2f8ccb4f35b298ff480d08b5475e java-11-openjdk-demo-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 8628a2b920f22be23ecc9b5efa3f5616d01df1736960c683a68c6f7928e235dc java-11-openjdk-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 8918c6a66c0d13e953d1a8694b34b7fc119ff4fb8dd806cf3a59550b7352c656 java-11-openjdk-demo-11.0.16.0.8-1.el9_0.aarch64.rpm 8f4b913f223800919f810cdedf53ff52be861f2e0e21cf67774ede3677e5b9da java-11-openjdk-devel-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm 9239feb81c52164a8640624489b22566b7799b99ef6eed404126360339d1e90d java-11-openjdk-jmods-slowdebug-11.0.16.0.8-1.el9_0.aarch64.rpm bc53aad1730b290fdc3efd632cd1cee18d111379ebaf82d778d7e48f38898e2e java-11-openjdk-demo-fastdebug-11.0.16.0.8-1.el9_0.aarch64.rpm cf01e2727b3214c43b4df2ac973d52c0ba7099df2121cf974df461f969051541 java-11-openjdk-javadoc-zip-11.0.16.0.8-1.el9_0.aarch64.rpm e03da2cfaf40b83601add6336963a3b68f41fbe51c91803d11aca5812c39fe4f java-11-openjdk-javadoc-11.0.16.0.8-1.el9_0.aarch64.rpm ee9a302d6582f14d7e3f9c581eadfdc70580f9696b2a59efb2de3926ddf47bb7 java-11-openjdk-src-11.0.16.0.8-1.el9_0.aarch64.rpm f59abc3ebe1d133beafdae2cf43c1d1f25ceb05d18e4bc9cebcf144e7ac79026 ALSA-2022:5709 Copyright 2022 AlmaLinux OS 0 1 Important

An update for java-1.8.0-openjdk-demo-fastdebug is now available for AlmaLinux 9.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084776) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-8] (BZ#2099916) * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-8] (BZ#2107956) * Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-8] (BZ#2107958) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-1.8.0-openjdk-javadoc-1.8.0.342.b07-1.el9_0.noarch.rpm 016c0c76cdcb9e6561492bf3c35a2cedde2695d2d3573cb0ca2a4fa753bf5a75 java-1.8.0-openjdk-demo-fastdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 13e54f68938741e20c7a4f2b0e688e9d7a020dd68ea8a55a133537bdb3bbea84 java-1.8.0-openjdk-demo-slowdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 1d5573506ba207469a24e19e1d9e16656ad23ce123699cbba5b95972676053b5 java-1.8.0-openjdk-devel-1.8.0.342.b07-1.el9_0.aarch64.rpm 2f7dcfbd8090f5c5b4c1c4b6dcdecd481672aacf671bc2930496269e307d67ef java-1.8.0-openjdk-src-1.8.0.342.b07-1.el9_0.aarch64.rpm 43bd8187df04dfc07d97fb47910f51119fbe8cec30a2437278de2f9f25829405 java-1.8.0-openjdk-headless-1.8.0.342.b07-1.el9_0.aarch64.rpm 43fc934b3e971d3bf6deeea265bbeb70d4cfe002255227aa13078e3dc88262ab java-1.8.0-openjdk-devel-slowdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 4a75ca2a7e9ba3dfbb997ce961324292dea354bb946cd721a86b52215e506657 java-1.8.0-openjdk-headless-fastdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 55795e2d5144b2ad8fd161a8c5c835cff0783b48399c8b205f9911fd9511c02e java-1.8.0-openjdk-src-fastdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 62ed8b234dd41cb5da9e477a061fb157384caa31c75e49601e8e4bdb45b6a2a9 java-1.8.0-openjdk-devel-fastdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 65f3bb2e57497d0604a012c2963375d26620fd4bbc208d7ba31add2493d58fa9 java-1.8.0-openjdk-headless-slowdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm 89731d39b9f406779e49f5b31338d11ed108354c6fc33fffae824a75939e7840 java-1.8.0-openjdk-1.8.0.342.b07-1.el9_0.aarch64.rpm ad0a803a01a8a6509a4ae6a2edcd5c3339c06b484fdd11fa9be36123107eeb7b java-1.8.0-openjdk-demo-1.8.0.342.b07-1.el9_0.aarch64.rpm b064f1e72fe6bc3ea466eed81d457758f85dc915844d0c6be4d8b745cd95778c java-1.8.0-openjdk-src-slowdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm b69900b4f3d8d0f1d27611fdb3dbc82c72dd21c7dd97cb637d34a3e18d109626 java-1.8.0-openjdk-slowdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm b7aed5fbdb3d6beb5a28b9ce85c48d33da741e6e10e016aa2a97d436a1c0666c java-1.8.0-openjdk-fastdebug-1.8.0.342.b07-1.el9_0.aarch64.rpm bc2ce7c6832e2fb2c60b46cb5284a3c3bbb1e4e1c377e7001a75645cd6bad5d6 java-1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-1.el9_0.noarch.rpm eef6d2e8806b1e7e959d8ea2224f3ff6f2aa5e4802e5b61ddcebf3adad114d9b ALSA-2022:5736 Copyright 2022 AlmaLinux OS 0 1 Important

java-17-openjdk security, bug fix, and enhancement update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8). (BZ#2084779) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) * OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previous AlmaLinux builds of OpenJDK 17 altered the arguments passed to sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an additional form of the method, retaining the original arguments, so that applications which depend on this internal method continue to function with AlmaLinux builds of OpenJDK. (BZ#2099919) * With previous AlmaLinux builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2105395) * With the release of AlmaLinux, a change was made so that disabling OpenJDK FIPS mode required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.AlmaLinux.fips=false options, with the intention that FIPS mode could be controlled independently of system security properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is required to disable FIPS mode, as in AlmaLinux. (BZ#2107941) * Previous AlmaLinux builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a lack of module access permissions. This has now been corrected. (BZ#2107943) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-17-openjdk-headless-17.0.4.0.8-2.el9_0.aarch64.rpm 2ef141ae996191fe833e1e78b150d990d3a6c3462e132218d1c8a63119a5f629 java-17-openjdk-src-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 37d549cd95384b7f9ff7bfe29acbd13dfe54d5df6776fdaee2f947e67f4b7a9c java-17-openjdk-headless-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 51f05ad89cd1c32bdac79ea258c551c18e8119c98c96e761610fe8004d619c81 java-17-openjdk-devel-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 5227f7d43c3176cad97208a62984c1637eeef1ebb7356916ee34aa141a099b1b java-17-openjdk-devel-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 56c0516eb1e521c6a5d7abab68c129d148c05daf51fac2b1ff311ccffccc5ad5 java-17-openjdk-demo-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 58bbb5fce4c43c518fc60b12d0ad37dead79937d3b5c334fec0714559794a399 java-17-openjdk-javadoc-zip-17.0.4.0.8-2.el9_0.aarch64.rpm 5afb5eae76028f9c0862b9d41955a571d42f318ff2ac7f16c2e7509630a9febe java-17-openjdk-static-libs-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 5b78636c828e5b4ab9e9ca7223ddf3b3e1d87eb2ba714115a205955d1fb6dc79 java-17-openjdk-headless-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 6239b02ae30d74913b5d67d0cf7adc117e4fb66cb50ec054822e32662cb7fb95 java-17-openjdk-demo-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm 6279e8c2514b95e7c19644794cef2efe6e14397dd78b459db33a15752d86b4c4 java-17-openjdk-jmods-17.0.4.0.8-2.el9_0.aarch64.rpm 648308f626f817ebe8888676f256c891b7a7789cf44edbbcc314b06b1ba57700 java-17-openjdk-static-libs-17.0.4.0.8-2.el9_0.aarch64.rpm 995995c7daa771ba9aa034ee29981544ea2367a1748ad6514977b5ff85871f97 java-17-openjdk-javadoc-17.0.4.0.8-2.el9_0.aarch64.rpm aac358a1c551e5e4b93e1ea1b2814b65179d6a0a0cbcf6466c32e5253ca1f065 java-17-openjdk-jmods-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm abe5a1e1e24224eed90d14a49a8afcd34bde7e675ed2c93ef54877e38818dd30 java-17-openjdk-src-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm ae687b0946b405aaf9da438153023b5123e340f808e52b187dfd57d8b906e89d java-17-openjdk-demo-17.0.4.0.8-2.el9_0.aarch64.rpm b4402503754a28e8e90a7ada107dbd1e1c99edb9240ebfed8fa209b19d6f67c4 java-17-openjdk-static-libs-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm b82d534bcd3e609e5718ae2d6f10ce4580a646e7a2e4662e86e95a70cf431d23 java-17-openjdk-devel-17.0.4.0.8-2.el9_0.aarch64.rpm caf25c6f124f2fe59efaa5899fbe9deddc8222f0e0f5eece9c9848873b689d95 java-17-openjdk-jmods-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm cd74dcb3d0eb2928fdd0fb16c72881934a0d86a1a9c466c4b35155ead8114fef java-17-openjdk-17.0.4.0.8-2.el9_0.aarch64.rpm df3efeed575ce8a9e1c76bf2ea3cb4350c95884c7d83b3ddb8029f62fbc35ba7 java-17-openjdk-src-17.0.4.0.8-2.el9_0.aarch64.rpm f5d6870addf32cd8c8b512b647a55979cdc195ab088dd15d3e2ebd4cb1834605 java-17-openjdk-slowdebug-17.0.4.0.8-2.el9_0.aarch64.rpm fa7ada42802a43f13fd34ea30084abdd9460825db9a245bb6ac5515a98687847 java-17-openjdk-fastdebug-17.0.4.0.8-2.el9_0.aarch64.rpm fefe99f806e34b68d1f9e5b7463f7ebd698f2e67ef229da3081a28c97ead0409 ALSA-2022:5948 Copyright 2022 AlmaLinux OS 0 1 Moderate

galera, mariadb, and mysql-selinux security, bug fix, and enhancement update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default mariadb-devel-10.5.16-2.el9_0.aarch64.rpm 146b0b5217618b0304f10a2470a8d5e0db6a99349d360b6807e62181f5475b3d mariadb-server-galera-10.5.16-2.el9_0.aarch64.rpm 2898ec19d2d60a138ab94f958ee9c6e9697e8aa391b0f955262f781ef3871786 mariadb-test-10.5.16-2.el9_0.aarch64.rpm 62c8765ac5fa9cb1770372d8976b45f4151feefb69c5f129c318d3cea0309c8f mariadb-gssapi-server-10.5.16-2.el9_0.aarch64.rpm 7ea1c913b46a136a7d4e14f098df4b5807f087e3dac31b6f1eb8a88886c012a0 mariadb-server-utils-10.5.16-2.el9_0.aarch64.rpm 8d3c8ba61504aa400c720710447d7045847fc7dc8e2b3b269101527070668a91 mariadb-backup-10.5.16-2.el9_0.aarch64.rpm 8e5f4d8090355278e37fc867d90ade26c74ac2c0634d0c0765a3049779dc7183 mariadb-10.5.16-2.el9_0.aarch64.rpm 90d775365b1bc7f942897f52eda13aceae35d5ce070d4f81c8e5568cee8a029a mariadb-errmsg-10.5.16-2.el9_0.aarch64.rpm 949affc68b2ba63c6dfc8f013355993428418522563fac9a6e5c56d04162ae57 mariadb-common-10.5.16-2.el9_0.aarch64.rpm 9c27720372d9e0a4c631360e9c759879c0eddcc6c51727f9fd09577cc9578b2b mariadb-embedded-10.5.16-2.el9_0.aarch64.rpm b1e67dc923d61ed166201cecd3c02e333474085bd5ce030977a14fe6d3f95807 mariadb-embedded-devel-10.5.16-2.el9_0.aarch64.rpm bfad67f9e719f3a6daba746d8c53914062e6e4fa08c97f3e757d0ae0cab7736e mariadb-server-10.5.16-2.el9_0.aarch64.rpm d24d51d575b134585808f34e94614723bf800892096dd341b9c9d6e1c0a01ce9 mariadb-oqgraph-engine-10.5.16-2.el9_0.aarch64.rpm e7a273a6fefd860ced01f729101ede60affa572c340092b0fc59cb6aef52555a mariadb-pam-10.5.16-2.el9_0.aarch64.rpm ef635d8b59ee8d5aa89775faf8ca51fd3b5fcdc1ed47688323405649fc35bac1 ALSA-2022:6003 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * information leak in scsi_ioctl() (CVE-2022-0494) * use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Power9 - LPAR fails to boot in shared processing mode and call traces are seen [Hash] (BZ#2092248) * Hard lockups are observed while running stress-ng and LPAR hangs (BZ#2092253) * FIPS module identification via name and version (BZ#2093384) * gfs2: File corruption with large writes when memory is tight (BZ#2097306) * i/o on initiator stuck when network is disrupted (4.18.0-372.9.1.el8.x86_64) (BZ#2098251) * AlmaLinux 9.1 doesn't support 3rd SATA (BZ#2099740) * Guest call trace when reboot after postcopy migration with high stress workload (BZ#2100903) * Oops or general protection fault with RIP decode_attr_security_label at decode_getfattr_attrs (BZ#2101854) * Oops as BUG: unable to handle page fault as free of uninitialized nfs4_label on nfs referral lookup (BZ#2101858) * lpar crash with Oops: Kernel access of bad area, sig: 11 [#1] when changing mtu of a bond interface (P10/ ibmvnic/ Haleakala) (BZ#2103085) * OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2109974) Enhancement(s): * iommu/vt-d: Make DMAR_UNITS_SUPPORTED a config setting (BZ#2105326) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default perf-5.14.0-70.22.1.el9_0.aarch64.rpm 0eb7d9f0ac3b9ebf57b4dcddacd068258fee009b0300672fc73bf3f3cc76d398 bpftool-5.14.0-70.22.1.el9_0.aarch64.rpm 11aa8fa25cb0c86c0ab9afacf0e49327a08b3f1e182a1c1badca56ad515ad620 kernel-debug-devel-5.14.0-70.22.1.el9_0.aarch64.rpm 19067b58234778af03dc1406968e83cf7204c772247fe6aae0e902dbba9e8dc6 kernel-doc-5.14.0-70.22.1.el9_0.noarch.rpm 232d05e4af484d9fb62fcffcdb7b23f898a654e8107f29507eaa1d61344427aa kernel-tools-5.14.0-70.22.1.el9_0.aarch64.rpm 26ac1360ed36248958f0de911dfd8bf26e3ad9dd1a4c08aff8162876ee8a4488 kernel-debug-modules-extra-5.14.0-70.22.1.el9_0.aarch64.rpm 3250c002bd3b0347f3de952c640d748b07483ac0d4eab7eba1ad3ac752b6c80e kernel-devel-5.14.0-70.22.1.el9_0.aarch64.rpm 39d1f784e6bbf88689a9763ad782f1b6f0ba8ec671dd5674554ea7f00f940580 python3-perf-5.14.0-70.22.1.el9_0.aarch64.rpm 53e1c95cf5302d8faed0e19d40a82fa484de071da8bcec5e63454206229fea62 kernel-debug-5.14.0-70.22.1.el9_0.aarch64.rpm 57a43bf16f0f7452f58d392c7069c7b99e1ce8a8acbb25a62444de6829e4c6be kernel-cross-headers-5.14.0-70.22.1.el9_0.aarch64.rpm 63b490aa9b228111f6f36c302ed5737345ea88ae035fb6fe7247773d1cf56815 kernel-debug-devel-matched-5.14.0-70.22.1.el9_0.aarch64.rpm 668d6a0f0fe6242b48cdd4dab0f049e001921cc2391e4dfd34883a3370a9d4ea kernel-tools-libs-5.14.0-70.22.1.el9_0.aarch64.rpm 847fd130e86944fb479b00add486721c88153b4d7ef8c43d5b55206e183e15ec kernel-debug-core-5.14.0-70.22.1.el9_0.aarch64.rpm 8ba59e43825dd20f3a745af5affdd9b39ba789ae033f1f82ba09862c902597b0 kernel-debug-modules-5.14.0-70.22.1.el9_0.aarch64.rpm 9001e8067883c7162f730f7a59594b27445a65b3939a57f4de1edb9cf1ed5ac0 kernel-modules-5.14.0-70.22.1.el9_0.aarch64.rpm 92c8eae307a024835f76633b28309131b7ad94a310ac34f09996f5e4d8afe301 kernel-abi-stablelists-5.14.0-70.22.1.el9_0.noarch.rpm a7507bb31645b36cd5120e3dee6c9f7928ea50fa4707527e8af610752ebdea2e kernel-tools-libs-devel-5.14.0-70.22.1.el9_0.aarch64.rpm aa0abc40b0a702614d2552fd79af91780b200c9aac5a8b41251763dabf0f2e60 kernel-headers-5.14.0-70.22.1.el9_0.aarch64.rpm c83bb3cfbc792bb291787b81cb79e2f56d54e18f6e3b3eb03fab25526b0a06c1 kernel-devel-matched-5.14.0-70.22.1.el9_0.aarch64.rpm cf2afe0a1ed9572489a002a48a9dd7870e27f1d44a7685efea4d867e43565da2 kernel-modules-extra-5.14.0-70.22.1.el9_0.aarch64.rpm d844866b6542a3631d9782d11e96fd310ab9bf3083e19faa462559cec49efb27 kernel-core-5.14.0-70.22.1.el9_0.aarch64.rpm e2ac0f626e2caaced755854b37aa4b3ffb16c524811e657a1b8204ba096918cd kernel-5.14.0-70.22.1.el9_0.aarch64.rpm fecda1093c65036388813c1ccac5eade9a95fd44ffa2a209ec02b7a17a14b7c3 ALSA-2022:6043 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.108 and .NET Runtime 6.0.8. Security Fix(es): * dotnet: External Entity Injection during XML signature verification (CVE-2022-34716) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default dotnet-templates-6.0-6.0.108-1.el9_0.aarch64.rpm 14b9c40c3cbc91fe5249b37ccb12aa078b854105d92e42fab556ffbad5739739 dotnet-host-6.0.8-1.el9_0.aarch64.rpm 180aefec52d84913ed741857cd97305eb364801b970ca56378671a68f1c74791 dotnet-sdk-6.0-6.0.108-1.el9_0.aarch64.rpm 2201cc2fb37ab21d6166ae81436a7ed6749203f4baabbfbf13fa007654828da2 dotnet-targeting-pack-6.0-6.0.8-1.el9_0.aarch64.rpm 372a53f55a185f528216c118155c8a273d44277a34a8f956ba7443ef58b72af9 dotnet-apphost-pack-6.0-6.0.8-1.el9_0.aarch64.rpm 593db43af07af8352960c8851598520851f0b2d1d08b8a40d288e5fb6b2518c4 dotnet-runtime-6.0-6.0.8-1.el9_0.aarch64.rpm 84ed309a949327c12735e0b5163964a69b503e8852fd32a5b37fcf6618707aa3 dotnet-hostfxr-6.0-6.0.8-1.el9_0.aarch64.rpm b2e794ed699181106b23a47c633643d1dbfe6bef9229105cc0c1227d13ae9241 aspnetcore-targeting-pack-6.0-6.0.8-1.el9_0.aarch64.rpm b9a58208d487d93908239c5f40801472afff52b267306c993ef44547b8683ca7 aspnetcore-runtime-6.0-6.0.8-1.el9_0.aarch64.rpm ba2327c99a34d124c23f09ded9f36b25dce6b478e1f3ddc390b881f3fad1f405 netstandard-targeting-pack-2.1-6.0.108-1.el9_0.aarch64.rpm d2f0b328aab7eba192d65b4710177a1fc3b942d8bfe5c6ae22c65a8a1b96f0be dotnet-sdk-6.0-source-built-artifacts-6.0.108-1.el9_0.aarch64.rpm e316e57bb13b902d053a8c57cbc24893cfde705eea5bb648a6c5e080a84e546a ALSA-2022:6521 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.109 and Runtime 6.0.9. Security Fix(es): * dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion. (CVE-2022-38013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el9_0.aarch64.rpm 2c1b5d67fcded9417e13396a4a32138eb73e5dea4e46138d90df9a063e324701 ALSA-2022:6585 Copyright 2022 AlmaLinux OS 0 1 Moderate

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428) Security Fix(es): * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default ruby-doc-3.0.4-160.el9_0.noarch.rpm c5aa94f05bb1afcbd2618a66cc942c7ed10a4ef69aae59317f0d3d7ee3173120 ALSA-2022:6590 Copyright 2022 AlmaLinux OS 0 1 Moderate

mysql security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.30). (BZ#2122589) Security Fix(es): * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21412, CVE-2022-21414, CVE-2022-21435, CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459, CVE-2022-21462, CVE-2022-21478, CVE-2022-21479) * mysql: Server: DML unspecified vulnerability (CPU Apr 2022) (CVE-2022-21413) * mysql: Server: Replication unspecified vulnerability (CPU Apr 2022) (CVE-2022-21415) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21423) * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21425, CVE-2022-21444) * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427) * mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21454) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022) (CVE-2022-21455) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21457) * mysql: Server: Logging unspecified vulnerability (CPU Apr 2022) (CVE-2022-21460) * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21509, CVE-2022-21525, CVE-2022-21526, CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553, CVE-2022-21556, CVE-2022-21569) * mysql: Server: Options unspecified vulnerability (CPU Jul 2022) (CVE-2022-21515) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21517, CVE-2022-21537, CVE-2022-21539) * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21522, CVE-2022-21534) * mysql: Server: Federated unspecified vulnerability (CPU Jul 2022) (CVE-2022-21547) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022) (CVE-2022-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Default logrotate set to wrong log file (BZ#2122592) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default mysql-libs-8.0.30-3.el9_0.aarch64.rpm 8cdae27f9d14fa0221b251e4363e85b450d158fc8cb797c724b74f4e64b7e77f mysql-devel-8.0.30-3.el9_0.aarch64.rpm 91864d57d84d35645c45f16e8de468e6dd11f0b24c567465cf9c1f5fb0056aaa mysql-test-8.0.30-3.el9_0.aarch64.rpm d611483961041025657d778b0b95123a0af2d2cdf7ac6260eb57576a7700c8f6 ALSA-2022:6610 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918) * kernel: vulnerability of buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * RDMA/mlx5: Fix number of allocated XLT entries (BZ#2092270) * mlx5, Setup hanged when run test-route-nexthop-object.sh (BZ#2092535) * many call traces from unchecked MSR access error: WRMSR to 0x199 in amazon i4.32xlarge instance (BZ#2099417) * X86/platform/UV: Kernel Support Fixes for UV5 platform (BZ#2107732) * block layer: fixes for md sync slow and softlockup at blk_mq_sched_dispatch_requests [9.0.0.z] (BZ#2111395) * Fixes for NVMe/TCP dereferences an invalid, non-canonical pointer, kernel panic (BZ#2117755) * Adding missing nvme fix to AlmaLinux-9.1 (BZ#2117756) * nvme/tcp mistakenly uses blk_mq_tag_to_rq(nvme_tcp_tagset(queue) (BZ#2118698) * Important ice bug fixes (BZ#2119290) * Power 9/ppc64le Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2121719) Enhancement(s): * lscpu does not show all of the support AMX flags (amx_int8, amx_bf16) (BZ#2108203) * ice: Driver Update (BZ#2108204) * iavf: Driver Update (BZ#2119477) * i40e: Driver Update (BZ#2119479) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default kernel-tools-libs-devel-5.14.0-70.26.1.el9_0.aarch64.rpm 0ab86ed45a95a6ee7ee06c2a23bcae50ef930543487598664bbfd242c22406d2 kernel-cross-headers-5.14.0-70.26.1.el9_0.aarch64.rpm 3b14469a9d9002aa5ad0bb20ad8add0d9555e2e07f5b415157178af3163b2cc3 ALSA-2022:6763 Copyright 2022 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080) * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177) * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default bind-devel-9.16.23-1.el9_0.1.aarch64.rpm 554042dbd95f1e0249beeed93709b4c8943e52532a8a74a66d694d81e2b04b46 ALSA-2022:6913 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.110 and .NET Runtime 6.0.10. Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.110-1.el9_0.aarch64.rpm 3401965051207c3da4f81fd96d86b544a8ac3466377658f9de7a5fc739eacf20 ALSA-2022:6999 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [almalinux-9] (BZ#2132934) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-17-openjdk-devel-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 0988e240cf793761279dbbf997a1c9175917f42d3261af1d9a920f3c85ba0888 java-17-openjdk-jmods-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 129832609145cdae735b6d7b3dcd282017cb3dc36b2fa4f88b2f46099ac1254f java-17-openjdk-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 16eb708033b384e680050d21509166f15620d94c00f13f38673d47f927f6a6da java-17-openjdk-devel-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 3b0d5f1da20502094b579fe0d22bb8fb565628bf3e8d75d5f005860d92e3ed5c java-17-openjdk-src-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 3f48db204cbc365b6620d90711df1b9aa0e6da85ef544bf594bcde614dd8bf37 java-17-openjdk-demo-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 4e22fe62f2975371a1cc575bac3f1bcec10445eaf99f0023c11eac7440ce054c java-17-openjdk-static-libs-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 6185d93a2acbe695f0ae9fc42c9fed71366ffc3aed4ef5e20848e9d228fa99bd java-17-openjdk-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 890800e57b4cb0591bc7825759abff4092e130cadd9230808c81959aef845827 java-17-openjdk-headless-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 8bd7d3e05f530d11e0c98a509240f0a80d610be514355782230420976477d32f java-17-openjdk-demo-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm 9453009219390924ca1d1916e1bc6d3a6a700a315b6d8d64be8258067afa0785 java-17-openjdk-src-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm a5f4c0e49bbc139a7c0f249d1126004f4b026cb5870bf1b0a93a0f474767eff3 java-17-openjdk-jmods-slowdebug-17.0.5.0.8-2.el9_0.aarch64.rpm b4ddb51ce286076e7eb25237a3fc67b605b247c5166d56f3d882506d57a1b781 java-17-openjdk-static-libs-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm b5e7b6b00e4cb181a8813fa064747b4b4e04545960931cf423fca71b92ed3f77 java-17-openjdk-headless-fastdebug-17.0.5.0.8-2.el9_0.aarch64.rpm ec6cfd81866616e786ac17da8502c9173191f2d00e83580dbe4b1ac7cce60b6c ALSA-2022:7007 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-1.8.0-openjdk-headless-slowdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 1891b268b2af2a88c20b242bb584e63b6fd3f327706cf7e587d53b9faf8679d6 java-1.8.0-openjdk-devel-fastdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 2223d22966b186143c46e5016319ee7859b538bba772ed39ffbf40c536c91a74 java-1.8.0-openjdk-devel-slowdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 4740c40a027eb7992ec7aab464885cc73afa409d798ccbdce85606ff356e735b java-1.8.0-openjdk-demo-fastdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 841489e95b5f0f99ac2d88ae124f370b979eee980e5ea4c566129bd7bbbffaab java-1.8.0-openjdk-demo-slowdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 8bd02b8c6c8d80dfc3e47a7df37ebb5f9f4fb9b3b3429babe084747cd68b1f25 java-1.8.0-openjdk-src-slowdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 933e3951b776e2e848b4f8c76e322862f0475561c76214848a03c5c90ccc2511 java-1.8.0-openjdk-slowdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm 954d0446ca569522d2cb4367eb8d97433723d770e8dc6a08914e1e72502c7bb9 java-1.8.0-openjdk-headless-fastdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm a8af64b1c2430a58df92633a99155fc4d8df21315406483ac269da3075c06cee java-1.8.0-openjdk-src-fastdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm c51a6f19a364a2d122d32c8ddb28a6e6e0aa37adc5c372cc3038af03558c1044 java-1.8.0-openjdk-fastdebug-1.8.0.352.b08-2.el9_0.aarch64.rpm f4f2bbcdfe52d9a331a8b2a8fb5a7a86cf9db8490c6f4f177b017e84b40ce2d7 ALSA-2022:7013 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [almalinux-9] (BZ#2131865) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default java-11-openjdk-demo-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 013ee061c020b104ebc4a20d2ab56a6b6c80d9306530d3240bad345d9e535973 java-11-openjdk-src-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 0e856dcbd892325850c546a51c2c603703d166332d6d7ce3dc3de117df494644 java-11-openjdk-headless-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 20de53348ba21edd5e777c2059e71b180c5947fc5e81231b603a76701b4b9f33 java-11-openjdk-static-libs-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 423c1cf6d8bea144e32b8b8505dce15ca8cf3f6ae6fba4444cbf7da6ed5f8a03 java-11-openjdk-devel-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 54f4d076114f3b014aabe7b0cbf4fe137783ba645af700e80683571a7aa72066 java-11-openjdk-src-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 737ab1e1ddbbedc07e152e68c0441ef72ce3257a7d30bce7d85c9e3740c66cf7 java-11-openjdk-devel-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 91e1bf53d65974297558fc927711961ef1321b85190186b7350cbc2ef76b2c18 java-11-openjdk-jmods-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm 950277b30399482afdcc134b1ef3ed492abdb4dbbe22d890309423d6b017cf78 java-11-openjdk-demo-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm b0661d644da0e554108a47be96973acd8e78e04a46ad6369388020330a4b9c6e java-11-openjdk-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm c1647f610c413cf29dbc94e7b0aad478ba096a0220694e57dd86bb4083edfb32 java-11-openjdk-headless-fastdebug-11.0.17.0.8-2.el9_0.aarch64.rpm dd180613ae33a9ea7358c41dc99278e6dddbadf85251262ab0076c8ab0989a32 java-11-openjdk-static-libs-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm e242ea64f0a7fef97524f23e0d74c669dd905d85a2bc37542aff03c18f61a1e6 java-11-openjdk-jmods-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm e29263888d66c87bacae2bdf492476ff262cfdfc58fc6c2143bd2a7bf31f569a java-11-openjdk-slowdebug-11.0.17.0.8-2.el9_0.aarch64.rpm e95f9e9288857941bc5cf206bc66cf520e7aed86e39bf8dba3cb4b642afd42db ALSA-2022:7090 Copyright 2022 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execution (CVE-2022-3515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default libksba-devel-1.5.1-5.el9_0.aarch64.rpm 696574c4d227e766f2f78434cd768d8d6e8ea1bf196237b488a5920d650b3b55 ALSA-2022:7185 Copyright 2022 AlmaLinux OS 0 1 Important

device-mapper-multipath security update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket (CVE-2022-41974) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default device-mapper-multipath-devel-0.8.7-7.el9_0.1.aarch64.rpm f2d8f00ca56bfb823aec9904a3fcbc8c779af0b3be75eb1b8089552f3dbb256e ALSA-2022:7314 Copyright 2022 AlmaLinux OS 0 1 Moderate

zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default zlib-static-1.2.11-32.el9_0.aarch64.rpm bd022652eb8dd26837ac7bc1ea3dd7391c9cbe8029faa26f1d04777d86d379be ALSA-2022:7318 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585) * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653) * execve exit tracepoint not called (BZ#2106661) * Matrox black screen on VGA output on some systems. (BZ#2112017) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129) * watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857) * Update cifs to 5.16 (BZ#2127858) * Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859) * vfio zero page mappings fail after 2M instances (BZ#2128791) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970) Enhancement(s): * Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default kernel-tools-libs-devel-5.14.0-70.30.1.el9_0.aarch64.rpm b22c85bf734d378e4cb9961c8c3556c60f6c6333f28c71f19dc646b3ff03d90e kernel-cross-headers-5.14.0-70.30.1.el9_0.aarch64.rpm bf20506f8be24b62f91448ced38d7c8f994cce4415f75e2285a0532bd7e14898 ALSA-2022:7323 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default python3-debug-3.9.10-3.el9_0.aarch64.rpm 357a5a2c139039ea9daa15b7669c4f7ed347c42b9c6d6621fb49c7439cf18c69 python3-test-3.9.10-3.el9_0.aarch64.rpm 36ab69a0b41b67d89b58f30baf7900d92c80adb858ff3b8b4467bdd8bf68c34a python3-idle-3.9.10-3.el9_0.aarch64.rpm a588a9c5a74b52eca41d3b1b7a005527438dc7f41014ceacffc04365525adf02 ALSA-2022:7329 Copyright 2022 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling (CVE-2022-33099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_default lua-devel-5.4.2-4.el9_0.3.aarch64.rpm 361e8fe0d5c2819cee386139009d1c1affb30d55d4c5b835ec4b94d01914a705 ALSA-2022:7958 Copyright 2022 AlmaLinux OS 0 1 Low

libguestfs security, bug fix, and enhancement update

The libguestfs packages contain a library used for accessing and modifying virtual machine disk images. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default ocaml-libguestfs-1.48.4-2.el9.alma.aarch64.rpm 2c513a41db8d74470ca50685df870a7ec7c7a446295895fecfa6898a27441b09 libguestfs-gobject-1.48.4-2.el9.alma.aarch64.rpm 344af5b5d34908e12404cd2d86d21810bbaad136b335ea1bca4fa436bdb36090 ruby-libguestfs-1.48.4-2.el9.alma.aarch64.rpm 4b426cc9c9f8956e7b46dc42710eb07e9b4e6e615bc9827bfb07e348eb897b93 libguestfs-devel-1.48.4-2.el9.alma.aarch64.rpm 6349f33d95dbc75ec7741cc2fcc9b569375f85a83bffcf3072694d15a5953987 ocaml-libguestfs-devel-1.48.4-2.el9.alma.aarch64.rpm 802361861e5283084fc0680acaf3f1138d1923648540629c9ea69dca5a5f769a lua-guestfs-1.48.4-2.el9.alma.aarch64.rpm 86f10ffd38bd5c34588e8276c109d26d69a8c5c6d870a25f168f7e68b2fead6c libguestfs-man-pages-uk-1.48.4-2.el9.alma.noarch.rpm af4f710b4de913c305b93516d4b72c70a6d6bea6926c1d220a9b862364554647 libguestfs-man-pages-ja-1.48.4-2.el9.alma.noarch.rpm c70d6eb341fe0eca9d22773d7e0310f3848bfed5973fc92f46cd0df16dcb3cdf libguestfs-gobject-devel-1.48.4-2.el9.alma.aarch64.rpm c9dcfdc12adff14d5b15c7453848fcf55f7d7513d37c7053938b2c12eea89175 php-libguestfs-1.48.4-2.el9.alma.aarch64.rpm e815929a281b21614c08c74c3c3d5d14a1a35b75cf7d3b093e454d1a214b24d8 ALSA-2022:7970 Copyright 2022 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default protobuf-devel-3.14.0-13.el9.aarch64.rpm 1485b4350f93a92f354972e2f44526f1872229d93a5458628583f4f95e4c918f protobuf-lite-devel-3.14.0-13.el9.aarch64.rpm 4a0e2bb1e2c5177cc6988a8f4479ebbc78354f53d14bfd14762a52abd25e7d66 protobuf-compiler-3.14.0-13.el9.aarch64.rpm fa247da7c3435edf761d85ec790cdcc6f2f1445a7dc8b34f02f61c22304dc7b7 ALSA-2022:7979 Copyright 2022 AlmaLinux OS 0 1 Low

speex security update

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fix(es): * speex: divide by zero in read_samples() via crafted WAV file (CVE-2020-23903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default speex-devel-1.2.0-11.el9.aarch64.rpm 9f6cb8b1bdf0c1fa169c07a2bcd2d8921ae4d65c62900e48da56b7b4ae7115dd ALSA-2022:8003 Copyright 2022 AlmaLinux OS 0 1 Low

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313) Security Fix(es): * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libvirt-devel-8.5.0-7.el9_1.aarch64.rpm 5da087da08726b65dfb84a21dc242e5ef34d58b341cca97ffd377836137e376f libvirt-lock-sanlock-8.5.0-7.el9_1.aarch64.rpm dbf75fa429ced213b693377c4ae4066bc0006bf11258c1f79b3cda4739bd082e libvirt-docs-8.5.0-7.el9_1.aarch64.rpm deffceefc1b4cd9bcb9a2fbd77c2abee11d521cd8f3d7812d4db7a4c8b5eadf4 ALSA-2022:8022 Copyright 2022 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework. Security Fix(es): * qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default qt5-devel-5.15.3-1.el9.noarch.rpm 9ebc6c52b9d1433612ea6bf67d160c769264f1496832e938e054352bab4405f7 ALSA-2022:8062 Copyright 2022 AlmaLinux OS 0 1 Moderate

unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2087120) Security Fix(es): * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30698) * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default unbound-devel-1.16.2-2.el9.aarch64.rpm 15832725c65683e48d200773d774e33b31ed6bea28fec80f1356b01a20d2d5fd ALSA-2022:8068 Copyright 2022 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220) * bind: DoS from specifically crafted TCP packets (CVE-2022-0396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default bind-doc-9.16.23-5.el9_1.noarch.rpm 7f2b5ebe8235b3d3a50a33d977b33607b5f6be05132c0d35d411e1b8c0c17f3e bind-devel-9.16.23-5.el9_1.aarch64.rpm 8db02396707d0be5710d5d3dfdaf4e5de469492299153fda6d382990317a5fb0 ALSA-2022:8078 Copyright 2022 AlmaLinux OS 0 1 Moderate

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default flac-1.3.3-10.el9.aarch64.rpm 7418bcd64f5a8ef729d675378eadfc7c0fd2c4d9ba1ff4fa3893eb7f42b910ef flac-devel-1.3.3-10.el9.aarch64.rpm ded71c30e5edc5b09ddb28ff410c8db19faff7503d9239a59ef2d5ed3e9d6a14 ALSA-2022:8139 Copyright 2022 AlmaLinux OS 0 1 Low

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default wavpack-devel-5.4.0-5.el9.aarch64.rpm 7703f0abbcf207d2efb0beeb4498aac10a5bcdcb41df70903f139e6eb513603f ALSA-2022:8151 Copyright 2022 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: A logic error in the Hints::Hints function can cause denial of service (CVE-2022-27337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default poppler-devel-21.01.0-13.el9.aarch64.rpm 8f263f6ee501e4c3e677539097904acfb2d4e2931559cada927a139068cacb9d poppler-qt5-devel-21.01.0-13.el9.aarch64.rpm ca2bb3d27ece214af6f5ac9c242e1ad3d002eb39942e65b39829e8021254e4b0 poppler-cpp-devel-21.01.0-13.el9.aarch64.rpm fc19a1b56310b7174674256b8ff1177187f67e90f3a7f18c6c7a86e50ec947dd poppler-glib-devel-21.01.0-13.el9.aarch64.rpm fc8afa88a99b8b9cb21619cf0ba0c5be0eab6af2bf52cfa11e9ae0802cab1309 ALSA-2022:8194 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562) * libtiff: reachable assertion (CVE-2022-0865) * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924) * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355) * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844) * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891) * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908) * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909) * libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libtiff-tools-4.4.0-2.el9.aarch64.rpm 1456434f7778d5d204c0c47f728f3e5078184488e837283ff60f427b38a80e37 ALSA-2022:8207 Copyright 2022 AlmaLinux OS 0 1 Low

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer (CVE-2022-1122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default openjpeg2-tools-2.4.0-7.el9.aarch64.rpm 2e424013141fe356d2bc7d16058582a0789adef3d404d3d333cd6476b53dddbd openjpeg2-devel-2.4.0-7.el9.aarch64.rpm 3655ef2d95841b2b062acfe6619efa463f02840fefc86f11db22ebe7b9a1e8ce ALSA-2022:8208 Copyright 2022 AlmaLinux OS 0 1 Moderate

dovecot security and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default dovecot-devel-2.3.16-7.el9.aarch64.rpm 6c187e3b25d29372f86753803435b984763febbbe022b0840ba5e5c5e11b3c15 ALSA-2022:8221 Copyright 2022 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default xorg-x11-server-devel-1.20.11-11.el9.aarch64.rpm 09fe4a440216cca03f6940a6977cec0abf542e9d1768daf263a3f7868c6e6cbc xorg-x11-server-source-1.20.11-11.el9.noarch.rpm 4e2b11caa9b1ede84bff1d50b6074841cd4ea148cfa780ae8267b2a485e75219 ALSA-2022:8252 Copyright 2022 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default yajl-devel-2.1.0-21.el9.aarch64.rpm 77bb19f4420d72a2f118921a076e94592d5921116ecdfad4849bf4702d24dbb4 ALSA-2022:8267 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516) * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640) * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168) * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617) * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854) * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016) * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048) * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184) * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280) * kernel info leak issue in pfkey_register (CVE-2022-1353) * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679) * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852) * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998) * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586) * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639) * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368) * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123) * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125) * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166) * possible to use the debugger to write zero into a location of choice (CVE-2022-21499) * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900) * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825) * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373) * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390) * use after free in SUNRPC subsystem (CVE-2022-28893) * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581) * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901) * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946) * nf_tables disallow binding to already bound chain (CVE-2022-39190) * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.6.1.el9_1.aarch64.rpm 2034b963c7a97fead4a1a784ac5a281d308d6c8c352051005d7398283e02e717 kernel-tools-libs-devel-5.14.0-162.6.1.el9_1.aarch64.rpm d02bb4161e8cc0ebe5367e2e07251b3dafd93f7101b941758e941fdf1854955b ALSA-2022:8317 Copyright 2022 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.16.4). (BZ#2077487) Security Fix(es): * samba: server memory information leak via SMB1 (CVE-2022-32742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default samba-test-4.16.4-101.el9.aarch64.rpm 0d2a2d6bbdfaf18a201df05a4b9735012c3f6292b006248f9ee1199d22abaa5e samba-devel-4.16.4-101.el9.aarch64.rpm 392ebf2b4714a0f81f5dac190b3754c9edb25861054780743fefd309bc9d8b35 libwbclient-devel-4.16.4-101.el9.aarch64.rpm c3a9c539aea8da83fa41ed7efd0280407a1098cd2bef57bfa721ae42e77d9f90 samba-pidl-4.16.4-101.el9.noarch.rpm ce4265a141b1855237a79ba6d86e8df379190f78d7ff3073272640f269cc5889 samba-test-libs-4.16.4-101.el9.aarch64.rpm d2e2e140bbd5f8aecd069952549e4ed7bcd1ed5c89c2d68330db057673ec04b4 libsmbclient-devel-4.16.4-101.el9.aarch64.rpm f4ff45e026c6d7b87627b51e685660d959fa42d2703d5d7fabe22182f57a470e ALSA-2022:8318 Copyright 2022 AlmaLinux OS 0 1 Moderate

libldb security, bug fix, and enhancement update

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490) Security Fix(es): * samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libldb-devel-2.5.2-1.el9.aarch64.rpm ae9e286ffebf0ca29feecd1dfb903a7ce65358eddcb5543b374686c5ecb7eeeb ALSA-2022:8353 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.14). (BZ#2128249) Security Fix(es): * python: mailcap: findmatch() function does not sanitize the second argument (CVE-2015-20107) * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default python3-test-3.9.14-1.el9.aarch64.rpm 533efed275892bd5deeca3acc4a0f5c8a33c355586ed881cf1f7463b8df706c7 python3-debug-3.9.14-1.el9.aarch64.rpm 94592c5c619b6904e18be04ca2c1f3a25d8b47ed421142257ca253640d595dd0 python3-idle-3.9.14-1.el9.aarch64.rpm ca9f56bb94b6c4c137886e78e96223517c04397d5076edd698c0d22cb127d21d ALSA-2022:8400 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtirpc security update

The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Security Fix(es): * libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libtirpc-devel-1.3.3-0.el9.aarch64.rpm eb539c16c8cfe5eab722c31c51a5ecc64ccc0833f6b6964c76498d7ab64b9235 ALSA-2022:8415 Copyright 2022 AlmaLinux OS 0 1 Low

mingw-gcc security and bug fix update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * gcc: uncontrolled recursion in libiberty/rust-demangle.c (CVE-2021-46195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default mingw32-cpp-12.0.1-11.2.el9.aarch64.rpm 2a508c78b99a6d6bcb31cfd9193e7c0da6b7baf845377259121daf6b9e4a0031 mingw32-gcc-c++-12.0.1-11.2.el9.aarch64.rpm 3b9826fb98cdcdc82c5104bfd71c7e9de34d43622062daa332f4e74123105bdd mingw32-libgcc-12.0.1-11.2.el9.aarch64.rpm 4d1c69f92da8ba67f94f4507ec4c5eaeff1fafaf6dee85fe8c9a912f5ead8a33 mingw32-gcc-12.0.1-11.2.el9.aarch64.rpm 5d54c407524fc4428dc2d4a0e7d8afdf992713048f645d5af9d3eb8bbc7e4bdb mingw64-gcc-c++-12.0.1-11.2.el9.aarch64.rpm 83de7acca1af74d2f851841c09dc71faed6911def2fc46d6a9499163b95e7148 mingw64-gcc-12.0.1-11.2.el9.aarch64.rpm b28446c4171fdd5ed9bca96b383b8978b42e23e96be41a7cc904428a384f4bc9 mingw64-cpp-12.0.1-11.2.el9.aarch64.rpm c96af03662a136f729106f64e58f5150e02bd4254b7821ee8e91f6a1ffbaadcc mingw64-libgcc-12.0.1-11.2.el9.aarch64.rpm d4508023fca590c09073fc2b097c122183b45956f33bfd32c274e83e95b998ad ALSA-2022:8434 Copyright 2022 AlmaLinux OS 0 1 Moderate

dotnet7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134641) Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default dotnet-sdk-7.0-source-built-artifacts-7.0.100-0.5.rc2.el9_1.aarch64.rpm b82377846343b1f2e6d25df6da35696e7938949cc79887fc60090b466bcc012c ALSA-2022:8493 Copyright 2022 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default python3-idle-3.9.14-1.el9_1.1.aarch64.rpm 2cf3e1c9164f6771f99ce2ef9a8e7cfa1b38c73f29e97e4e0560577e2187c354 python3-debug-3.9.14-1.el9_1.1.aarch64.rpm 3e14628205982ef5b80def3884101898116f58a37e90de4522ee7b6d56d4c158 python3-test-3.9.14-1.el9_1.1.aarch64.rpm 97fad320156284174038180e0773607870aab260905f9493a8895f4708b9cad9 ALSA-2022:8643 Copyright 2022 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: Request Forgery Vulnerability (CVE-2022-45060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default varnish-devel-6.6.2-2.el9_1.1.aarch64.rpm 7c4beeebf942e4699bbde45b92950d638a9b54c33d6a7c736b5378dfb52f21c7 ALSA-2023:0077 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.113 and .NET Runtime 6.0.13. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.113). (BZ#2154459) Security Fix(es): * dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process (CVE-2023-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default dotnet-sdk-6.0-source-built-artifacts-6.0.113-1.el9_1.aarch64.rpm e935d0c6b13896e348f80afcd0954e99f7aa7030413d5a756bb953f5e809da18 ALSA-2023:0194 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS database. This update allows more control over database use using two new properties - fips.nssdb.path and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-line arguments to the Java virtual machine (RHBZ#2147476) * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [almalinux-9] (BZ#2153097) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-17-openjdk-headless-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 031ff190e9bb820d21b86181ea4a72cb0933b77e073490c31a65daf6794999ca java-17-openjdk-jmods-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 0a708adfe80303bb57a87c6d35f373b8fa76ca3dde378dc037092dea4f003f75 java-17-openjdk-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 37a5c83360f1639236e1d53a5b3cfc1a83a0f49098af2101b872dc593c1f4add java-17-openjdk-headless-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 54da442f2c93b79399e148c0e5f0f1cf07c76d98b4bb208082f2bf56a1e5c192 java-17-openjdk-src-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 595d68bee2d30c316fa64e0ab55dce49fc4f6bd57c70a73220ebae0983e87caf java-17-openjdk-demo-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 59a8e7ea3887aadb015693554d50f3c47bd1393e59ab6e72f25547ce7a0fa0b0 java-17-openjdk-static-libs-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 67777a8fea404b5aa7220b98b17883dd3d703e6f2990f120716ad6bdcc27709a java-17-openjdk-devel-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 695fbc16ff6067ca45e5c991577cdb7ab12c1cf9f4fe04a227faedd66f3842a0 java-17-openjdk-devel-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 727593393f6860f8d52804b0363c9bf2134e694b09a620d399954b9be5c835a2 java-17-openjdk-src-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 807b25dc16cde1b7fb950111c8a2831f51cf54c7a983b83bb578464a5b61a9a2 java-17-openjdk-jmods-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm 937d1e5e5e9e6c1300aaa1aa31cc396a3f19a3b0f5ac0a285d2b5299e7ae0cd0 java-17-openjdk-demo-fastdebug-17.0.6.0.10-3.el9_1.aarch64.rpm ad444886032ca101460385da677e4d25e6c6d585716d369cead563aa77c60a8e java-17-openjdk-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm c5a6470dc8ed5d2609721dc1cca299fe0d725ea45a12b56d5f4040cd997a337a java-17-openjdk-static-libs-slowdebug-17.0.6.0.10-3.el9_1.aarch64.rpm cb40008aedaf207fdd1bd20abd4b088bf5344edb7f35500aaec5c28bc867c590 ALSA-2023:0202 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [almalinux-9] (BZ#2157798) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-11-openjdk-devel-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 29c1a320154760f2eabd8d6b00e122a4844196d341f0ce7da3cf8dcaa9e2c31d java-11-openjdk-headless-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 2b3a2ae5f320b684c816191b2f5dc9c08a3de7232d1b70e8182a1e8b8df5640b java-11-openjdk-jmods-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 3de6adcecb525574b3eac0134230a0444fa72cfb08ad378a1ac98160c5fcae34 java-11-openjdk-headless-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 4bbeb40d49bba2a832658cdae2d57335ab0361a70de5b7b6525a1d8fe0ec1b8c java-11-openjdk-src-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 58ab16dce95eda0232cae251797b69e91106384af57d11cfacef2979576e7430 java-11-openjdk-demo-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm 9e62514f98d621c893fe7fa0f45ff932983f60d77f95e716fb9985f5f83fba77 java-11-openjdk-devel-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm a42cd0c818b0b09dcb13e748896facd2a5702c7d71120b17a705844081dadb5f java-11-openjdk-jmods-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm a764266a040633f5592400095d1bf3572d7a9292d8aec013e3c994b2d4bddaa2 java-11-openjdk-src-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm aa8a0a540571f7ba30b8ffb9483f4202c4c89cc5373d6f7f45410b4c20127758 java-11-openjdk-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm b78fffeb17c94a5759f005e2405fa95f41371361bb5a364dc46f1940e0529dcc java-11-openjdk-static-libs-fastdebug-11.0.18.0.10-2.el9_1.aarch64.rpm bd2ae7aac7ff3b688cdbb0f8f9d002a5eb3f7d5250d16f84ec0d0f574109eccd java-11-openjdk-demo-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm be47f18adb5e2e70548fd7779d623b8b826156c58410d3247cf412a2457d9881 java-11-openjdk-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm bf0f741d92071ac154b79cb82a8be44065bf3fad4c6e7f36510728c9a6d23018 java-11-openjdk-static-libs-slowdebug-11.0.18.0.10-2.el9_1.aarch64.rpm f9e0ca8b1f10b12335f1ecb00bd580eb6bc1daf270a99004f0a88b308d22726f ALSA-2023:0210 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) [almalinux-9] (BZ#2159912) * solr broken due to access denied ("java.io.FilePermission" "/etc/pki/java/cacerts" "read") [almalinux-9, openjdk-8] (BZ#2163594) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-1.8.0-openjdk-devel-fastdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 05fb06f665c908bd42f51411f0977b263c8acdd559abb1c5f8b00c250deeeb38 java-1.8.0-openjdk-src-fastdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 06c565d8ece1cb4f758f7a1281d551880bbd5665e0388a43e400a586251511e5 java-1.8.0-openjdk-demo-slowdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 16a8b892bb6fde157ca46eb56cc40e4ba9a3e01184e18e750f879c93512f95f7 java-1.8.0-openjdk-headless-slowdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 218afbcdb6d0d85bce4d15947b137d1b30aed3a7690c88180c7003322adea1ab java-1.8.0-openjdk-slowdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 8faa4a4a64e0aca0a03e308b86aabee17c90687a26dec45412000bb941c888e6 java-1.8.0-openjdk-devel-slowdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 9b9b06f804c22dab522c0a79fa4bcddee49b46562037f690574951d19a36257a java-1.8.0-openjdk-fastdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 9cfad89e667fff38c2cb72bed13baca6c9d331557c250bff30760f64690d1dc7 java-1.8.0-openjdk-src-slowdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm 9f97450c56ed2f6851de1b86c40736168970fbbee53554139450941b933a9185 java-1.8.0-openjdk-headless-fastdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm cee4e3b42e07626b7ff65502330c33923ffde988a5ec6ec69bc87d8b1492109a java-1.8.0-openjdk-demo-fastdebug-1.8.0.362.b09-2.el9_1.aarch64.rpm e3e5aaba2ff5594937211300101d28aa507fd84b1f8a1ff93c61065e3b4feb5b ALSA-2023:0302 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058) * libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519) * libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953) * libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520) * libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libtiff-tools-4.4.0-5.el9_1.aarch64.rpm b9e520a1d90d0a1f5f32092c5a2b1a52420d5e1e5c3841bd788f6cf40319cc7e ALSA-2023:0334 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964) * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139) * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945) * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077) * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel 9.2: Important iavf bug fixes (BZ#2127884) * vfio zero page mappings fail after 2M instances (BZ#2128514) * nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359) * ice: Driver Update to 5.19 (BZ#2132070) * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588) * drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619) * updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914) * DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213) * No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153) * Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168) * ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976) * fatal error: error in backend: Branch target out of insn range (BZ#2144902) * AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217) * Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910) * Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605) * DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.12.1.el9_1.aarch64.rpm 3cec21ee6c7f2e3df42233024e006d282f73457e4b4b0c6adb5c0c1606a69382 kernel-cross-headers-5.14.0-162.12.1.el9_1.aarch64.rpm e999cd85c758ab0da6c545f602acc15a76dc07a01eeee86069b980a14af03805 ALSA-2023:0340 Copyright 2023 AlmaLinux OS 0 1 Moderate

bash security update

The bash packages provide Bash (Bourne-again shell), which is the default shell for AlmaLinux. Security Fix(es): * bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default bash-devel-5.1.8-6.el9_1.aarch64.rpm 509098e78501114b84c181e16e303b01b90fb3f421848f3583d4d7250e0ee95e ALSA-2023:0626 Copyright 2023 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow to code executiona (CVE-2022-47629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libksba-devel-1.5.1-6.el9_1.aarch64.rpm 47fc3964dcd6a7a72b7a849425307979d34123abbfaa016c8c8c230f00ddee92 ALSA-2023:0951 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564) * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379) * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179) * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux 9.0: LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133083) * AlmaLinux 9.1 Extending NMI watchdog's timer during LPM (BZ#2140085) * AMDSERVER 9.1: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151274) * qla2xxx NVMe-FC: WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70 qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2152178) * Regression: Kernel panic on Lenovo T480 with AH40 USB-C docking station (BZ#2153277) * Scheduler Update (almalinux9.2) (BZ#2153792) * AlmaLinux9.1, Nx_Gzip: nr_total_credits is not decremented when processing units are reduced by dlpar in shared mode. (FW1030 / DLPAR) (BZ#2154305) * MSFT, MANA, NET Patch AlmaLinux-9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155145) * Azure vPCI AlmaLinux-9 add the support of multi-MSI (BZ#2155459) * Azure AlmaLinux-9: VM Deployment Failures Patch Request (BZ#2155930) * The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158815) * AlmaLinux-9.2: Update NVMe driver to sync with upstream v6.0 (BZ#2161344) * CEE cephfs: AlmaLinux9 cephfs client crashing with RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] (BZ#2161418) * block layer: update with upstream v6.0 (BZ#2162535) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.18.1.el9_1.aarch64.rpm 3f74ffff57b4d2bccbe96abf43d3907ed6d4ad351e52e95c4f6c3698da3bfa0c kernel-tools-libs-devel-5.14.0-162.18.1.el9_1.aarch64.rpm 93216810fc6d01f502dbfe3cc6ffb6b52c5fd52e0c449f832283d3a965f79ef4 ALSA-2023:0953 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default python3-idle-3.9.14-1.el9_1.2.aarch64.rpm 62fc3a2fc14a8a301e0dae38ca9e8edf6aefe5c89d851433b3f4fc3316d810b7 python3-test-3.9.14-1.el9_1.2.aarch64.rpm 6c4b9818d86e2f87132ac7cd15c23717c4eca378cf2bc213bbd7377fa63bc527 python3-debug-3.9.14-1.el9_1.2.aarch64.rpm c663c044f057ecabcb8ca2fa0e19c6aca42c9d539892a0d02c7f038b3951f4b4 ALSA-2023:0957 Copyright 2023 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: use after free allows Sandbox Escape (CVE-2021-44964) * lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default lua-devel-5.4.4-2.el9_1.aarch64.rpm af247c7fabfb4e334a00aceeb15bbbd25bf098229a5516137aa685389c21dc36 ALSA-2023:1068 Copyright 2023 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap buffer overflow in get_word_rgb_row() in rdppm.c (CVE-2021-46822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default turbojpeg-2.0.90-6.el9_1.aarch64.rpm 076aca82fd3dfe13b6e95e025af4fab3827f6e1bf355a28b78a8658dd50bb930 turbojpeg-devel-2.0.90-6.el9_1.aarch64.rpm 346428ef19f69997bf40ec5e906c63b6b8802377e265ab6dd19f968ba58bd485 ALSA-2023:1470 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux9.0 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127880) * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on the system. (BZ#2143766) * AlmaLinux9.0 - boot: Add secure boot trailer (BZ#2151528) * kernel-rt-debug: WARNING: possible circular locking dependency detected (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160614) * Support cpuset.sched_load_balance by changing default CPUset directory structure (BZ#2161105) * AlmaLinux9.0 - s390/kexec: fix ipl report address for kdump (BZ#2166903) * libgpiod doesn't seem to work with Interphase gpiochip (BZ#2166956) * Azure AlmaLinux9 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170227) Enhancement(s): * IBM 9.2 FEAT: Upgrade the QETH driver to latest from upstream, e.g. kernel 6.0 (BZ#2166304) * Intel 9.2 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168382) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.22.2.el9_1.aarch64.rpm 249fdadd7e9e8db3e7c6e54e9efa1ca6627db1915ace5edfceafb420b7fcc55c kernel-cross-headers-5.14.0-162.22.2.el9_1.aarch64.rpm aa444e408cac5b03af737c9d637bc91f7f108b93cf6ca464f9ab18de9824a8d4 ALSA-2023:1693 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625) * postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default postgresql-test-13.10-1.el9_1.aarch64.rpm 0592d779335bfcf25e4ed6c33af14a0bc9c834e171d7ec18cb4673808b09ccbe postgresql-private-devel-13.10-1.el9_1.aarch64.rpm 0c259345917a131905bc4087a9518b46cfc8674bd3c177a3cd4c6239f2b1a64d postgresql-docs-13.10-1.el9_1.aarch64.rpm 56c4d80f05e7e111c2c2424ac86c40b605d4a74af40dd78583c0e932c57c4567 postgresql-server-devel-13.10-1.el9_1.aarch64.rpm bffc7a7c71bcbace6d091b55d91b208c9d498c6a5cb7032d68b03e8c3555f78b postgresql-upgrade-devel-13.10-1.el9_1.aarch64.rpm f247059b6356ee236a57981fe07e5b73d02a3533b9f958fb61afde68f012357a postgresql-static-13.10-1.el9_1.aarch64.rpm f7afd58cb370fa3d60e96f85e4814f7985f32920142971e025fd28b8e51c8856 ALSA-2023:1703 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Update intel_idle for Eaglestream/Sapphire Rapids support (BZ#2168361) * AlmaLinux9: An application stopped on robust futex used via pthread_mutex_lock() (BZ#2168836) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.23.1.el9_1.aarch64.rpm b2da46afa91dbbd4a2816ddc45f48eb63088544d01e8aee0996d2613db73c4f6 kernel-tools-libs-devel-5.14.0-162.23.1.el9_1.aarch64.rpm c2a68394f4248b9e550ce167cfc827811cb88a26b0fe432597d57fb963fc6c48 ALSA-2023:1879 Copyright 2023 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the list of cryptographic services and algorithms available is limited to those that are FIPS compliant. It was found that this filtering was too strict and was also excluding service attributes. These attributes are now made available in FIPS mode, as they are in non-FIPS mode. (RHBZ#2186804) * Previously, the XML signature provider was unable to operate in FIPS mode. Following recent enhancements to FIPS mode support, the XML signature provider can now be supported. It is now enabled in FIPS mode. (RHBZ#2186811) * The PKCS#11 provider used by FIPS mode can be supported by different PKCS#11 tokens. It was found that some PKCS#11 tokens may not be initialised fully before use, leading to an exception being thrown by the provider. With this release, this exception is now expected and handled by the FIPS support code. (RHBZ#2186807) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-17-openjdk-demo-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm 2f136e2032b18659cc22e620b55d7fc4b4527bdce6a78f3fd7216a8d62e3d281 java-17-openjdk-devel-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm 73de238423300b349eb9ad97fce9a44e580b24e182a8a36b1f991b99cc593e93 java-17-openjdk-src-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm 7585511a7bf99b82d52ab2073b2f95f36464d5a904e6e5d0ce58975f726d0225 java-17-openjdk-demo-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm 7bcc03ce7f635cd21240b4a0190f03ca865c4dcda7e57217b1cdfd4eebb4d016 java-17-openjdk-src-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm 8daf52bc356e97b65ea6e01d916d3ecba9650559d65402c70a2a0cb0606bd620 java-17-openjdk-static-libs-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm a43b99cb612727de687da8129b15474231a2c913c6a899a5eb3e76017d8039aa java-17-openjdk-static-libs-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm a4a35f7aaa121c64d80198a7500c71c45c03bb6ca2b7d8ffb4fe5111c5f9e76c java-17-openjdk-jmods-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm ac624cd0b29607b64bc228e9364e229709fe8d9d4290440d8a5b4a9d6c8dc248 java-17-openjdk-headless-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm b668f6776026c27a584f98f843377c6fa183848d11c6936e5f41e51398ad11f9 java-17-openjdk-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm bf1245005ff17c2c073f5c47132558c49a8b4e2be25988096ea37ca0ec24b77a java-17-openjdk-devel-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm c691b309971da06124fa6168705384fc23f1b2cfcc019eff29e22834bef49a1a java-17-openjdk-jmods-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm c6e46171f44a7cc3a39f8343a9aa271660006f304fed8d5caba0e6b922989280 java-17-openjdk-fastdebug-17.0.7.0.7-1.el9_1.aarch64.rpm c84ccc29be3b2e9ff3c4fd225ea7c58f428bef8420f307b63dcbc5d0efffdefb java-17-openjdk-headless-slowdebug-17.0.7.0.7-1.el9_1.aarch64.rpm d4effce4d36d2bfb85ef87bbdc612daad57921c25dff53659fcd1561750633b2 ALSA-2023:1880 Copyright 2023 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-11-openjdk-src-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 04a63e1cb8e3e29a57df3ce30cad922d58f4ab3e2161825c8b59c402f998c317 java-11-openjdk-jmods-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 0e34a4ae278eb46756ca00d51c27438981b4f360e56459540db630ecbc8d9f70 java-11-openjdk-headless-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 43e591b1e17e67f431511521cb0ffb0574000bfc43753b2b5d7a5f8b6e66a8e1 java-11-openjdk-static-libs-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 486e05590152f289c1fb2574a092b9ffbbc362ad4728b1ea4f805e0aafbbfbee java-11-openjdk-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 62a8d8dab9bb2c0780096036ec4ddd613ac820c11dccc52072635fe8a75c8b63 java-11-openjdk-demo-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 66d5de3c6978ee46ca7e8de61c1c33e18e4ca4fd8b0f338665174a66a64d98f3 java-11-openjdk-devel-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 7a0be70dd9e4a9241a97c854bb7af1cf1ab43da7c3360c4c86eaeecf1f7fccff java-11-openjdk-demo-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 7e1e0ce7c231e58cccd52b5f5331aff8ed5afd8bb72bf647d732cb96f6b35a8e java-11-openjdk-headless-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 87486a9dd4eb6d593d9cc9d6af03e3aa920d1d84cd19d025bf2180578999ff10 java-11-openjdk-jmods-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm 900aa9eb339306516f6480ed24a594134ac32703a9e712d5b3f9100b2386f139 java-11-openjdk-static-libs-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm b01c0ea676cfc3d6354dca7380e02ca626efefc0588bcad923a216da8321cbe5 java-11-openjdk-src-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm b5c78ace287f0facc4a4c4a53da2655ec131338897d461be8f98f34abec7e51e java-11-openjdk-devel-fastdebug-11.0.19.0.7-1.el9_1.aarch64.rpm c19ccc2522367c01b004c7d3fb2ad2e09c4bf95e85ee1a812a5262d263047977 java-11-openjdk-slowdebug-11.0.19.0.7-1.el9_1.aarch64.rpm ecd3d59158affeef67d0e0e78d8929e0e217fb3ee075c543aea0a4caed7d5c17 ALSA-2023:1909 Copyright 2023 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The RSAPSSSignature implementation works with RSA keys via the SunRSASign provider. However, it did not fully check that the RSA key could be used by the provider before attempting to do so, leading to the possibility of errors being returned with custom security providers. The implementation now validates RSA keys and will allow other providers to handle such keys where it cannot. (RHBZ#2188024) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default java-1.8.0-openjdk-src-fastdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 05482484e8ce52af76093507c24a2c56f541d42b12725531995e416800e2129f java-1.8.0-openjdk-demo-fastdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 39b04df432deed4213e0d7706ebd410df51bbb6297bdc789b6a5c6ed3df3da9a java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 477de5566680dc7e6fda3af8f8df173829d545fa3546a37975bc854538972b76 java-1.8.0-openjdk-devel-fastdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 57fa4af68285ab323a01769b069d420ec29868f44ec080cdd1085874f66b029d java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 622d78f8aee15d9707cae9a908695117d091f871232a364f9f78eaebfd79e18b java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 6d113eeb1cee1eebdd08a584b786c431814c8bda23f425891008c5308df857ce java-1.8.0-openjdk-headless-fastdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm 971a9b6b2649baca8129b37ced550624d8a2696ad6ae0a08c309ad25288d1514 java-1.8.0-openjdk-fastdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm a75e1338e21a0aef356ea3e170f4b413dc722c690e81408b2a26436c32025375 java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm d72b35e74c199adc2c794f441860231088297ee180bce24e43170d1d2c990e26 java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-1.el9_1.aarch64.rpm de9f25203c2b9b606eda8bbba5654ff1106fedf81a6e18b2d099e6f64c528c61 ALSA-2023:2127 Copyright 2023 AlmaLinux OS 0 1 Important

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_1_default libsmbclient-devel-4.16.4-103.el9_1.aarch64.rpm 11ae941889f86069a183cd0f47e277a28eb8319a42d71a3f87ac0c53899eb7e2 libwbclient-devel-4.16.4-103.el9_1.aarch64.rpm 23f089f6d45bdcc042e262bcd92c8d75fe6169c9c308b7190959b2607698102b samba-test-libs-4.16.4-103.el9_1.aarch64.rpm 596cb35f936f06787c3837ff7c023b51097dbcd88ff24b0ddde12f4acded2edc samba-test-4.16.4-103.el9_1.aarch64.rpm 7a1c6b749ad85f3f04291658f24a9c97fe2879127f8016313bcb9e1bbe674ee1 samba-devel-4.16.4-103.el9_1.aarch64.rpm 7be63a02c69642885a38ca9f40f0574950e7179c09a0cd1b90090833231aa438 samba-pidl-4.16.4-103.el9_1.noarch.rpm c48c0aef3685e93ad6b4c179b446ee741ca10c2e8490e8c61364eac2f8b8440b ALSA-2023:2165 Copyright 2023 AlmaLinux OS 0 1 Important

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) * edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation (CVE-2021-38578) * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304) * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450) * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default edk2-ovmf-20221207gitfff6d81270b5-9.el9_2.noarch.rpm 3cf7d77ad2e87fb283447992c4f5b4474e6e3cd46f19d8416b62644de5d475f0 edk2-tools-doc-20221207gitfff6d81270b5-9.el9_2.noarch.rpm 88fdd6252e0556b1732a5dcd546d6e5d581e2f2f0156472f6779bd95e8b8ca10 edk2-tools-20221207gitfff6d81270b5-9.el9_2.aarch64.rpm ce69facb48ba1ba68470471c4067d52286e52d3983abf6ac57f7e83b75260f77 ALSA-2023:2166 Copyright 2023 AlmaLinux OS 0 1 Moderate

freeradius security and bug fix update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: Information leakage in EAP-PWD (CVE-2022-41859) * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860) * freeradius: Crash on invalid abinary data (CVE-2022-41861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default freeradius-rest-3.0.21-37.el9.aarch64.rpm 2fc665d88e0716fde84751eddcfc8f1f8552df305ea18527cd0710c0d54107c9 freeradius-postgresql-3.0.21-37.el9.aarch64.rpm a1e883da11b8fadfbe3409b275e9f75ea61ff396d69f6f21051da481eb41f91d freeradius-unixODBC-3.0.21-37.el9.aarch64.rpm a28479e6f09397a93313292dd85c36d8bd8b342c9232617c15d37855d62b2c3f freeradius-mysql-3.0.21-37.el9.aarch64.rpm afaf2f5c693e69ff19880e99d3570ed13996638210668d97fbd22333bb7ee3bc freeradius-perl-3.0.21-37.el9.aarch64.rpm bef5e50603b2a7c5ca1f54fdd2aef31dc38681da10316e37244bcfc3cef0102d freeradius-sqlite-3.0.21-37.el9.aarch64.rpm ded83ffc252c599b31b5d413529e8bc59b9a9d7bbe98010a8d03e5e63b43f200 ALSA-2023:2248 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550) * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283) * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340) * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341) * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342) * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343) * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344) * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494) * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default xorg-x11-server-source-1.20.11-17.el9.noarch.rpm 3b231953962ef28c2c50afd8c6fc428361b8e1316ccbe683f1cfb5c063cd4d87 xorg-x11-server-devel-1.20.11-17.el9.aarch64.rpm ee5f0bc1dcff4d309b00834055a5afdba5695822e0cd9a4e4501e72a0b4d0212 ALSA-2023:2259 Copyright 2023 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: integer overflow in JBIG2 decoder using malformed files (CVE-2022-38784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default poppler-glib-devel-21.01.0-14.el9.aarch64.rpm 787f1ec87b01867149c65c627463824a222dc9d966003c40227059d96cf827c5 poppler-devel-21.01.0-14.el9.aarch64.rpm 868dfca2bcce61ff7a2e418a951443b92231ff60b3a6ee5cf60932176c17a309 poppler-cpp-devel-21.01.0-14.el9.aarch64.rpm 9ac0c3d166ac1160b1c42bd3ad87bacd088626457384b8577a771421b3ef0e9b poppler-qt5-devel-21.01.0-14.el9.aarch64.rpm dd42cadcfa979ecf1d985b78e47a45ac27917c90e171309cf74ae249835d67f2 ALSA-2023:2261 Copyright 2023 AlmaLinux OS 0 1 Moderate

bind security and bug fix update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795) * bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default bind-doc-9.16.23-11.el9.noarch.rpm 89aa2e6a4d42f3636b882c4f0a7b97379335821cf7298757b760024b54a49ca6 bind-devel-9.16.23-11.el9.aarch64.rpm d795962ea8f43e403d6cc66bd9b4659a3aa3a21f9e6798e7c0cedbaf37a3ec83 ALSA-2023:2326 Copyright 2023 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282) * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283) * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316) * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317) * freerdp: division by zero in urbdrc channel (CVE-2022-39318) * freerdp: missing length validation in urbdrc channel (CVE-2022-39319) * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320) * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347) * freerdp: missing input length validation in `drive` channel (CVE-2022-41877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default freerdp-devel-2.4.1-5.el9.aarch64.rpm 1c60d72fc592b911678a375de6b8e461548e11ca18903c5298b1c51b6e47432a libwinpr-devel-2.4.1-5.el9.aarch64.rpm e847db36cf50f1ee79816f64caa4e6074311c6b6e02706c7678c65f5280f6570 ALSA-2023:2340 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE-2022-3597) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c (CVE-2022-3598) * libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c (CVE-2022-3599) * libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c (CVE-2022-3626) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627) * libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970) * libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c (CVE-2022-4645) * libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value (CVE-2023-30774) * libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (CVE-2023-30775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libtiff-tools-4.4.0-7.el9.aarch64.rpm e0b9e73f23a55e29ec12618866cb78170a1090e137c4e0dcce9e3eb8de8b8018 ALSA-2023:2370 Copyright 2023 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default unbound-devel-1.16.2-3.el9.aarch64.rpm 02485406f79f3a6ecb70260782a6dffe000aa1a7e7b54afadac3f418b6a533d2 ALSA-2023:2373 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security and bug fix update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: f5ethtrailer Infinite loop in legacy style dissector (CVE-2022-3190) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default wireshark-devel-3.4.10-4.el9.aarch64.rpm ecc03cb75a5e4b7de753b0183d471bee3e19bd04e59f8ed62b63ae7048e25348 ALSA-2023:2458 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896) * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461) * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341) * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655) * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462) * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789) * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882) * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196) * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663) * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028) * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435) * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522) * memory leak in ipv6_renew_options() (CVE-2022-3524) * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566) * data races around sk->sk_prot (CVE-2022-3567) * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619) * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623) * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625) * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628) * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640) * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707) * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128) * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129) * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141) * lockdown bypass using IMA (CVE-2022-21505) * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388) * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743) * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188) * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189) * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674) * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703) * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720) * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721) * Denial of service in beacon protection for P2P-device (CVE-2022-42722) * memory corruption in usbmon driver (CVE-2022-43750) * NULL pointer dereference in traffic control subsystem (CVE-2022-47929) * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394) * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590) * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195) * denial of service in tipc_conn_close (CVE-2023-1382) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default kernel-cross-headers-5.14.0-284.11.1.el9_2.aarch64.rpm 287a4d0b1267b2d63c40ce78874463467f1d240b7618c6f5636ba8176753cfbe kernel-tools-libs-devel-5.14.0-284.11.1.el9_2.aarch64.rpm fcf3c99b12a4dd84ba09584530cadb64ba8b5bcfd72dfe6943499da97f46a1e1 ALSA-2023:2459 Copyright 2023 AlmaLinux OS 0 1 Moderate

device-mapper-multipath security and bug fix update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default device-mapper-multipath-devel-0.8.7-20.el9.aarch64.rpm dd4a2d670b81cffffcd0d4ae26a724e0d25595390cff4d6a0cfa2a66ec93611d ALSA-2023:2487 Copyright 2023 AlmaLinux OS 0 1 Moderate

fwupd security and bug fix update

The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34301) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34302) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default fwupd-devel-1.8.10-2.el9.alma.aarch64.rpm 02313cd6679ce7e0618f491980066da10d4c7197d853f926fe7a6c6cf91b3095 ALSA-2023:2519 Copyright 2023 AlmaLinux OS 0 1 Low

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2131993) Security Fix(es): * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default samba-test-libs-4.17.5-102.el9.aarch64.rpm 029daaa52c2a2012edf11b3ac5ae066779b67b5bb85799542b322fd6a0f0232d python3-samba-devel-4.17.5-102.el9.aarch64.rpm 0b37c7bf46fc2e2d8e9ccdcd655c6b769d1e297b1ca5fdd909c47db62e5a7e39 samba-devel-4.17.5-102.el9.aarch64.rpm 2cb5b917dc2d2f039c5ec99852e7f7e5d48a9aa26110f3934f7f0b2475fdfde8 samba-pidl-4.17.5-102.el9.noarch.rpm 39aaadaf78a1fa8a0747154fca75e17ac1ed358cd6d47644f2ec50e7303a1e81 python3-samba-test-4.17.5-102.el9.aarch64.rpm 49da02e19065649eba24f173522a612cee8fbfa45ea9ff830b0b6080c16e54e5 libsmbclient-devel-4.17.5-102.el9.aarch64.rpm d6643a8291fc5daeb6a1ffb4957cbe18571d3c2b1a4d4c2ec37acabfe4b4a851 samba-test-4.17.5-102.el9.aarch64.rpm d887d83184453d5cc1ff22f084a8975a0e2ace17141d16c060625746a55c1601 libnetapi-devel-4.17.5-102.el9.aarch64.rpm f5bc679a2715adb4d74279c083d21e50504e3e16623f1216d2df759bd54b9357 libwbclient-devel-4.17.5-102.el9.aarch64.rpm f6c2a17262f22806effd89fea444daee093869e25cfb2725021ee49c028237f2 ALSA-2023:2532 Copyright 2023 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libarchive-devel-3.5.3-4.el9.aarch64.rpm 728c9e27fa15a7e65734c65067cd33d075dd1558856270fc503f3cd4290358e4 ALSA-2023:2582 Copyright 2023 AlmaLinux OS 0 1 Low

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overread (CVE-2022-28805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default lua-devel-5.4.4-3.el9.aarch64.rpm f2d7ab675516c5dee02f6063118da0e1b57b5f3e2306a0cabbee9d24f65f410b ALSA-2023:2589 Copyright 2023 AlmaLinux OS 0 1 Moderate

autotrace security update

AutoTrace is a program for converting bitmaps to vector graphics. Security Fix(es): * autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default autotrace-0.31.1-65.el9.aarch64.rpm 98920a9c44565e12c779c3dfa173b00c038ad0b4234143c269931d72874d4d44 ALSA-2023:2592 Copyright 2023 AlmaLinux OS 0 1 Moderate

golang-github-cpuguy83-md2man security, bug fix, and enhancement update

go-md2man converts markdown into roff (man pages). Security Fix(es): * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default golang-github-cpuguy83-md2man-2.0.2-4.el9.aarch64.rpm 521aa2918f29b6dafff48a407a0bf64abad13727640ab0709e2bcd7be061f612 ALSA-2023:2621 Copyright 2023 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177731, BZ#2177732) Security Fix(es): * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611) * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632) * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410) * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883) * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917) * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default mysql-devel-8.0.32-1.el9_2.aarch64.rpm 425e7b5e2f1fac862f379a7b39422a8e6d9146e80719b3a698581b2e87550f2c mysql-libs-8.0.32-1.el9_2.aarch64.rpm be1a689452d853e8ec3201eea74888fda6a14b5e6f8bcd46df96ca7c23444303 mysql-test-8.0.32-1.el9_2.aarch64.rpm fc2d375076303ffbbd80717d06df14188a333ba2e029b689fc02615c563d6389 ALSA-2023:3423 Copyright 2023 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-filters: remote code execution in cups-filters, beh CUPS backend (CVE-2023-24805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default cups-filters-devel-1.28.7-11.el9_2.1.aarch64.rpm 5c3b5df66ebe548568be972c712e9d5b01b5d62ec57bc7df3f39f78c247e2bf4 ALSA-2023:3581 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.118 and .NET Runtime 6.0.18. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.118). (BZ#2212379) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.118-1.el9_2.aarch64.rpm 32631bac7fdad191ef05477b5a6f4929cf32492984761f5766305fe3d4c71a70 ALSA-2023:3585 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3.11-idle-3.11.2-2.el9_2.1.aarch64.rpm 2dfdad022c680d87e0fcfd5dc2e7737c00579ab2d5fb2a2c37174f9bde830712 python3.11-test-3.11.2-2.el9_2.1.aarch64.rpm 5d303c1ab53cdcef4af65331369ef6ec64ef54f564ae814b19ffb402ef30b228 python3.11-debug-3.11.2-2.el9_2.1.aarch64.rpm 748bc1d8b480c2cc31fba24bd974f1c1e5a2f4a476b99e2cbfde18efe2d44824 ALSA-2023:3592 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211877) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.107-1.el9_2.aarch64.rpm 52074f3d429a78a91f72edf3d6af26f39a41922838320a7f51d74b8e7390c288 ALSA-2023:3595 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3-idle-3.9.16-1.el9_2.1.aarch64.rpm 0db7352708e453899d41ee30ff0c676d6a5db6f046ba0711ffd7a6d068e51101 python3-test-3.9.16-1.el9_2.1.aarch64.rpm 3d142427dc050a03327d25073aa5ea85a9d5c84cbe3625523b43508dfe4a062c python3-debug-3.9.16-1.el9_2.1.aarch64.rpm 4afe6ccb139bd6b989a767202ae800d1bf526f24a7abe92dbf4b12bb6d794e77 ALSA-2023:3661 Copyright 2023 AlmaLinux OS 0 1 Important

texlive security update

The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems. Security Fix(es): * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default texlive-gnu-freefont-20200406-26.el9_2.noarch.rpm 16c75f425a783945efc0d78b91bf1ea50b85ae1c0a2699dfa7710075d8c68c96 texlive-lib-devel-20200406-26.el9_2.aarch64.rpm d0406709e277b997ba49a8ff94b6117355894eb6d4dffe3a9bc8ce2689a0c1d1 ALSA-2023:3711 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) * libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795) * libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796) * libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0797) * libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798) * libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libtiff-tools-4.4.0-8.el9_2.aarch64.rpm 03bd37b719d0026f2a029fcd9a9513ec64c952de857160d394b2193cc17d2c10 ALSA-2023:3714 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454) * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default postgresql-docs-13.11-1.el9_2.aarch64.rpm 98262c6cc3fb8e9fbb70c4f362906e1378cf4d792565f946e64df5089574f3da postgresql-server-devel-13.11-1.el9_2.aarch64.rpm a66c3a49311215074079e14d1c767dab1c0cdc288cc9de8c6a05743d692e7390 postgresql-upgrade-devel-13.11-1.el9_2.aarch64.rpm bcad68d016b9a8c7aaec2ceab8986b500f5ed036c682c3e144f723d32cbbbed8 postgresql-static-13.11-1.el9_2.aarch64.rpm ca1698ecacecbc8728487a9e62e293521643247bb17f1b04eecebb652e80734c postgresql-test-13.11-1.el9_2.aarch64.rpm e3f056d27931b48aea233303cbe5f849c10b87d5b236ca018b8ed8bcc0e16a35 postgresql-private-devel-13.11-1.el9_2.aarch64.rpm e47cb53372a11cb4815fe77d91a68107cc03fb01fc29ac59434bb15b4a4c2f1c ALSA-2023:3715 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libvirt-lock-sanlock-9.0.0-10.2.el9_2.aarch64.rpm 2081600d5a728738b221a43977ec6ef1919cbd5657caf191d06b644ecda71e24 libvirt-client-qemu-9.0.0-10.2.el9_2.aarch64.rpm 31a0dad7e339d1bb06fbc54484af152ff4c83a6815700dd666335bf4f5a2a2e9 libvirt-docs-9.0.0-10.2.el9_2.aarch64.rpm 859b03e414e6917abb44fc21b84a7b5a33914a33a7f71ede405be14c04e0083a libvirt-devel-9.0.0-10.2.el9_2.aarch64.rpm aa1779f1ddd783d61f1767a61159abbbe0a3738dc1ae9d9a0fcfbec217fbceac ALSA-2023:3723 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235) * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233) * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002) * kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124) * kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194) * kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel QAT Update - (kernel changes) (BZ#2176846) * RPL-P IOTG/RPL-S IOTG: cpu frequency issues (BZ#2178857) * In FIPS mode, kernel does not transition into error state when RCT or APT health tests fail (BZ#2181727) * Kernel BUG in iwlmvm wifi driver when used Mesh systems (BZ#2186723) * Azure AlmaLinux 9 Backport upstream commit 93827a0a36396f2fd6368a54a020f420c8916e9b [KVM: VMX: Fix crash due to uninitialized current_vmcs] (BZ#2186822) * AlmaLinux 9 blktests nvme/047 lead kernel NULL pointer (BZ#2187536) * Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2187709) * kernel[-rt]: task deadline_test:1778 blocked for more than 622 seconds (BZ#2188655) * fix page end in filemap_get_read_batch (BZ#2189349) * AlmaLinux 9.2 hwpoison: data loss when memory error occurs on hugetlb pagecache (BZ#2192348) * wdat_wdt watchdog timeout triggered unexpectedly (BZ#2192585) * ice: high CPU usage with GNSS or ptp4l (BZ#2203154) * AlmaLinux 9 "smpboot: Scheduler frequency invariance went wobbly, disabling!" on nohz_full CPUs after long run (BZ#2203178) * Dying percpu kworkers cause issues on isolated CPUs [almalinux-9] (BZ#2203229) * FJ9.2 Bug: [REG] NFS infinite loop of COMMIT call and NFS4ERR_DELAY reply. (BZ#2203335) * perf errors - "event syntax error: 'unc_p_delayed_c_state_abort_core5'" b'_ value too big for format, maximum is 255' (BZ#2207471) * AlmaLinux 9: Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst (BZ#2208242) * cifs: backport small patches to bring us close to 9.1 - backport commit aea02fc40a7f cifs: fix wrong unlock before return from cifs_tree_connect (BZ#2209045) * AlmaLinux 9 x86_64, kdump 2nd kernel will randomly panic on "kvm-08-guest25.hv2" (BZ#2210614) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default kernel-tools-libs-devel-5.14.0-284.18.1.el9_2.aarch64.rpm 11247ee58e2b5014cba04cbddbf65a0e92fd396bfa40a720b45fe78346d9558f ALSA-2023:4057 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet7.0 (SDK 7.0.109, Runtime 7.0.9). (BZ#2219634) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el9_2.aarch64.rpm b2b485d6746fffbd7c73e9fca7d28e5ba2807f043ee69c64c5b9d9c741025147 ALSA-2023:4060 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet6.0 (SDK 6.0.120, Runtime 6.0.20). (BZ#2219640) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.120-1.el9_2.aarch64.rpm b1d0f1b324707b02a059ee4c670ac290e6f46e93bab4a8fd8bc1686c5ec919ba ALSA-2023:4099 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default bind-doc-9.16.23-11.el9_2.1.noarch.rpm 3626cfa861e4506dc542b852affac40020461c645de4b287336e8be7112c589f bind-devel-9.16.23-11.el9_2.1.aarch64.rpm f2c5450eebeeace2cbb1031ca7c5a459e587c545905c74ea4065b62727d2cccd ALSA-2023:4158 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [almalinux-9] (BZ#2223100) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-11-openjdk-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm 04f0edb7c78d1a85b8d02943f0a13b751a68672d7682322822b8529e9dd3415a java-11-openjdk-static-libs-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm 1516a435b9475261f10117741ce9a48dda12a9e1d50c1d63050f848602d337ba java-11-openjdk-demo-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm 2c8a5accb3d1718bdb77ca99eaaa92fb27f9faa2680c23adfd5577c51973bab9 java-11-openjdk-src-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm 3c0c2cc912db074518c23fdd5ae946ed7278a101b15b6bb6768536011ffa5363 java-11-openjdk-headless-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm 4d668cd6d252cc653daa9eb052109f724dd0bef759e6fa25c4057e07ab8f8f20 java-11-openjdk-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm 5130f89fc90a1253dfe14153e17cd07a816f09f1a4a189144efc05cee427b99c java-11-openjdk-jmods-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm 58380d323660208d5c4ad0db7375069d658418d8d2297fa0278da6d99f9de265 java-11-openjdk-headless-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm a7d25a93ec13b5c70947ade6474f3c8563fa071180da1f65e3965d9b79017cfd java-11-openjdk-demo-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm ab224c5908f5da973d32f4525c2110d6457add4069d5f42985b602cb06ead661 java-11-openjdk-src-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm b0d8c9f2629e4dad764d9b5e8ad077b999cc4c6b5cd9baa2c2144e1b0e0eb379 java-11-openjdk-jmods-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm c05303b3e99bf109962b08f03813d48be268c10fb3b52fd8938ab1ba3366db6e java-11-openjdk-devel-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm dce99ccae34309510e08218eb893d18990112bdb4a3c203c5f55ac425a309599 java-11-openjdk-static-libs-slowdebug-11.0.20.0.8-2.el9.aarch64.rpm e50c1f8818a924efbf74b07f6227fc3dd9e2f93f9baa72eb56e51eaa36652a88 java-11-openjdk-devel-fastdebug-11.0.20.0.8-2.el9.aarch64.rpm f34d410b36f90a948d86276274e5ad441b4c9073304b56bfc6bf10d1e3cb31f7 ALSA-2023:4177 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653) * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-9] (BZ#2222852) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-17-openjdk-headless-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm 0d8e7b8faf89e0be5a42e6366f1f91cfa0812e0f59e9d191071d4ba3916ce291 java-17-openjdk-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm 28bb54e9a41a4fe31cb194b1d670b3546887678c4a47f7ce9c3de02f5ba3b324 java-17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm 34289710829d5043699d8db6a08450eff2a5200c84dfa74c4e5425c73bb685ed java-17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm 53bb39ca020e76b43b91007285868fd0ab6d2a31c849bb07529e42f245c5cc08 java-17-openjdk-demo-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm 5bfe226ecb16fbb71d4a5558ab3e6dfd2ebd00f05d7a91427c26703306b76770 java-17-openjdk-src-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm 5c927d9f506b1ea53d1d9b880ec56ae75a69b876b09731c5328fd68efa1bef2d java-17-openjdk-demo-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm 96b71e843587127671f2cce95f5d886af4c0aa0755af87215f190d2956b6b40a java-17-openjdk-headless-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm 97d704a48f33897c3c0addf3102ab6772e7dd91f1611b5a924f29ff291b784c0 java-17-openjdk-devel-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm a3fb7bf05471e78e1b39c847f61647abc8ce0df5faa904eb10d91016a1574c63 java-17-openjdk-jmods-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm bf1f3672221b4da5b8fa839285dd41c4106341c14738c187bad5fd32f428f49e java-17-openjdk-jmods-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm d5ca0d4ccb3652aa013512654591001b8ee22a541b8358a62baf1c7ca27f7b52 java-17-openjdk-devel-slowdebug-17.0.8.0.7-2.el9.aarch64.rpm d762eb1865b287824ee1d516aea138fee5bebef990a9ee2ac3ae728d6fc317f0 java-17-openjdk-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm d9aa813cca3aed7ebc6acb1296b21e171c0a866f54cda5e6e192674452fc2797 java-17-openjdk-src-fastdebug-17.0.8.0.7-2.el9.aarch64.rpm ef080ae49d451bf28554135907e0b1d40c71faba4aadb6584a9a0b18d9b1156d ALSA-2023:4178 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) [almalinux-9] (BZ#2220662) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-1.8.0-openjdk-src-fastdebug-1.8.0.382.b05-2.el9.aarch64.rpm 16f3f421eeb22f4afdff7cb33427ae150fb69688fd09595fcfc420c15a72e75a java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-2.el9.aarch64.rpm 4559d613c10c95fa40541dd3173566595fd6e8b0e361977511a46ed42891f8da java-1.8.0-openjdk-demo-fastdebug-1.8.0.382.b05-2.el9.aarch64.rpm 4adf106b6751df6378f45d9def49939ec17f725d70f26a1002565bbc460457db java-1.8.0-openjdk-fastdebug-1.8.0.382.b05-2.el9.aarch64.rpm 63cdcc47aebfaa48654be22445c95bbc19481cd87aa50e09d60499f82176bd86 java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-2.el9.aarch64.rpm 6cef3f4c9e7d8d568f3aca3f1f6eeb847ff165d0eb352618d6e4ec24219d96be java-1.8.0-openjdk-headless-fastdebug-1.8.0.382.b05-2.el9.aarch64.rpm 716965c5e489ff9ee80489de788ceeeaf815179a0b260b78f1205597c0c4fb30 java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-2.el9.aarch64.rpm 8121b95e537950262401485349ea54abd40c9668f380df933a237ff56000000c java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-2.el9.aarch64.rpm 894f49a9af7d0cfdb624ca76dcd914319ce17b3435d544f193a05f437992ab4e java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-2.el9.aarch64.rpm 960fd92abced68cce4755209fb0b1d85f7afdd39d26bb8b4f8631672bc9a2b51 java-1.8.0-openjdk-devel-fastdebug-1.8.0.382.b05-2.el9.aarch64.rpm ec580705021db557da3ef6bb1b365af348c7458ac4ae9fba9bdcfc0d49a9949b ALSA-2023:4325 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security and bug fix update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: SMB2 packet signing is not enforced when "server signing = required" is set (CVE-2023-3347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The trust relationship between this workstation and the primary domain failed (BZ#2223600) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libsmbclient-devel-4.17.5-103.el9_2.alma.aarch64.rpm 1b673dbf69df6155f9384ce2d0d7c126cf00363f30e00912c7b2912e8cba0acc libwbclient-devel-4.17.5-103.el9_2.alma.aarch64.rpm 277ba39e8363dd775c2b1dca5ea78caf36dc20a54c094644695a93fca3d02037 python3-samba-test-4.17.5-103.el9_2.alma.aarch64.rpm 3d23e10cebf054e756a73c848a4c2255da50db6a569451ad4485a9e0cd0fe908 samba-devel-4.17.5-103.el9_2.alma.aarch64.rpm 664181be5248d781b63f79f866fc96707eac16a593d67bba26df423ef38e0d4e samba-test-libs-4.17.5-103.el9_2.alma.aarch64.rpm 94c0deddc9f684a64e1fd6326c165d17a43882dee04510ca6f5d9b40e462ecca samba-pidl-4.17.5-103.el9_2.alma.noarch.rpm a5359420cdecee730be12c0b6671254d313b1999e65343f668df6c6fbf625afc libnetapi-devel-4.17.5-103.el9_2.alma.aarch64.rpm d6033207abb343876c1a68df59983ae554360466448765142791be0077c517b6 python3-samba-devel-4.17.5-103.el9_2.alma.aarch64.rpm df99b39bf478ce1f95304712b948425fc648d3d268526d7049b5550492e6b8b2 samba-test-4.17.5-103.el9_2.alma.aarch64.rpm ecb04b7bf14e60f44bdd374ffe1d32051a2e7fd68e05a409dded453f51752380 ALSA-2023:4377 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090) * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788) * kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869) * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458) * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default kernel-tools-libs-devel-5.14.0-284.25.1.el9_2.aarch64.rpm 2aadf36f2b83289cdb69a86d40959a2d2567e24ffaab19309aaa291835da60ee kernel-cross-headers-5.14.0-284.25.1.el9_2.aarch64.rpm fed6bb23a4cc8263df8efea71e94a6d3f803850688c96b2c809218fbf542d352 ALSA-2023:4642 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.110 and .NET Runtime 7.0.10. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.110-1.el9_2.aarch64.rpm af0cccd4d3c72f569f4bf56f359fb98e8786cdfb3e2ce3ce83b6b46e0652d1bb ALSA-2023:4644 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.121 and .NET Runtime 6.0.21. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.121-1.el9_2.aarch64.rpm 9e24315e2f1f0626d22517aafa8bb7115f17e637d774cb325b22c0a92aae4b24 ALSA-2023:5048 Copyright 2023 AlmaLinux OS 0 1 Important

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default flac-devel-1.3.3-10.el9_2.1.aarch64.rpm 591f4838bf4930208fc51df86a85600c0e46c283d2aa4f8ae6e3991959dd8ac0 flac-1.3.3-10.el9_2.1.aarch64.rpm 96a143cb2d55c0ef0bf9eaf3f6a499b5fdbba12191cfb2f0acfa6fee1deac018 ALSA-2023:5069 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel (5.14.0). Security Fix(es): * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390) * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610) * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776) * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004) * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147) * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248) * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001) * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637) * hw: amd: Cross-Process Information Leak (CVE-2023-20593) * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [Intel 9.3 BUG] [SPR][EMR][FHF] ACPI: Fix system hang during S3 wakeup (BZ#2218026) * [Dell 9.2 BUG] Monitor lost after replug WD19TBS to SUT port wiith VGA/DVI to type-C dongle (BZ#2219463) * rtmutex: Incorrect waiter woken when requeueing in rt_mutex_adjust_prio_chain() (BZ#2222121) * AlmaLinux AWS ARM Instability During Microshift e2e tests (BZ#2223310) * AlmaLinux 9.x updates for SEV-SNP guest support (BZ#2224587) * Lock state corruption from nested rtmutex blocking in blk_flush_plug() (BZ#2225623) * bpf_jit_limit hit again - copy_seccomp() fix (BZ#2226945) * libceph: harden msgr2.1 frame segment length checks (BZ#2227070) * Temporary values used for the FIPS integrity test should be zeroized after use (BZ#2227768) * Important iavf bug fixes July 2023 (BZ#2228156) * [i40e/ice] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228158) * lvconvert --splitcache, --uncache operations getting hung (BZ#2228481) * perf: EMR core and uncore PMU support (BZ#2230175) * NVIDIA - Grace: Backport i2c: tegra: Set ACPI node as primary fwnode (BZ#2230483) * NVIDIA - Grace: Backport i2c: tegra: Fix PEC support for SMBUS block read (BZ#2230488) * [Hyper-V][AlmaLinux 9]incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230747) * Kernel config option CONFIG_CRYPTO_STATS should be disabled until it is enhanced (BZ#2231850) * [AlmaLinux 9][Hyper-V]Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231990) * AlmaLinux-9: WARNING: bad unlock balance detected! (BZ#2232213) * NVIDIA - Grace: Backport drm/ast patch expected for kernel 6.4 (BZ#2232302) * [Lenovo 9.1 bug] AlmaLinux 9 will hang when "echo c > /proc/sysrq-trigger". (BZ#2232700) * [AlmaLinux-9] bz2022169 in /kernel/general/process/reg-suit fails on aarch64 (/proc/[pid]/wchan broken) (BZ#2233928) Enhancement(s): * [Intel 9.3 FEAT] cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2210270) * [Dell 9.3 FEAT] - New MB with AMP Codec Change on Maya Bay (audio driver) (BZ#2218960) * [Lenovo 9.3 FEAT] MDRAID - Update to the latest upstream (BZ#2221170) * [Intel 9.3 FEAT] [EMR] Add EMR support to uncore-frequency driver (BZ#2230169) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default kernel-tools-libs-devel-5.14.0-284.30.1.el9_2.aarch64.rpm c48031630b5e3f6ebff5da16492c29c4e23274f702e760983c184a2707a5a476 ALSA-2023:5143 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.122 and .NET Runtime 6.0.22. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.122-1.el9_2.aarch64.rpm 2ee8474aa75203df046a839dde9905f0a320550fc72c13b852200a89f7575a6a ALSA-2023:5146 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.111 and .NET Runtime 7.0.11. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.111-1.el9_2.aarch64.rpm ea0a1a69771c5da01d0f746fe068d29cdf5cf91284c59858910c4503a66161ae ALSA-2023:5214 Copyright 2023 AlmaLinux OS 0 1 Important

libwebp security update

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libwebp-tools-1.2.0-7.el9_2.aarch64.rpm 4d253294e35958bbc6303ab3c1afaeb5277c8af498c95b06d24ce411ccd1372e ALSA-2023:5453 Copyright 2023 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911) * glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) * glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806) * glibc: potential use-after-free in gaih_inet() (CVE-2023-4813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default glibc-static-2.34-60.el9_2.7.aarch64.rpm 3352f62f7dfb88bb51c4b0524b482cef30a427cd32c07b069b4985db8c1e065e glibc-nss-devel-2.34-60.el9_2.7.aarch64.rpm 3dd5ed65320b708c2db8163d7355d058b4e4f67613b16edfdaa837c03f88b4c6 glibc-benchtests-2.34-60.el9_2.7.aarch64.rpm 89ea7d8a7667bcb5e918694ea0138bd0d92bc1a2320028e709afd57bceda1fde nss_hesiod-2.34-60.el9_2.7.aarch64.rpm 94cf9f3e14380f573f9f58ecbb31a47fec952b03754fdcbc8b47d95c022688de nss_db-2.34-60.el9_2.7.aarch64.rpm 985437109366e72a477c3f13ef600c9c93e05fc73be269d77c0eb90b879c855b ALSA-2023:5456 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3.11-debug-3.11.2-2.el9_2.2.aarch64.rpm 9d9631726ae6cd5474341aaf3686465711a3f4275b6b3c26bb44323f7bd25f81 python3.11-idle-3.11.2-2.el9_2.2.aarch64.rpm d0c3c36de378fc8d178615ebd720bd6bff22068f445e3f6844074731c298fb4d python3.11-test-3.11.2-2.el9_2.2.aarch64.rpm e18687065f02ef0b559132daa91b1733a7870555e5f00b45a2866833bd418806 ALSA-2023:5459 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices (CVE-2023-36664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libgs-devel-9.54.0-10.el9_2.aarch64.rpm dbe51b018516c4bdcf9be6e887111f4a9ef263276e48140f412afcb01af796a6 ALSA-2023:5462 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3-test-3.9.16-1.el9_2.2.aarch64.rpm 04387590be55c14c42a0f56ef926e88345ecc235fb48110bd265ab9e534a5700 python3-debug-3.9.16-1.el9_2.2.aarch64.rpm 32b56dfebd2cbc9ff903b32051fa3190a279a1de2e286389da15d03179c0fb47 python3-idle-3.9.16-1.el9_2.2.aarch64.rpm c87ee594438dbf0fcabc0ec40f5a92963c6fc21a0d6e8d9330ecbac9bb52285b ALSA-2023:5539 Copyright 2023 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libvpx-devel-1.9.0-7.el9_2.alma.1.aarch64.rpm 2c273738b6876ddf72f259ec21e4d69f34ff5601c35cd8c5e4c83e18c07e4d42 ALSA-2023:5684 Copyright 2023 AlmaLinux OS 0 1 Important

galera and mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22). Security Fix(es): * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157) * mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081) * mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082) * mariadb: segmentation fault via the component sub_select (CVE-2022-32084) * mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089) * mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091) * mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791) * mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default mariadb-test-10.5.22-1.el9_2.alma.1.aarch64.rpm 330d21a31b24a488ac306e9fcd0072449edd29c6c25c0babcc13eb9d52759bb9 mariadb-embedded-devel-10.5.22-1.el9_2.alma.1.aarch64.rpm 3455db17014a976181bf47fc5d1a61f0f4e54a9085f041484366ba9aeee1f2d6 mariadb-devel-10.5.22-1.el9_2.alma.1.aarch64.rpm 89837b0619df8f725ad2c6723f751bc67ed855abcf64486b7368686a39f27e91 ALSA-2023:5689 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default bind-doc-9.16.23-11.el9_2.2.noarch.rpm 66efa77c46000b37186909a04710d2643178d4f0246f35f8d0a8c8eddd9829b0 bind-devel-9.16.23-11.el9_2.2.aarch64.rpm b7519cbd39b75a4aa7590126caf9ee5b1e1048b21463a8407b916aef5d4475d2 ALSA-2023:5708 Copyright 2023 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.123 and Runtime 6.0.23. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.123-1.el9_2.aarch64.rpm 4cd97f1cd8bc1d75fe0e06a2cce05fc36e72548438b1e2d5bdb795065cac943e ALSA-2023:5711 Copyright 2023 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.aarch64.rpm 68a35283e7e271b837b02106cc4f0f8896113d941693d7ee9ee92ad852015910 ALSA-2023:5733 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433) * OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (AlmaLinux-13593) * The /usr/bin/jfr alternative is now owned by the java-1.8.0-openjdk package (AlmaLinux-13583) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-3.el9.aarch64.rpm 07b21f3fc2da13288e6ee8df8294f1e576fbd05d85fd2f489fb5b398bdebc679 java-1.8.0-openjdk-devel-fastdebug-1.8.0.392.b08-3.el9.aarch64.rpm 2ba9f146bb2d1bac29226ef3363f463f71adb4c31aa488e94c5bdf96a88240fb java-1.8.0-openjdk-src-fastdebug-1.8.0.392.b08-3.el9.aarch64.rpm 2d9e6ff5316b8828fe8683c5cb267452beaf4802a5cb23e45a6097d2d8be8646 java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-3.el9.aarch64.rpm a972c1f54f7dae12f42d4c3e55a8bc1262b1828e9782e6e2748bf3b5e9d12df7 java-1.8.0-openjdk-fastdebug-1.8.0.392.b08-3.el9.aarch64.rpm acf1c3025f8abfd0b758fc74e291db00ca4b18d8b09658471bd07b674cac1358 java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-3.el9.aarch64.rpm afdf734ef75dab7cf40e01cf3ffd3ee57bc60ab663b7cbad8926f2d106149d77 java-1.8.0-openjdk-headless-fastdebug-1.8.0.392.b08-3.el9.aarch64.rpm b20f46417bf8e3d6746d96c1cc8c1f5090b20cead7083589ce8fdadc637c2c39 java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-3.el9.aarch64.rpm bd6734ecfdf8ea91f62f9e6646b481d0d45037cff4da2f767a6dad6f7061f8ff java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-3.el9.aarch64.rpm c3b831e2265718beb298ee72e389b2f0757602d7dbc40d3372fc3946df9e3d60 java-1.8.0-openjdk-demo-fastdebug-1.8.0.392.b08-3.el9.aarch64.rpm d433d58485a2feebb642d92c046dd0d40246eb0ca2fe3866b7ffaeadc5aa9fbe ALSA-2023:5744 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 11.0.20 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 11.0.20.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237175) * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 11.0.20 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 11.0.20.1, increases it to 16 MB. * The serviceability agent would print an exception when encountering null addresses while producing thread dumps. These null values are now handled appropriately. (JDK-8243210) * The /usr/bin/jfr alternative is now owned by the java-11-openjdk package (AlmaLinux-13532) * The jcmd tool is now provided by the java-11-openjdk-headless package, rather than java-11-openjdk-devel, to make it more accessible (AlmaLinux-13536) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-11-openjdk-devel-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm 0a6bee1d825cd15794a49129c9d21ce5040dd049484cfd6a3bcd9befc2c1a6e0 java-11-openjdk-src-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm 217e05acbf97a85402edab1dca1cb7323afc0f4921f38592a5e4957adb3f9a4a java-11-openjdk-demo-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm 2c65e4fb17fb472d787c9e36f9f61a7a139b71e56d4c261b9bd24b3fa0d8fbc2 java-11-openjdk-demo-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm 31a47d51184f535b17bb8bbe8aef7bece92356e1eddbf7674d3a89978e94019e java-11-openjdk-headless-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm 74eb9d7ceb81b811d0c6f96860f961af62f2b7ecba008b84b896b64a96f620c5 java-11-openjdk-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm 76de4bc581e43cefc0f4948b1c980124246a754b12112068a71ffd3d194b2514 java-11-openjdk-jmods-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm 8271201af86e5bf24a0614ba74c9b45f9e1c9deee4867bff8a54e9959cd79717 java-11-openjdk-static-libs-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm 98f8092bbec023dd9ebc4386e592ea321599443542dcabcf114e3af820836a2e java-11-openjdk-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm a18b179ed7e98dd96a0cc88e8373d3d5a66fed9401008d71c5f2eb27c9b81fee java-11-openjdk-devel-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm a7717110d155246400c0ec24bcab9dae7ecef3353fcf80384b4772839edc505c java-11-openjdk-jmods-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm be08018e347dd9d70e1867e65551da3ad4367b193434ce3e35134cd1f555152c java-11-openjdk-static-libs-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm d2622f7f7ac2b894239a8cd4a9a93b23602f1be71f323f48f53b8d16367598fc java-11-openjdk-src-fastdebug-11.0.21.0.9-2.el9.aarch64.rpm e6ba63c0bd963d843ff3e3253d723a9a09703bd405fb2a9e8201d615592181fb java-11-openjdk-headless-slowdebug-11.0.21.0.9-2.el9.aarch64.rpm f7fd0ff57ee9d24a71c9f0c019e7d7d6084709ae634f874af4764113af604d18 ALSA-2023:5749 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 7.0 to SDK 7.0.112 and Runtime 7.0.12. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.112-1.el9_2.aarch64.rpm eee8a2196f6a601e540aae5df843efce46d0dcd30ac08cd9a5b07f63a6dd7f05 ALSA-2023:5753 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 17.0.8 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 17.0.9, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237185) * The /usr/bin/jfr alternative is now owned by the java-17-openjdk package (AlmaLinux-13648) * The jcmd tool is now provided by the java-17-openjdk-headless package, rather than java-17-openjdk-devel, to make it more accessible (AlmaLinux-13651) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-17-openjdk-demo-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm 168f7a40c58f2abd4878d33c132a75f8175211d4588a041645bcaf1760a68a58 java-17-openjdk-headless-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm 2d8d62f28591249e46b71fc5f962bdefe7b81e61afa44520d4db9326665ad201 java-17-openjdk-src-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm 62e90cde24dccdea5b88e41c23f8afb0047341647df5c58b61d5485917d352aa java-17-openjdk-static-libs-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm 70bfdf410a0d8dcbfe97b529b428724dcaa4b606d393fe7f3a09ddc2e5558156 java-17-openjdk-devel-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm 734f95ffa64b0e50d97f612222b2a7a619dec2236fc901ea04b9e6815333ea76 java-17-openjdk-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm 84c367ff52f9f7c417ac5e834b3069a8334c090eaa9dbf5964ffaebd6cc9d9f1 java-17-openjdk-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm 9404a83ab590555e21e330e8a288323bf26955369991d09158fb8d5cf2df32be java-17-openjdk-jmods-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm a4f729e5c33dd528e3a17144808354e059196b1505acf56a4027b83422f350a6 java-17-openjdk-static-libs-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm b19c3b76869d78de59076ecf295c05dd0f08831858247b7e20786d766dbeea56 java-17-openjdk-jmods-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm c1fd4fc672578c5f75029f8b1e8affe499a8daa5c41fccb664f9a2bba1cdbf40 java-17-openjdk-headless-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm c30179791ce94eab71ade4112a54845561c9c56bef8b0a00a24a066679778878 java-17-openjdk-src-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm d8c56e42f62400aa717f66d78e198224fe1cadaab0fc6195dab17e3819f401c9 java-17-openjdk-demo-fastdebug-17.0.9.0.9-2.el9.aarch64.rpm d9358e0234ec7706d3067c0da62796b9e0b929c4d93cb303710910db14943688 java-17-openjdk-devel-slowdebug-17.0.9.0.9-2.el9.aarch64.rpm e341364c0994e59da0e88cfafe5d20dd3830af35734bb46e33e963cce55f9e8f ALSA-2023:5838 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libnghttp2-devel-1.43.0-5.el9_2.1.aarch64.rpm b8c9b97c9f48be0ca732dfde5d75731b1bc1afcf5e1b84aeb9373349f1b68872 nghttp2-1.43.0-5.el9_2.1.aarch64.rpm feb0ded4795c8ffedfe2319e96cb926a23fbb9d4d59d7921df6c37e43f8303ff ALSA-2023:5924 Copyright 2023 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default varnish-devel-6.6.2-3.el9_2.1.aarch64.rpm 2e7718164e5eb7fe70678be2cd2e77841f52a31c2f58b66b3bace81f6e2b0483 ALSA-2023:6242 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.124 and .NET Runtime 6.0.24. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.124-1.el9_2.aarch64.rpm 12a0db26ad889963cbefa1dc369657a6c426832d57df5dd09dce3b0e3f184a32 ALSA-2023:6246 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.113 and .NET Runtime 7.0.13. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.113-1.el9_2.aarch64.rpm c029f732a41e4cfeb2d64035f1408a4dd9b981eb4b0419b67e8457540ac061e5 ALSA-2023:6265 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libgs-devel-9.54.0-11.el9_2.aarch64.rpm 0c832c71aafe9115cd34896be588d9dea1a9075138eabd82072c2725e754d80b ALSA-2023:6330 Copyright 2023 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default edk2-tools-20230524-3.el9.aarch64.rpm 7a9748dcb86b262479b73eedb3d525353f454ccecfb636799c0e4474ea7330d7 edk2-aarch64-20230524-3.el9.noarch.rpm 7f420a2e6902aa83721973936da687385ce3f9a318f79cec650eaf58da03c9ed edk2-tools-doc-20230524-3.el9.noarch.rpm bc4917712bdd37c686a2e9927839c2ca2f3285b9325d99e9fe4bb9eb8a68f06b edk2-ovmf-20230524-3.el9.noarch.rpm cf00362ca3ecc9d6ce43ec1f21168c8524b96b2675854692c3afd7bf709e0918 ALSA-2023:6340 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default xorg-x11-server-devel-1.20.11-19.el9.aarch64.rpm e7cde849d92eacf914a686c607928ad3bc5942cb55d98b322e4caca769b2bc69 xorg-x11-server-source-1.20.11-19.el9.noarch.rpm ed9468d65a98be100088d86f19083f24832179b05fca80ab20b7058d4b20ea55 ALSA-2023:6369 Copyright 2023 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

Qt is a software toolkit for developing applications. Security Fix(es): * qt: buffer over-read via a crafted reply from a DNS server (CVE-2023-33285) * qt: allows remote attacker to bypass security restrictions caused by flaw in certificate validation (CVE-2023-34410) * qtbase: buffer overflow in QXmlStreamReader (CVE-2023-37369) * qtbase: infinite loops in QXmlStreamReader (CVE-2023-38197) * qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default qt5-devel-5.15.9-1.el9.noarch.rpm 14df93938a3e6baf085f3edb3deec26a56cf6eff403e27dbc124e5a0fdca69d5 qt5-qtbase-static-5.15.9-7.el9.aarch64.rpm 89e697cf8df1761190fd4bfdbe4aa178c4215e9d33658e77a017ff38242c2970 ALSA-2023:6409 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785) Security Fix(es): * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libvirt-client-qemu-9.5.0-7.el9_3.alma.1.aarch64.rpm 8c36f95302c734d1c550d9d0ca23db73df120d2eb1e673c1fb65d3a0ba6b3068 libvirt-docs-9.5.0-7.el9_3.alma.1.aarch64.rpm 8c677c4ab7d837ff747c51203ce8b191ef8ecfed2dcc8984a53f6b623a44226a libvirt-daemon-plugin-sanlock-9.5.0-7.el9_3.alma.1.aarch64.rpm ef6c8f2f9b854a425c0adb12f289f1928d35d092171263a4943c9b2323787362 libvirt-devel-9.5.0-7.el9_3.alma.1.aarch64.rpm fd4326aee6cf8a365d32bc91b0d220bc2a352e0fdb0a84d55e15b944a599ddca ALSA-2023:6431 Copyright 2023 AlmaLinux OS 0 1 Moderate

libfastjson security update

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fix(es): * json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libfastjson-devel-0.99.9-5.el9.aarch64.rpm 1afc430711d823780142130b5b67a1a2e0f54bdd0dbffb2fee487ecb92fef569 ALSA-2023:6469 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: RTPS dissector crash (CVE-2023-0666) * wireshark: IEEE C37.118 Synchrophasor dissector crash (CVE-2023-0668) * wireshark: Candump log file parser crash (CVE-2023-2855) * wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856) * wireshark: NetScaler file parser crash (CVE-2023-2858) * wireshark: XRA dissector infinite loop (CVE-2023-2952) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default wireshark-devel-3.4.10-6.el9.aarch64.rpm 5165ce5486a5eed3686bff73a8590d3cafee395a2092ec1637cbd710940160f2 ALSA-2023:6482 Copyright 2023 AlmaLinux OS 0 1 Moderate

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c/librabbitmq: Insecure credentials submission (CVE-2023-35789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default librabbitmq-devel-0.11.0-7.el9.aarch64.rpm 8ecb642275347f4ed7f80bde795214888d2769c0fec35e943b3463741089015c ALSA-2023:6494 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.11 (3.11.5). (BZ#2210785) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) * python: file path truncation at \0 characters (CVE-2023-41105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3.11-idle-3.11.5-1.el9_3.aarch64.rpm 3f2c4e2e61ce937014d6e6eb8fffc9b30a671b1a0d407cf48ea8398a4ff56a0e python3.11-test-3.11.5-1.el9_3.aarch64.rpm a5e84d8145edc2bc1ec45ea42c5431a8b396cb39e2c8e3e671c4f109d0eec70c python3.11-debug-3.11.5-1.el9_3.aarch64.rpm c9b958a8ae6cdc13f0f50666edd5c02239af0e50820696eda54f290bdc2bdedc ALSA-2023:6518 Copyright 2023 AlmaLinux OS 0 1 Moderate

flatpak security, bug fix, and enhancement update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. The following packages have been upgraded to a later upstream version: flatpak (1.12.8). (BZ#2221792) Security Fix(es): * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100) * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default flatpak-devel-1.12.8-1.el9.aarch64.rpm 52eaf143b3e493f2eef36591d3fdcdb81af63550b881b291dfeaa5578bc611a3 ALSA-2023:6544 Copyright 2023 AlmaLinux OS 0 1 Moderate

ghostscript security and bug fix update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879) * ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS (CVE-2023-38559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default libgs-devel-9.54.0-13.el9.aarch64.rpm 70854d8a488f06b0e7a1e1418e35286d75ea1fed2ae2fe6c5707b6e07038f85d ALSA-2023:6551 Copyright 2023 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default yajl-devel-2.1.0-22.el9.aarch64.rpm 263477ca542bae4ff3e41f243fcef11174ce6651fedd0c2aa7e67c4a02bb7282 ALSA-2023:6566 Copyright 2023 AlmaLinux OS 0 1 Moderate

libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application. Security Fix(es): * libmicrohttpd: remote DoS (CVE-2023-27371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libmicrohttpd-doc-0.9.72-5.el9.noarch.rpm 67390759e2ec13f61ba7f59dbe3cfaa36ab3d99119dee2bb683a6e76818003ec libmicrohttpd-devel-0.9.72-5.el9.aarch64.rpm fdcefa5dc92899e9687d949d79c5e4c2795a8a7798ff2c3f6b79df3d213ff141 ALSA-2023:6575 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731) * libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316) * libtiff: memory leak in tiffcrop.c (CVE-2023-3576) * libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c (CVE-2023-26965) * libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libtiff-tools-4.4.0-10.el9.aarch64.rpm 9f3994e38bd1cad1f8bcd9b55574014b8b68da27f1451f51a99dddd101b77241 ALSA-2023:6621 Copyright 2023 AlmaLinux OS 0 1 Moderate

protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers. Security Fix(es): * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default protobuf-c-compiler-1.3.3-13.el9.aarch64.rpm 4ece2848fd2a3d02d4af9f79d8c56c77c51a2f4c5b71816c401ccfb01775c1ea protobuf-c-devel-1.3.3-13.el9.aarch64.rpm 57bc80e7f31e347ddb10b58fe3529d23fffaafbf874fe4e3a329b9b14cbcfb90 ALSA-2023:6631 Copyright 2023 AlmaLinux OS 0 1 Low

glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499) * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611) * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default glib2-static-2.68.4-11.el9.aarch64.rpm 3cf913259a1ccc62a68af14b915b3fa142a064c0020139b3036f1febb26d3eeb ALSA-2023:6632 Copyright 2023 AlmaLinux OS 0 1 Low

shadow-utils security and bug fix update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default shadow-utils-subid-devel-4.9-8.el9.aarch64.rpm 06015e0e7bc1845463d5dfe29d9e696950f26586fd9f1f946c4a4f4d48ececfa ALSA-2023:6659 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.18). (BZ#2210783) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3-test-3.9.18-1.el9_3.aarch64.rpm 4aaf197c060dbfa61f88f99c2aa6b134702cd61a78bbf9a1efaf01e6a435ffac python3-idle-3.9.18-1.el9_3.aarch64.rpm b16c8fc2a91cb5b1d2951b45b365516265ef9fe487bd8aecd10d6c5520ec03bd python3-debug-3.9.18-1.el9_3.aarch64.rpm be0cd11a6a6dc6ac913c8712c8e6dc23cd37092e95c917cd38e5b5190b5d0d95 ALSA-2023:6667 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415) Security Fix(es): * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127) * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966) * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967) * samba: spotlight server-side share path disclosure (CVE-2023-34968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default samba-test-4.18.6-100.el9.aarch64.rpm 2990703d2341d2b5a1ab65ef310809d66ff98e76e670392fcfeb63787c27c8dd libnetapi-devel-4.18.6-100.el9.aarch64.rpm 30c7d0c8ca52f33b7b571ab59a5af7f6ab458e6abf3ab856419f2951ec5b6087 samba-test-libs-4.18.6-100.el9.aarch64.rpm 5db12560e49d785349cbd02233927f1157a87eeb1f735b308eaeffd62e1d5369 samba-pidl-4.18.6-100.el9.noarch.rpm 612991a14c95fa2121a221b922b765cc7bec8b2556c61d9b4fec0ed42bae7173 samba-devel-4.18.6-100.el9.aarch64.rpm 7b4da55c20a0d4b613b8011055cda111df4ea7e347a481161add925dfb4c397c libsmbclient-devel-4.18.6-100.el9.aarch64.rpm 9c66eb3164410ff0a7284ac8d8347bc65cdb4213c7e80ec69be9aca1bd32e4cd python3-samba-devel-4.18.6-100.el9.aarch64.rpm e43fca89741f85dd8d4d16af1e25bcb2002390e7a5e956e61e06e4e9a5a68080 python3-samba-test-4.18.6-100.el9.aarch64.rpm eaa69885fef98af2d483327f8cbe68889243318b0da5165293810065f7b9527c libwbclient-devel-4.18.6-100.el9.aarch64.rpm ee329fa3dec5d9d6fcd0f3b1aa2a67d356cb7a58bbacba7bb846c1c32cc08ec5 ALSA-2023:6685 Copyright 2023 AlmaLinux OS 0 1 Low

tpm2-tss security and enhancement update

The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices Security Fix(es): * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default tpm2-tss-devel-3.2.2-2.el9.aarch64.rpm 4fb52d1b2abe34937ff2607f162461fe361ce4d9c76dc35130421aaea70d041f ALSA-2023:6705 Copyright 2023 AlmaLinux OS 0 1 Low

procps-ng security and bug fix update

The procps-ng packages contain a set of system utilities that provide system information, including ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx. Security Fix(es): * procps: ps buffer overflow (CVE-2023-4016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default procps-ng-devel-3.3.17-13.el9.aarch64.rpm ff818afd0315770b33f1b5f401830cf801e9fb29033e7a78cf1bb8929f41e2ed ALSA-2023:6707 Copyright 2023 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468) * avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502) * avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default avahi-compat-howl-devel-0.8-15.el9.aarch64.rpm 5010794acfa2f5e4608c8a122ec05b798b8321686437dc57c9e1c4c62d89844f avahi-glib-devel-0.8-15.el9.aarch64.rpm 6227ba70382e0675097ede28fd131d4bb85fe0bb63a87728aea3f37a987c2cb1 avahi-devel-0.8-15.el9.aarch64.rpm 97f6498aafbf394d683212921f20e9bc8da9c0fd56cb90cf0d7fab43f44f4dd6 avahi-compat-libdns_sd-0.8-15.el9.aarch64.rpm bf4ad4953bddc1e6e98c2e5002afad5590331ad684cca0e65c4b1548b9dda4f0 avahi-compat-howl-0.8-15.el9.aarch64.rpm c43347ed04b97d802333d24db5ed8d1f46458313f31466926f47753578acd5cf avahi-compat-libdns_sd-devel-0.8-15.el9.aarch64.rpm e2017f0ae9d896569c92a6f4914636522d712ae0f347d152a25893de1e9fa79f ALSA-2023:6712 Copyright 2023 AlmaLinux OS 0 1 Moderate

python-wheel security update

Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427. Security Fix(es): * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli (CVE-2022-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default python3-wheel-wheel-0.36.2-8.el9.noarch.rpm 3d0309b1e2967adc653729a9f88ae803d2b08b950de795181354f1390ee081c9 python3-wheel-0.36.2-8.el9.noarch.rpm 3e81c4451b2cefe7a23125e40c7b73abefee7630a64b19b57cce91adb41850a0 ALSA-2023:6732 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libgs-devel-9.54.0-14.el9_3.aarch64.rpm 4c77c5e22821d00b672f3de315c0eabf57761e0847cd791b4df9216b3459890f ALSA-2023:6738 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-21-openjdk security and bug fix update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 21.0.0 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 21.0.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 20.0.0 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 20.0.1, increases it to 16 MB. (AlmaLinux-14954) * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-14962) * Installing the same java-21-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-21-openjdk-headless package. This prevented the use of the dynamic dump feature, because the checksum in the archive would be different on each system. This release resolves this issue by using the .jsa files generated during the initial build. (AlmaLinux-14946) * The /usr/bin/jfr alternative is now owned by the java-21-openjdk package. (AlmaLinux-14959) * The jcmd tool is now provided by the java-21-openjdk-headless package, rather than java-21-openjdk-devel, to make it more accessible. (AlmaLinux-14948) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default java-21-openjdk-headless-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 1185cbe78031709d2070a1bab907559820464944fc7d367f6a1318e7ef94a640 java-21-openjdk-headless-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 15eefb22bd008713b25fecb2e93aa81c68827bd57435543fc1ed74e20ca977d9 java-21-openjdk-src-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 18f4cc452192da00a42cc8fa9343179633ea140cf4b5b750e78454d4612cfda1 java-21-openjdk-jmods-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 3b20a4292e0357a8c49121b3bc3eea4c9dc092803b8e6f7a90de884baec78229 java-21-openjdk-devel-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 45c27fe1b95880c969a83e10c56eb627bfa78aa2b4734fab034acb1d7f24c5ee java-21-openjdk-jmods-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 628b6e67cef190ab5556f18772e39bd481af538443140e9a5696bc60665e70ee java-21-openjdk-devel-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 62ab5075122108a05c51bd82825d5b412f6280415967e59dca9d90b6a088b909 java-21-openjdk-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 78f526a882eac76b39906d5f4fdd442bc5c3a8fcc01256199c4e23d68bbabc00 java-21-openjdk-src-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 7973f937bdc105774401577736514228964968018ed59b19c69399d83fc16fc8 java-21-openjdk-static-libs-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm 7e849ceb2d5e1db5c94e8f2ab05f3a081f8aa811ab136d92aa7415e446ca0ddb java-21-openjdk-static-libs-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm ab6117014adbd920b0cc128486cb87bf96414aa191d7aca1e8c22e7c88d3c54d java-21-openjdk-demo-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm de35e89d93655f786c546e46dc45e63c6129ffa02d1525834f7387be4eddcb09 java-21-openjdk-demo-fastdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm e009c692cc52cbece6f684e54b57746b3d6bbb418a407497735f0636c967a395 java-21-openjdk-slowdebug-21.0.1.0.12-2.el9.alma.1.aarch64.rpm f64ec1fb6f5882607eb35e50b84dff0c65d7860c36117209d554a9b7fd95ebbf ALSA-2023:6744 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961) * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091) * samba: "rpcecho" development server allows denial of service via sleep() call on AD DC (CVE-2023-42669) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libnetapi-devel-4.18.6-101.el9_3.alma.1.aarch64.rpm 3d965d7af9a0b700d1c849311f713e892210bd0f98e6769b31293f315054c5aa samba-devel-4.18.6-101.el9_3.alma.1.aarch64.rpm 454b8f8da7fcd1c52724ca79bd6e285b5a59d877f29193d06f42e392a38dc982 libsmbclient-devel-4.18.6-101.el9_3.alma.1.aarch64.rpm 50ad62835731b99ed843152713c382edb5777f834dcbd5fa0a6755aed1e65fe3 samba-test-4.18.6-101.el9_3.alma.1.aarch64.rpm 5414b30533e40d8beb1de9a66e115c0ea54f037d177798b926d56be2c187f143 python3-samba-test-4.18.6-101.el9_3.alma.1.aarch64.rpm 8fdd6400308e7561dcaf95a09a941f2f8b6bb4c6ef189a34da817e087489e8d7 samba-pidl-4.18.6-101.el9_3.alma.1.noarch.rpm a354085fbc28e8f451498a06fa2c351712ff1a40a027007331bfc331b30c9272 libwbclient-devel-4.18.6-101.el9_3.alma.1.aarch64.rpm a828ce7f577dbdf80e01079581e16166d579f366cdeb90ac584a207da2dd0fdd python3-samba-devel-4.18.6-101.el9_3.alma.1.aarch64.rpm e386a736886882ce5333c9404b1afad8df69b10bafcdd4e16c57d0819923eee4 samba-test-libs-4.18.6-101.el9_3.alma.1.aarch64.rpm fc4a96ff9abe9a21989386d170fce6814d867b57a9e3a3e14444b207b8ff658c ALSA-2023:6746 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_2_default libnghttp2-devel-1.43.0-5.el9_3.1.aarch64.rpm 80aebb9d9b841025c63ffc171cccb861f20f41543ac92c390230da2241c605fd nghttp2-1.43.0-5.el9_3.1.aarch64.rpm 89c013dafe253eb014003fd423940c45252c09decdfd44579d3f7962eea55838 ALSA-2023:7253 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.100-2.el9_3.aarch64.rpm ae4caf255efa5af9161ab3cb52d756812e46cc63b18417df35b80585910a58f4 ALSA-2023:7255 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.114 and .NET Runtime 7.0.14. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.114-1.el9_3.aarch64.rpm 9d57bab6516987ba5992c38453ece23b23905c3389e1a655fb4e370c28e42ff1 ALSA-2023:7257 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.125 and .NET Runtime 6.0.25. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.125-1.el9_3.aarch64.rpm 5b77320b47dcf12114cf3d206252e0c3850ea009eef72d30af67650b1a09d91a ALSA-2023:7784 Copyright 2023 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868) * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417) * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default postgresql-static-13.13-1.el9_3.aarch64.rpm 059e48d1778d7288c25926cdf0ef51373836d6dd14009895cfe4a4b0c602b20b postgresql-server-devel-13.13-1.el9_3.aarch64.rpm 3962c4ddf6535780e7b3216783ded2cb45c14c401a2fda8c456d21a682c88d89 postgresql-upgrade-devel-13.13-1.el9_3.aarch64.rpm 874eaa47eedbd9a86e9f98cfb185555899e7e0f9bf2e81861ead63750540f1b0 postgresql-docs-13.13-1.el9_3.aarch64.rpm b1e7ee9ad25f733905d7a1d2383f6b80cff32260bd53051fbc10f0a5a8486913 postgresql-private-devel-13.13-1.el9_3.aarch64.rpm ce8127387f200e099b6d1fbd4003641a7f299272a28e682b184554a452ed710f postgresql-test-13.13-1.el9_3.aarch64.rpm fb157efc7db0e36fad0f2ac49bb049bda53fd8c9d48bc2b3d32546f2839e2f45 ALSA-2023:7791 Copyright 2023 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429) * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default gstreamer1-plugins-bad-free-devel-1.22.1-2.el9_3.aarch64.rpm 06187b97d895156c30b4e678035dee5438f5f8957858aa277a609867955fdb19 ALSA-2024:0141 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: Invalid CSRF protection (CVE-2023-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default python3-ipatests-4.10.2-5.el9_3.alma.1.noarch.rpm 68d1ad015ab26a9ad0dbf8959a913b4646f9c03e6148457726c5c1540c1443b8 ALSA-2024:0151 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el9_3.aarch64.rpm e948c247da2c6b2a49cbb8427c4a2316d73707174edfd870c563006f33d62896 ALSA-2024:0152 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.101-1.el9_3.aarch64.rpm 7cbf63da41d326f0c749c3fb26e31b00db4e61b39124a37af20d522207f7d113 ALSA-2024:0156 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.126-1.el9_3.aarch64.rpm 85a981f578273f0c86a71760366158828fb2b9ec0d50d79f65eb26d4419bd9e9 ALSA-2024:0249 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-21-openjdk-src-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 15a96994d90c0cfce4aaf5e1f68aca82262b12e10ae49a7135b550d85d13f177 java-21-openjdk-headless-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 53d5b5dcd5a11048c7b95d6e4b23459fd7fab33e44744865ccab930ff3dc59df java-21-openjdk-jmods-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 6c8451a1309b2f8e9923fe27f61b5d88d62f64fa018ee00ceffeae319da12864 java-21-openjdk-demo-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 6d16e768b943fb47584192eff84c9a8dcb48ce5b29c47f40058e4cef2aa8c2ae java-21-openjdk-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 740a47b7cb28657928847c3f125d559e303c053dfccb7d16bb78aa662a5ee624 java-21-openjdk-src-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 76ea349c268b10251c64735fe74a4cdedbb039616ae520fbe5befc2d6553ecee java-21-openjdk-devel-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 93b339fcf9b3aad0507d5d20ea6d397423647ece2a0ab04570d31f11b5a54aaf java-21-openjdk-headless-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 95f78dd89b5a1823fa90c50c166d0b3604b3924d98fd5afadc91fba49fd1f47e java-21-openjdk-static-libs-fastdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm 99ae549baf599be116e1f56dc35a7792b0a0c705bbc922d3eb63e5e270230009 java-21-openjdk-jmods-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm bddfd9def07b6bc352bab855c4529d7e344799c991da8f3f659c82c85ccc144e java-21-openjdk-demo-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm cb76d844fc82c8b60864de4b548862dc7cef881c11f675953dba64813d029ff0 java-21-openjdk-devel-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm d31e513be01b8d3146cf509e9ef09b5c80eba2269f6ef139c977de272ea1e8b1 java-21-openjdk-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm de07ad2192d0d7c51ef5fc9025afa27a15bf453c6da0775040c0938a8313c5d7 java-21-openjdk-static-libs-slowdebug-21.0.2.0.13-1.el9.alma.1.aarch64.rpm e85d9abad7f652e1dce67364ecedb11798e0d9cfcff00d0cdd40f349263f6434 ALSA-2024:0265 Copyright 2024 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-1.8.0-openjdk-src-slowdebug-1.8.0.402.b06-2.el9.aarch64.rpm 163ce78d7e723886743b3fa7333470c03a187f325e65ad2fa6761512bb78b544 java-1.8.0-openjdk-headless-fastdebug-1.8.0.402.b06-2.el9.aarch64.rpm 2509c8a3f7491f32a30e630616922b69cffb3ba01def97eb5da721189bf786ce java-1.8.0-openjdk-devel-fastdebug-1.8.0.402.b06-2.el9.aarch64.rpm 60d1d56c1272401d7fd5d2b9599f7dcd4284b596952a25bb9b73c8aadd77dc7e java-1.8.0-openjdk-demo-slowdebug-1.8.0.402.b06-2.el9.aarch64.rpm 626bc60599f4a1417c2d007e6a2301f3daf9f658b24cfbae070ebf80f0d3bb81 java-1.8.0-openjdk-src-fastdebug-1.8.0.402.b06-2.el9.aarch64.rpm 89a93516fc73ad960b1e49fb947800ac05c2ca95cca668440280bd8313b726a9 java-1.8.0-openjdk-fastdebug-1.8.0.402.b06-2.el9.aarch64.rpm 9508908516dbeea215e951acdedc36da8dd79701ec903729d2aa29fa964731dc java-1.8.0-openjdk-headless-slowdebug-1.8.0.402.b06-2.el9.aarch64.rpm b3b50c742dd210b69e54b2024143b92d0fc33636c283db11139bc172c0f3bd8b java-1.8.0-openjdk-slowdebug-1.8.0.402.b06-2.el9.aarch64.rpm b908a6b69a9e601a2853639cbf6dc9dd3049d448f6e9ef83e0d3f2d919e68580 java-1.8.0-openjdk-devel-slowdebug-1.8.0.402.b06-2.el9.aarch64.rpm c57bda391cc33cb8df42b540ea47850d61a5de152e33773aeb0bd04b68751ded java-1.8.0-openjdk-demo-fastdebug-1.8.0.402.b06-2.el9.aarch64.rpm feddcfac4d92c476079052c43ba7c7f9c2402832136a10885e438665a912bce2 ALSA-2024:0266 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-11-openjdk-static-libs-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm 06e6c93f20ea8e0715055173608aa7a51d9fca72dcd64823057009cbe9ed3141 java-11-openjdk-headless-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm 2528dd8e7b027fcc2181534e63bd45694b57ab85e25d9715f432f6b3e5bb7649 java-11-openjdk-demo-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm 2df512313f8e15ee5d707ca4c79e2ade5f775eace49493307e940b0cb9331182 java-11-openjdk-jmods-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm 5d7b5797843beb127556e0ebf5338f77c098c307d13af2eda1ec326cf3a02a41 java-11-openjdk-devel-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm 627b0b1c8a6737ea8b1ee650dc6a80354400aabe2f71cb31474f6213d40662cb java-11-openjdk-jmods-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm 768a6ae232b1a48e4a62dd6135f7bba88327c9735a72d2f4e37c1d8687b987ed java-11-openjdk-src-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm 7e9f3fe9dc15079356ea0a83d8626103cdb6cd1f65f2e9cf75034458ceabe465 java-11-openjdk-devel-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm a54c64074fcdc337541fe51d4c3be7a3fc7e5d567638a0d15e55bf7b1a285b10 java-11-openjdk-headless-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm ad3089fd3814efe9e5f1c36e50bbbfb085074c7df331266325e3008406c68bef java-11-openjdk-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm aeb8dccaf633b6df0edecbc2671954f90d9342ebf4bcf7f8295299fd9337a8fb java-11-openjdk-static-libs-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm ba2ee0c9560694b3439ae9bbe9b3e8ca09e9bdd6aa4c413f7e7b00e45b2ada26 java-11-openjdk-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm cbc3c1cf0a780041af07af54737a0452093c3c13be48e07868dbd97e80c57e31 java-11-openjdk-src-fastdebug-11.0.22.0.7-2.el9.aarch64.rpm ce313894211adcb7b7b36ca10078fd19beeb6b4ffb86b33b1d44b807742848f6 java-11-openjdk-demo-slowdebug-11.0.22.0.7-2.el9.aarch64.rpm f14ae60f979c6b09082c11471215ebbb051bbb6e91412c62e6d14e7951713e5a ALSA-2024:0267 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123) (CVE-2024-20932) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-13930, AlmaLinux-13931, AlmaLinux-13934, AlmaLinux-13935) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-17-openjdk-demo-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm 3f6c8a402b428e9f65f290672d48b0b9797ea048dc5069308806de9c39d1e90f java-17-openjdk-jmods-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm 450acdac27aacaffc8dcbc4fddc562e6dd6aec135a682c243fb4bad15a08ce38 java-17-openjdk-devel-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm 528ca896dfc9e2e9dd0d7556db8e84521b38148ff2e348857583d8e68064d9e9 java-17-openjdk-headless-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm 590a3cef5dcc2d49ed36ec89b50ac90426e9e2a8d9fe643859c87bc5dd4278eb java-17-openjdk-src-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm 5d6473f94a478b020b03dfe076b1c8e7916bb368322759d1eb1de98c92515479 java-17-openjdk-headless-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm a2caeb6fdd8a4c694f5912f7115920bd50abe6fc3ea9a0ccb7fa87df28d2a18c java-17-openjdk-static-libs-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm a319985bf4d34f8deba73642db91f67e32fe7c3dcfb4774ced6c1a27c06ebc2c java-17-openjdk-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm a3a2f4adae6026c1f4c3eb739428c783efb4c6b051782b1eb249baf6fcca69b4 java-17-openjdk-src-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm b8139fede28c6019ad7c55f4b02f00b7cd47ea83e6cdac219d055e62ab2ddada java-17-openjdk-jmods-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm d37c324cf2d8423fcdab2db60e76d8aacc1906f1dfd5c3d40761911d44e972b8 java-17-openjdk-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm e1351204700e6801f13dc2df1355519720c5278b1efe7db73cd50ec7a5079b72 java-17-openjdk-devel-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm e39c49a3a3be928422f11c75d5009ac52eb8f4436cea0569625ff8402e55eda2 java-17-openjdk-demo-slowdebug-17.0.10.0.7-2.el9.aarch64.rpm efe631f1e88b60b83ec8989494bb1dbe98799cf09f3a56e342be31d26a288f7b java-17-openjdk-static-libs-fastdebug-17.0.10.0.7-2.el9.aarch64.rpm f3b3f7084749e0c1844e4b0fe0099726b35647c0cd623d505ecf09a2610bd362 ALSA-2024:0466 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default python3-test-3.9.18-1.el9_3.1.aarch64.rpm 0bd371a9d9d4e7c972f282b2bd82f7d2381103c4c18a24c350711b762416c4e8 python3-debug-3.9.18-1.el9_3.1.aarch64.rpm 16201701cf9754dee56e154edb3f1b0b46e625f3910fbbe51b95ae1bb5fd956e python3-idle-3.9.18-1.el9_3.1.aarch64.rpm c87ea364d06746258677bd2ca22dde1e0fac06cabb9408ee3d514b4d2a5a849a ALSA-2024:0805 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.116 and .NET Runtime 7.0.16. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.116-1.el9_3.aarch64.rpm d557882b392bb7bf1da312aa89b6547ef58186188f6ac931ba3c51a2467196a9 ALSA-2024:0807 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.127-1.el9_3.aarch64.rpm 9acebcdcb6d3e9a2b4e4f1bfab04b33f20e58407a53f64ed8721ac87ec2e5ec8 ALSA-2024:0848 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.102 and .NET Runtime 8.0.2. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.102-2.el9_3.aarch64.rpm 94b283a5e22f752e2f4f042da97c096ad527e3fd283c0e4671093e6718f27dc2 ALSA-2024:0951 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default postgresql-private-devel-13.14-1.el9_3.aarch64.rpm 1d56d3fd0df967c321db96cc16e86548d18c03817347e1d3497d1994de13e1d9 postgresql-upgrade-devel-13.14-1.el9_3.aarch64.rpm 4f0195c66cca0f9ad00e93d39b06916b0896e40281d01298ffda5891fb3421ac postgresql-test-13.14-1.el9_3.aarch64.rpm 5398cc79d101a8503f65dc6e269d95d251749196642aa92aa469b4bc0b0ba3a7 postgresql-server-devel-13.14-1.el9_3.aarch64.rpm b9a13e0003cc4fa7034f9d619b4ef39b17ca90a0f246f8d9661b7292e8dff18a postgresql-docs-13.14-1.el9_3.aarch64.rpm bea362e6b29beb78ffa802e6b2eb72aaa85440d5131da808aa38d6763aeb0822 postgresql-static-13.14-1.el9_3.aarch64.rpm ed22c967c6294dcb1beebe68f9d8cffd612cbacace479b5f990fc9292437b0c3 ALSA-2024:0977 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.1.aarch64.rpm 93af7ac764127ea9813f25768399594c936e68b667c6b12182d389d93987e5c6 ALSA-2024:10274 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009) * kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244) * kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CVE-2024-50226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.15.1.el9_5.aarch64.rpm aa92963b2e8cf9a71e1767272d7cac6ce77ca02411837d1b4c14067921a0c4d2 kernel-tools-libs-devel-5.14.0-503.15.1.el9_5.aarch64.rpm d6e964296420d57f379be294ede1791a0f818d648e76839726655695fadf8dfc libperf-5.14.0-503.15.1.el9_5.aarch64.rpm ea20baf7f8da97b922005835e4590ee4784a0bbf9566f5121768cb40ea14d18f ALSA-2024:1075 Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230) * edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default edk2-ovmf-20230524-4.el9_3.2.alma.noarch.rpm 672357e5f22af5021147da1e6ea2940970361d3219b3256dc24010fdaeeb1424 edk2-tools-20230524-4.el9_3.2.alma.aarch64.rpm 85da1cfd3ac68b41837db5960f6385ef673332aabf8d8ea21f448998b78d1f09 edk2-tools-doc-20230524-4.el9_3.2.alma.noarch.rpm bfcb0f5d6e03f7d8b84272a53664e90bac1a421417262c4e9b2f8eefe207350d edk2-aarch64-20230524-4.el9_3.2.alma.noarch.rpm c344e31df64e7b01343cb0aed155d8145237772f7f844a227dd8eda235c3368c ALSA-2024:10791 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default postgresql-test-13.18-1.el9_5.aarch64.rpm 09feba60fc3b06c9916bf08c0ab27489a398e5bc2aa8218577908358b0bd6dc7 postgresql-server-devel-13.18-1.el9_5.aarch64.rpm 18a89cb000c97f59b199e59413854fb8a563ce7042a691b833618b9e63eab4d5 postgresql-private-devel-13.18-1.el9_5.aarch64.rpm 341a95e4dd23b615e6f65f9695c22f79cd769750630ad6f90ca7f815769cb26b postgresql-static-13.18-1.el9_5.aarch64.rpm 58e9eaa3de9cad83742f55e2cd5226816b74df5ee40e753570bbb3edb4471be1 postgresql-docs-13.18-1.el9_5.aarch64.rpm 69f8f8b417c7c08643314ef9a2b4ec3594e9e567159eb08e16c7ebdd603739f0 postgresql-test-rpm-macros-13.18-1.el9_5.noarch.rpm 8e7546673e90d6d2cf20b6956f17bd1e184001032394a5fb82dfcd5ef8e622ee postgresql-upgrade-devel-13.18-1.el9_5.aarch64.rpm dd616b8d09384809183d04679c04c9c52c3f9b6e9f80b8546596850dfd87e187 ALSA-2024:10858 Copyright 2024 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default ruby-doc-3.0.7-163.el9_5.noarch.rpm 7485aeb0e6755d661e1ec91aaf7d312c6b374400a15cfc3836f7fa8b35c81c0e ALSA-2024:10939 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: iommu: Restore lost return in iommu_report_device_fault() (CVE-2024-44994) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) * kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695) * kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CVE-2024-49949) * kernel: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CVE-2024-50251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default libperf-5.14.0-503.16.1.el9_5.aarch64.rpm 02021be776ebf0d4bae4fc70d5d17e91d4def85d423871383a78277ace875541 kernel-tools-libs-devel-5.14.0-503.16.1.el9_5.aarch64.rpm 07c7465f04a0b7e318e554f21fac7d86a236b6e1a2a0308dea0a643026e6c2a1 kernel-cross-headers-5.14.0-503.16.1.el9_5.aarch64.rpm f9cdaa73299849f635b2f0a85685f9e830d1599214ca1e6b9fa94363be0f0800 ALSA-2024:10978 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3.12-test-3.12.5-2.el9_5.2.aarch64.rpm 136c54c0a3955d9cda7d3315d1fbf1ee45e6cc64a9b99682e10908e743f5c5dd python3.12-idle-3.12.5-2.el9_5.2.aarch64.rpm 9455ad62bad98398ff26546ca23d5159d3bb76374699fb085de09f2afa4cbe63 python3.12-debug-3.12.5-2.el9_5.2.aarch64.rpm ea7a5b9e6e35a8ebf26483b662b896dd14429a435d7ac6b533d13d1bfd13a4a1 ALSA-2024:10983 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9:3.9.21 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3-idle-3.9.21-1.el9_5.aarch64.rpm 7f38086eed8a6bbade4bc28accf0d3c4c56727940eabd71984e3ae01f912afb7 python3-debug-3.9.21-1.el9_5.aarch64.rpm ecf7142411cf507f468c8695f073427a56a03719d48a2fc3b1f58ef7903bb4ae python3-test-3.9.21-1.el9_5.aarch64.rpm feb2e17333c7a2f8eed2bf2db5553b48b75de9d593a203708f3ff37ec44a46bb ALSA-2024:11111 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3.11-idle-3.11.9-7.el9_5.2.aarch64.rpm 09226c555f52b23f88d3901db83d21c39c3281bcfa0516133ac5151ff83e3747 python3.11-debug-3.11.9-7.el9_5.2.aarch64.rpm 6bd2792597619ef072f4b6bddab6696d12b7d12ef3abbbe528628f1457e35bb5 python3.11-test-3.11.9-7.el9_5.2.aarch64.rpm 8638180f43d9523d7f531e427ed7e4f17abc5a3bfa2b699c81cf34ad9ccd3db5 ALSA-2024:11219 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2:20240524 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default edk2-tools-doc-20240524-6.el9_5.3.noarch.rpm 2b923e24eec0bc923208f279be2fa0de8f842b72a1682114e63d9f2e4b3d8654 edk2-tools-20240524-6.el9_5.3.aarch64.rpm 39b369bb00e1e00b0b6d0c616af76b76f669ea235fca1756b51ecbd63bd4e8f1 edk2-ovmf-20240524-6.el9_5.3.noarch.rpm 78c94982627bd8d6000410fa5f470a76850f56d9d10d3b989fdf8cc767e6221e edk2-aarch64-20240524-6.el9_5.3.noarch.rpm b4113deecdfdfe37d6e0009c5471b1d36782fb5ed693b1ca0c64dfd4f940de66 ALSA-2024:11232 Copyright 2024 AlmaLinux OS 0 1 Moderate

unbound:1.16.2 security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default unbound-devel-1.16.2-8.el9_5.1.aarch64.rpm 89b4db0c098230488e3ee976921cd1f45645a1904ab64d04d6324cb40c5e8b9c ALSA-2024:11237 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile:1.0.31 security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default libsndfile-devel-1.0.31-8.el9_5.2.aarch64.rpm 7cd443e05372ccf08e5d51dc52603c64f36c1b68bc656471ea62ef5d61336be4 ALSA-2024:11242 Copyright 2024 AlmaLinux OS 0 1 Moderate

mpg123:1.32.9 security update

The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries. Security Fix(es): * mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default mpg123-devel-1.32.9-1.el9_5.aarch64.rpm 1d00811a6c89529967381c5a4e1c261f51bb0f3fb59605d6f29d085e68a8c61b ALSA-2024:1141 Copyright 2024 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911) * mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982) * mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21955) * mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966) * mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972) * mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980) * mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033) * mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046) * mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053, CVE-2023-22054, CVE-2023-22056) * mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058) * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114) * mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111) * mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115) * mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-2097, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964) * mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967) * mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981) * mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983) * mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984) * mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985) * zstd: mysql: buffer overrun in util.c (CVE-2022-4899) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038) * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113) Bug Fix(es): * Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22454) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default mysql-devel-8.0.36-1.el9_3.aarch64.rpm 2b6911fb740fb23a0eaad63e5952b39dee0a278b5f8eeafff5083b2a30fb5c90 mysql-test-8.0.36-1.el9_3.aarch64.rpm b4bf63dbb0c1e4112fabd9341bca4d4d403630b2033d823af90b068314770356 mysql-libs-8.0.36-1.el9_3.aarch64.rpm bbbdca618b5c58e25626a29213032a9d2edb8fab2cb4f683740dd306ae3b967b ALSA-2024:11486 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: bpf: Fix a kernel verifier crash in stacksafe() (CVE-2024-45020) * kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out (CVE-2024-46697) * kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CVE-2024-47675) * kernel: bpf: Fix a sdiv overflow issue (CVE-2024-49888) * kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099) * kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110) * kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125) * kernel: Bluetooth: ISO: Fix UAF on iso_sock_timeout (CVE-2024-50124) * kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (CVE-2024-50115) * kernel: xfrm: validate new SA&#39;s prefixlen using SA family when sel.family is unset (CVE-2024-50142) * kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister (CVE-2024-50148) * kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192) * kernel: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CVE-2024-50255) * kernel: sched/numa: Fix the potential null pointer dereference in task_numa_work() (CVE-2024-50223) * kernel: bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.19.1.el9_5.aarch64.rpm 58f14c74e19df20aa134052bb51a3ce2e04563f8a85f62c4dd50b4e6d8e21875 libperf-5.14.0-503.19.1.el9_5.aarch64.rpm 82a63a61638e5a08908f7338fc697fb77de931108d76d1485bafbe6795fa919c kernel-tools-libs-devel-5.14.0-503.19.1.el9_5.aarch64.rpm d0f7ad1a46489a91b862d8bf2dea780764be83ffbf5811dde476e6fd7251ce67 ALSA-2024:1239 Copyright 2024 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default opencryptoki-devel-3.21.0-9.el9_3.alma.1.aarch64.rpm e71e10315b487cf3e65456e0df60801f618d8f48fbfd9e9328fe3ee92ca62326 ALSA-2024:1309 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.117 and .NET Runtime 7.0.17. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.117-1.el9_3.aarch64.rpm 126dc5d58c147c341da527879290beb60fea28b4235ad2ccdbc82c5fda5d4ab4 ALSA-2024:1310 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.103 and .NET Runtime 8.0.3. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.103-2.el9_3.aarch64.rpm e8eb10f6d79242a23cac9d40d27afa06685565987750cfc770f3158dbf3575b0 ALSA-2024:1691 Copyright 2024 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default varnish-devel-6.6.2-4.el9_3.1.aarch64.rpm f79763be630d36dd3608ff6c6bf78a73594757de44df12a47bfec16aa7b3a9f4 ALSA-2024:1750 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. The default combination of the "control-use-cert: no" option with either explicit or implicit use of an IP address in the "control-interface" option could allow improper access. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged local process to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. To mitigate the vulnerability, a new file "/etc/unbound/conf.d/remote-control.conf" has been added and included in the main unbound configuration file, "unbound.conf". The file contains two directives that should limit access to unbound.conf: control-interface: "/run/unbound/control" control-use-cert: "yes" For details about these directives, run "man unbound.conf". Updating to the version of unbound provided by this advisory should, in most cases, address the vulnerability. To verify that your configuration is not vulnerable, use the "unbound-control status | grep control" command. If the output contains "control(ssl)" or "control(namedpipe)", your configuration is not vulnerable. If the command output returns only "control", the configuration is vulnerable because it does not enforce access only to the unbound group members. To fix your configuration, add the line "include: /etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf". If you use a custom "/etc/unbound/conf.d/remote-control.conf" file, add the new directives to this file. (CVE-2024-1488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.5.aarch64.rpm ae6fde936ce92199744d8bbdeda76101437f6f21cafbb91857fcc46bb85102ce ALSA-2024:1789 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default bind-devel-9.16.23-14.el9_3.4.aarch64.rpm 197ea72a2bc7d2805b56066752b8e3ee257003de1b11b03471cffc70a1141eb3 bind-doc-9.16.23-14.el9_3.4.noarch.rpm 22ea42050319c6952320fdfdb1eb6f005290375161f8b1ae7f8089901182832f ALSA-2024:1818 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-1.8.0-openjdk-slowdebug-1.8.0.412.b08-2.el9.aarch64.rpm 27d89071e805d19c2e53fb9a14431e19206a121348678b4187bf73456bc48b88 java-1.8.0-openjdk-src-fastdebug-1.8.0.412.b08-2.el9.aarch64.rpm 5eb3245b16f74ce2348080e4156432d1a798affffb68f7fc8f01f085793a7516 java-1.8.0-openjdk-headless-slowdebug-1.8.0.412.b08-2.el9.aarch64.rpm 6a5099da5e54b8956253654ce0059c00ebeb416094227d471b29e27ebc93be3e java-1.8.0-openjdk-devel-fastdebug-1.8.0.412.b08-2.el9.aarch64.rpm 6c7ebf277f4748e7fabe4ebfef07fae4247028d2fa2feeb49824d628c59d343f java-1.8.0-openjdk-devel-slowdebug-1.8.0.412.b08-2.el9.aarch64.rpm 7f559637f8b8a6c1bf708e4f3006115a9d9169e22e895e3eccab66c665134245 java-1.8.0-openjdk-fastdebug-1.8.0.412.b08-2.el9.aarch64.rpm 819bd462142ba5e911f6e8c4cb02fab5aeb52a927331105aeb3ca2685f4e69bb java-1.8.0-openjdk-src-slowdebug-1.8.0.412.b08-2.el9.aarch64.rpm d85ba838911176168616d56d15a55dbf5546cfd59e2a7057c12526d12d3843a6 java-1.8.0-openjdk-demo-fastdebug-1.8.0.412.b08-2.el9.aarch64.rpm e74e5a844a551a84f78c175c757a342add68dfc0dc7a87d275f05073da11f626 java-1.8.0-openjdk-headless-fastdebug-1.8.0.412.b08-2.el9.aarch64.rpm edbe89c88ec9dbabff1a4ff0a74fbb343196ec17afd1b1b91ec67de10e3a4e2c java-1.8.0-openjdk-demo-slowdebug-1.8.0.412.b08-2.el9.aarch64.rpm f38c759df06c3d4021e64fea22fb1437252acd23200cd1d2b92a57e97d9deb1c ALSA-2024:1822 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-11-openjdk-headless-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 04f14571d21d4cf578126a2de185cc94f8d0821d159046788dd362154417b2b5 java-11-openjdk-headless-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm 08b0058508dc427d28ea9b54c1b4ac2d857c69aa896298edad38be87e2352cba java-11-openjdk-devel-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 0d58dd2ebd2d6f7f72a07e8382d1687ab591b1886cef90d342b9dad13874d7e6 java-11-openjdk-src-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 152262d05ef1c7ff3f3b8da1fb9b19eec83a0455e35a7e211c7f5db4df352471 java-11-openjdk-jmods-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 43e0167cd4d112fcec1fa72677d71d386d3b4be567b9e26917547e45c7be38db java-11-openjdk-static-libs-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 73cb62fb4184de17af195ca5e44f1a90289d86abca454e2596661f4e7ab7e381 java-11-openjdk-jmods-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm 7444c60db86283cd6c2a1f8d5013d1999edf9672ec184d4667de6ee2a9d64ee2 java-11-openjdk-src-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm 7ae18c8156a50d4d569206c0e8d729a2269a48cb5561a13fbdf6fa46c7790ad8 java-11-openjdk-static-libs-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm 7bcfc9c4805857d32a2f63b4aa671076450a5b5f4f8586cc5cf16f11cef60afe java-11-openjdk-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 97b6263f22a4518d8b29ad6420d6e9c6ca7778852107c4151103eb1e79156bd1 java-11-openjdk-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm 9ab7fc009acbf53e10ff053b3ec9e9e4b7d0fc3c2c6b33a7a9d2de1b4e73c4b9 java-11-openjdk-demo-fastdebug-11.0.23.0.9-3.el9.aarch64.rpm 9e9fa4fb33a84c2e7a83f494dccf93dce589bba37ef3440f1d84d0485bbacb24 java-11-openjdk-devel-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm bf858f4447b650717722994083f0be043b48b315f8396fd8b08e3997a27b49cc java-11-openjdk-demo-slowdebug-11.0.23.0.9-3.el9.aarch64.rpm da7dcb904f8cd2dc4bcc28e6d784a37832409b3b82981c0ca5e997fff339eff9 ALSA-2024:1825 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-17-openjdk-demo-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 0d6877b4e0ef331cbe975fec4d8baed71e871f44ebeafb9f68f9fa05a4997221 java-17-openjdk-devel-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 1e7935f2c64cf3cf72eba83a0fda95ebdcf1f3743d84121d56287ff4773dd419 java-17-openjdk-jmods-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 31bd6b7a671ac516b4a8be1b1784a123a7e8d9bde2dc391019bef2f9931bc8ba java-17-openjdk-headless-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 55873640752e29f5538fd52dc4d27410695806ca65ab5e4e6cdbee5ef0a2fae6 java-17-openjdk-devel-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm 57b69718e0dc38cb44490445172d1d29d7a088f7d0f2c3aa253c9a545901db1f java-17-openjdk-src-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 737feccd7d5d7de8e8b7124656104a330200d0817b734f3cea669999bf714ec7 java-17-openjdk-static-libs-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm 97a29e2a69cceecd5c3b0992af68d2e4f8854a66ddd07e91cd678aa1deba6d07 java-17-openjdk-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 98eab3d424edc42cc791674aaebb29ea5fe167728b1bda39f4ae16e8b97dc5ad java-17-openjdk-static-libs-slowdebug-17.0.11.0.9-2.el9.aarch64.rpm 9a9460d9264d0a102c93e7bbaebf109b9fee621b0d4a07d0d1b931a754c7dfe0 java-17-openjdk-jmods-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm a08bb26f2822e0c547f8ff427be8e643793e8a3d3d8c31f0a9dc9d9f74c78551 java-17-openjdk-demo-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm a12ebfc737054a274b692cccc69ccb46771676f0dd466e12788eb4526b680f08 java-17-openjdk-src-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm a66d69c5ab7c33c387be9c3f6f9b9a16a1b416fd9ab3a16bc87faf97dfbb21ce java-17-openjdk-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm ec8b7a4b425d24909c70306042ebc2a8cc6ae955867a952c9bcd480472b11b62 java-17-openjdk-headless-fastdebug-17.0.11.0.9-2.el9.aarch64.rpm f9ce56a838f9156b1320bed6bf9d86853c4403407b85b3996b84d41442385311 ALSA-2024:1828 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_3_default java-21-openjdk-headless-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 1d330d65c6749db63dca687506e1489cc3a41e1b8f755009da4baba1158f2dc2 java-21-openjdk-devel-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 48c708c5da63e83d48d002de068a6bf179b4addb4b3cab2ea08ed3b2eb3f2271 java-21-openjdk-headless-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 53a60771c8b5a4e413ec7265680881f1f6ebec335a77cfc8dc7a9032b1c725cd java-21-openjdk-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 6cacdefcbfd262b6655514d445a3f01fc05bb14a97b8c98bcf869ff760244194 java-21-openjdk-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 78a9ee78f21385f139262a9cae9811d93a64d3faf9a63e915f3c8a44337a2705 java-21-openjdk-jmods-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 88bffd6dbfbd35e0ba028d4ba8e7e1ef9090be29314a008928fe2387373db4a0 java-21-openjdk-devel-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm 9df4a04d3ab0416e406e3fb2c5294772644110646dd877a1ef32e348ee170907 java-21-openjdk-static-libs-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm c1481d7cae0cd0902c817a024de5727fb8e097c487fd987916c152f3c6924eba java-21-openjdk-jmods-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm d7e1aa3eaa31800c37f9403f0ea0f45ec2866caaab90faa01aacd36570b53607 java-21-openjdk-src-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm e35e6e79188e0a413ba6bd9e0e5c3e98f244d0f0b22bba9404b80d38c5556ae4 java-21-openjdk-demo-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm e46e375a9c92b0fa63fdd04589a8c6458686752d4e8c6cef5dbd3d024c553a21 java-21-openjdk-demo-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm ee311fabc9e6ee3218aaa281eb8a9da67d9a6c5a63f8fbc90baa9d47f37e5261 java-21-openjdk-static-libs-slowdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm f638ff6160db4581e56c1fdb9839eff71e98c6e8bf61500d8ff67e6d9db00175 java-21-openjdk-src-fastdebug-21.0.3.0.9-1.el9.alma.1.aarch64.rpm fe58594ec075bac1df088792d38a5fb6086259f45f8cdb169ee0cc81901573d4 ALSA-2024:2147 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-ipatests-4.11.0-9.el9_4.noarch.rpm d851142c22ff4c5d9ddf230430e8aced17c7f7736aaced76c0e7c45c4580cf6b ALSA-2024:2169 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377) * xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (CVE-2023-6478) * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816) * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVE-2024-0229) * xorg-x11-server: SELinux unlabeled GLX PBuffer (CVE-2024-0408) * xorg-x11-server: SELinux context corruption (CVE-2024-0409) * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885) * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886) * xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-24.el9.noarch.rpm 312de6141de8edf176752f753a27b2608f335b89d5c094f576bbb86755bd521f xorg-x11-server-devel-1.20.11-24.el9.aarch64.rpm a29069d1dc5ee5365ffc1d42fb9a960ff6d1f6a412c93bce4dc84799c4d12c7f ALSA-2024:2184 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in src/mat4.c and src/au.c leads to DoS (CVE-2022-33065) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libsndfile-devel-1.0.31-8.el9.aarch64.rpm b1710e80ef70fe6340f822d769bf49b3735ec859ceef8117fbe3f5ee16693dca ALSA-2024:2199 Copyright 2024 AlmaLinux OS 0 1 Important

pmix security update

The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fix(es): * pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default pmix-pmi-devel-3.2.3-5.el9.aarch64.rpm d9da7634c37267e5773733d8e4f16aed23bd0b6bd75b6581b50ea66da6e94284 ALSA-2024:2204 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871) * libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default ocaml-libnbd-devel-1.18.1-3.el9.aarch64.rpm 185a1588b1fcc996d92225f8fbb0e495bdd2b9dfaa99104c29d938df9a1e7248 ocaml-libnbd-1.18.1-3.el9.aarch64.rpm 5b705511af39b9f710e93eebb1fa31d4c47f116c48559293cd831af04982eb6c libnbd-devel-1.18.1-3.el9.aarch64.rpm 9f303277fdd2334ee7c73e14b20d990e62d2819463eb26e907b2e23cdd984f8c ALSA-2024:2208 Copyright 2024 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350) * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351) * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352) * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356) * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186) * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567) * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations (CVE-2023-40569) * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589) * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353) * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354) * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181) * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default freerdp-devel-2.11.2-1.el9.aarch64.rpm c80e2a5bfcf37068b1485a313c7799779bf0a4e01bfd0deaf9f429c44311d758 libwinpr-devel-2.11.2-1.el9.aarch64.rpm d07b45debd13f257ec7a99995bf29936114605cceaf1130c3a7155e066d546d8 ALSA-2024:2236 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: NULL pointer dereference in udevConnectListAllInterfaces() (CVE-2024-2496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.el9_4.alma.1.aarch64.rpm 9117bb288584174e26df237fee13c4bd4dd6c50ce89bfdf0156817e7ee95f931 libvirt-daemon-plugin-sanlock-10.0.0-6.el9_4.alma.1.aarch64.rpm f1bcde2960f1815c0642235d60c25a5d348d60662c38552834cc3fa2b67b0b70 libvirt-docs-10.0.0-6.el9_4.alma.1.aarch64.rpm f9fa6b1a4ead085171afc53e67d2b542d6d838a40e85a2c0c6c32f07e59a6e9a ALSA-2024:2264 Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default edk2-ovmf-20231122-6.el9.noarch.rpm c344271226d0016eca110ad5673ec0a7851704d8b9007a02e5cef91ddccbea0d edk2-tools-20231122-6.el9.aarch64.rpm f96de4de9f85a61df9a83dbf5500becf6c11057d56ef4459baa709c7d42871f4 edk2-tools-doc-20231122-6.el9.noarch.rpm fea2aecfc1c20965950c39c0c2bf9fc32aecfd41f5c952d8f00fa41a0fe43687 ALSA-2024:2276 Copyright 2024 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: incorrect integer overflow check (CVE-2023-51714) * qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-9.el9.aarch64.rpm 00f95069db70db375031b61f53402f567b7b219464fe541e80016d6266ce12c6 ALSA-2024:2287 Copyright 2024 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video (CVE-2023-40474) * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (CVE-2023-40475) * gstreamer-plugins-bad: Integer overflow in H.265 video parser leading to stack overwrite (CVE-2023-40476) * gstreamer-plugins-bad-free: buffer overflow vulnerability (CVE-2023-50186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default gstreamer1-plugins-bad-free-devel-1.22.1-4.el9.aarch64.rpm 3a6f45baffdc4631125e5128aae6c4a096dfe2ba0a46f4b43d258c7ddc09a4d8 ALSA-2024:2289 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090) * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618) * libtiff: integer overflow in tiffcp.c (CVE-2023-40745) * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175) * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9.aarch64.rpm ea2e9ca05c42e22560ac12a7caa9259f421a418574d4e9c6ccae54b194434252 ALSA-2024:2292 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9.aarch64.rpm 25c737cce851e1b403a918eadf36c1fac8450095e5855481f98ac49128b71374 python3.11-idle-3.11.7-1.el9.aarch64.rpm 3ac7fe715baf097dd6eb2bbd2fae5a8f3c4d3aa3b5951b4c3cf38a6ca1fdf25a python3.11-test-3.11.7-1.el9.aarch64.rpm e82f4afccb8e95685dc326b90394a797f988e6963df7d86748d2b60e27c6c1a1 ALSA-2024:2295 Copyright 2024 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default turbojpeg-2.0.90-7.el9.aarch64.rpm 4932044c9ac744b6941a67cb4d11504cbbbc627c3baaee3ff319ee2569b2c03a turbojpeg-devel-2.0.90-7.el9.aarch64.rpm 81c1b3e5c41df3615eb531c239aa71e544e92df6cf164bef7c25719cb5c70bcf ALSA-2024:2353 Copyright 2024 AlmaLinux OS 0 1 Moderate

mingw components security update

MinGW (Minimalist GNU for Windows) is a free and open source software development environment to create Microsoft Windows applications. Security Fix(es): * binutils: Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfd_getl64 (CVE-2023-1579) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default mingw32-binutils-2.41-3.el9.aarch64.rpm ad0e1d17e7d97d6a07b7286f578514fb07198d09caaa9dc0455a74f8ecd101d6 mingw64-binutils-2.41-3.el9.aarch64.rpm cea57b1eee94df051836465ffa19a94b00ffd084f3f2c286523b49f0ea888534 mingw-binutils-generic-2.41-3.el9.aarch64.rpm cfa530ac240af3b8885146728e1eab674e860e80147304ed8d27d8590ccf041e ALSA-2024:2377 Copyright 2024 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default zziplib-devel-0.13.71-11.el9_4.aarch64.rpm cb096c11a45f4f18bab53030d293f52223d11fbb7547dba3add74882fb68b32e ALSA-2024:2394 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546) * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582) * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480) * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448) * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934) * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040) * kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531) * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931) * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023) * kernel: irdma: Improper access control (CVE-2023-25775) * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464) * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866) * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083) * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194) * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756) * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863) * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434) * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489) * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522) * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581) * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578) * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580) * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610) * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565) * kernel: tls: race between async notify and socket close (CVE-2024-26583) * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584) * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585) * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586) * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593) * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602) * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609) * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176) * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476) * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620) * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.13.1.el9_4.aarch64.rpm 8478ca3e77a9d017dc5b920a246d4339ca5a74094567ebe816a892d627513d8e libperf-5.14.0-427.13.1.el9_4.aarch64.rpm 8c0e96ae494b6f01a544c979c7e553a8e24e5dda6ab28cfd16770f44fc8deaeb kernel-cross-headers-5.14.0-427.13.1.el9_4.aarch64.rpm ac800b399722d8dd0446a606b7e52f442594a079d48a2daf08301907232c520c ALSA-2024:2433 Copyright 2024 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469) * avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470) * avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471) * avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472) * avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default avahi-compat-howl-devel-0.8-20.el9.aarch64.rpm 4ccb8d8923c4905318b6f30dcf4f82dc252ad8fc7a16fdeb3894f1929a56a5b0 avahi-compat-libdns_sd-devel-0.8-20.el9.aarch64.rpm 79501f390928c1c0365688e7bbb559d3318f0d6a6b290cd9975a79e8a06418dd avahi-devel-0.8-20.el9.aarch64.rpm 89389c5f0feb95ee5867724e114848f098354cf5a57a02a6ba243211879f83a3 avahi-compat-howl-0.8-20.el9.aarch64.rpm 9697f006e8961a67cd5fb76c4977d359ebfab74b8b66bbe5e1e81f947473fba9 avahi-compat-libdns_sd-0.8-20.el9.aarch64.rpm b7969cb8ec10fef1cf4917ef9d5c1b05ed82e3fcb0531d5a0943cf73e5725445 avahi-glib-devel-0.8-20.el9.aarch64.rpm d737a1d82fbe0bbbed75c8411f8504a695e629a49c09a5d70719a00bd82c3397 ALSA-2024:2463 Copyright 2024 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes (CVE-2023-7008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default systemd-boot-unsigned-252-32.el9_4.alma.1.aarch64.rpm a87d3265835259e61c323584a4d3a6844dafa759477db8603a47825e976f791b ALSA-2024:2512 Copyright 2024 AlmaLinux OS 0 1 Low

file security update

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Security Fix(es): * file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default file-devel-5.39-16.el9.aarch64.rpm ef9c0c614a61d4e0016afbb9a4710854b2ac555f3cfdf03bd13b2506e21bbfe2 ALSA-2024:2551 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) Bug Fix(es): * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default bind-devel-9.16.23-18.el9_4.1.aarch64.rpm 61484cbd6cc643c983998d7a59dd1c34d9d888355341c6076d1042944831a565 bind-doc-9.16.23-18.el9_4.1.noarch.rpm f79829629665932a43bcf0575918edac6feb3858caced0cd6b7d9228d46c6ec4 ALSA-2024:2560 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security and bug fix update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441) * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() [almalinux-9] (JIRA:AlmaLinux-25081) * libvirt: negative g_new0 length can lead to unbounded memory allocation [almalinux-9] (JIRA:AlmaLinux-29515) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.2.el9_4.alma.1.aarch64.rpm 2cd9718c087ad0c4d89695ae13cdc50e3e743d262097a1d31ea00e3df0b75908 libvirt-daemon-plugin-sanlock-10.0.0-6.2.el9_4.alma.1.aarch64.rpm 312c18fbd778ddc7d3a57d119b097f5a37f0c0621608ecc5642585d643f6a37b libvirt-docs-10.0.0-6.2.el9_4.alma.1.aarch64.rpm db10900291f3090a6c42b5dc0afb696451a4c4d6222f64c12abd450dbae56560 ALSA-2024:2571 Copyright 2024 AlmaLinux OS 0 1 Moderate

sssd security and bug fix update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758) Bug Fix(es): * socket leak (JIRA:AlmaLinux-22340) * Passkey cannot fall back to password (JIRA:AlmaLinux-28161) * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (JIRA:AlmaLinux-27209) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libsss_nss_idmap-devel-2.9.4-6.el9_4.aarch64.rpm 8015acc4cce2c19fb2654bf7b90f08ba1f5e96008b7a49a4dd6bebaaaa46bfa6 ALSA-2024:2758 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240) * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-SN-3008,CVE-2024-25742,CVE-2024-25743) Bug Fix(es): * ffdhe* algortihms introduced in 0a2e5b909023 as .fips_allowed=1 lack pairwise consistency tests (JIRA:AlmaLinux-27009) * mm/mglru: fix underprotected page cache (JIRA:AlmaLinux-29235) * [EMR] [TBOOT OS] SUT could not go to S3 state with AlmaLinux 9.2 Tboot OS One CPU return -16 running BUSY (JIRA:AlmaLinux-29673) * system hangs completely - NMI not possible (JIRA:AlmaLinux-30678) * ice 0000:6f:00.0: PTP failed to get time (JIRA:AlmaLinux-30110) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.16.1.el9_4.aarch64.rpm 6a9f7f6a6cdbf0c015fb51a27074985e6d19ac697652ae1fb0dc6cf0eeca757b kernel-tools-libs-devel-5.14.0-427.16.1.el9_4.aarch64.rpm aaf85414cf8ae32c29c8517ef66526c88bc3a93f388233d780bb86c7029b7878 libperf-5.14.0-427.16.1.el9_4.aarch64.rpm b53cea1b5c8bad9463d3eb87b994eb99d08d6add2cf0b9f165b22a815f522e56 ALSA-2024:2842 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.105-1.el9_4.aarch64.rpm acd3ea4dae34ba20db7621a9589343a1d1bba479d5db96f1257991e084bbfad8 ALSA-2024:2843 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.119 and .NET Runtime 7.0.19. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-7.0-source-built-artifacts-7.0.119-1.el9_4.aarch64.rpm 2123994dcca6a09c49393c55a9be3935721e2894415200c618d46f9496995e3f ALSA-2024:3306 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.18.1.el9_4.aarch64.rpm 6fbb46c77b5c907d2497994de5320ea6143a1a99f4d8977016fd13255c5f599e libperf-5.14.0-427.18.1.el9_4.aarch64.rpm 807b73e374da4a5f01ceff27c7296394383440a93b9646f03d58295f0b538c97 kernel-cross-headers-5.14.0-427.18.1.el9_4.aarch64.rpm e26df682d4b8aa02d1a49bb9e8ded3dc38c22c06afc2cf044256d7206cf7873b ALSA-2024:3339 Copyright 2024 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (CVE-2024-2961) * glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599) * glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600) * glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601) * glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default glibc-static-2.34-100.el9_4.2.aarch64.rpm 05c44a26d074f91eb7d3b29a0cbd275029eb6bdaca4281a82e2a26667a449668 nss_hesiod-2.34-100.el9_4.2.aarch64.rpm 5c15ab7933cd215af81f6229e19c18660a6e75ffe89166c210d92cf41bc606c3 glibc-nss-devel-2.34-100.el9_4.2.aarch64.rpm c0a9064906a4d1c9a8c23b1b06ad9cc8f97ea6e6210b1b34a8ead31ee8b60d72 glibc-benchtests-2.34-100.el9_4.2.aarch64.rpm c7093c7faa1a95a05daff8aaed0babff237c7d42d31c433c7be11294e49b45fd nss_db-2.34-100.el9_4.2.aarch64.rpm e7fc0b83ad2557e7c29937892e9fa841cd6c645201c85eb41ea415c5f0209733 ALSA-2024:3501 Copyright 2024 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libnghttp2-devel-1.43.0-5.el9_4.3.aarch64.rpm 0083f6b4d4c6ed52bc73e14c7ba256443401388579ab9b0cc8fa1ddff64049e0 nghttp2-1.43.0-5.el9_4.3.aarch64.rpm 59e880af00d5249048bd2841f7216f25078d1c1721803db8a03c82a0f08d871c ALSA-2024:3619 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.20.1.el9_4.aarch64.rpm 33a17701277b0b336cea3b1508a8e0d93d722679480549a5b50b65ed45f15161 kernel-tools-libs-devel-5.14.0-427.20.1.el9_4.aarch64.rpm 4c02a38ca175eeffe5f49baae55d42afd1add5c2107a87872c34343009e9132a libperf-5.14.0-427.20.1.el9_4.aarch64.rpm 699909e9a96b656fdd347f58ca9fbc36515516afef84bcd8c929cdc47c5ee474 ALSA-2024:3754 Copyright 2024 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVE-2024-2698) * freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVE-2024-3183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-ipatests-4.11.0-15.el9_4.alma.1.noarch.rpm 78a871b98a4d70c7e4965a260510e083551216826811b20ae35783e13bdd5fdd ALSA-2024:3837 Copyright 2024 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657) * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-8.el9_4.aarch64.rpm 084dc1ebc5e8c7c19a509e104be0b17715f1763d1e86d7320f256def5bfa72be ALSA-2024:3838 Copyright 2024 AlmaLinux OS 0 1 Moderate

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0). (AlmaLinux-35740) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default ruby-doc-3.0.7-162.el9_4.noarch.rpm 08fa7f7a8c78fdb7c1bcc7a1c92de0956e0c4e18dc0c8953ef596a1a75bec22b ALSA-2024:3959 Copyright 2024 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default flatpak-devel-1.12.9-1.el9_4.aarch64.rpm ce8fd5458662ecc04f3a0f216fbf5c5091dff4c1bf031619a5c15045162df7ff ALSA-2024:3999 Copyright 2024 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: OPVP device arbitrary code execution via custom Driver library (CVE-2024-33871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libgs-devel-9.54.0-16.el9_4.aarch64.rpm 8936c1809679ce0f4c37123d638da766f382c2fd345bad33eef58aa79649233b ALSA-2024:4077 Copyright 2024 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.1.aarch64.rpm 4c136de3346c7e477a001e68b6077c51e5c2ce58aec4b212797173bf469ef288 python3.11-idle-3.11.7-1.el9_4.1.aarch64.rpm 6add5910b9b0b5731691ce9c129f1fad5ef1ec51bfbb61c9ba44e89f2dda93a1 python3.11-test-3.11.7-1.el9_4.1.aarch64.rpm d5c8e3418065455f8b6276fd89cf1616aa469d04aee44caf5767f12cfaa76d19 ALSA-2024:4078 Copyright 2024 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.1.aarch64.rpm 3528e4f493bba53ea5fe7bef446124bbb7a37bd731557b7870fa0086050291bc python3-test-3.9.18-3.el9_4.1.aarch64.rpm 6da7eb58647e7d942e534644976ac6a424862f60fac396d2708d83cea80c5166 python3-debug-3.9.18-3.el9_4.1.aarch64.rpm 9d9b612c0c34c8b20b044e6e9bf6afa2e98652d70a96e6c69ca5c2b686ea1882 ALSA-2024:4349 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801) * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974) * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393) * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667) * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870) * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960) * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400) Bug Fix(es): * cifs - kernel panic with cifs_put_smb_ses (JIRA:AlmaLinux-28943) * BUG: unable to handle page fault for address: ff16bf752f593ff8 [almalinux-9.4.z] (JIRA:AlmaLinux-35672) * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [almalinux-9.4.z] (JIRA:AlmaLinux-36220) * [AlmaLinux9] kernel BUG at lib/list_debug.c:51! [almalinux-9.4.z] (JIRA:AlmaLinux-36687) * ice: DPLL-related fixes [almalinux-9.4.z] (JIRA:AlmaLinux-36716) * CNB95: net/sched: update TC core to upstream v6.8 [almalinux-9.4.z] (JIRA:AlmaLinux-37641) * IPv6: SR: backport fixes from upstream [almalinux-9.4.z] (JIRA:AlmaLinux-37669) * [RFE] Backport tmpfs noswap mount option [almalinux-9.4.z] (JIRA:AlmaLinux-38252) * Isolated cores causing issues on latest AlmaLinux9.4 kernel and not functioning as desired. [almalinux-9.4.z] (JIRA:AlmaLinux-38595) * [ice] Add automatic VF reset on Tx MDD events [almalinux-9.4.z] (JIRA:AlmaLinux-39083) * [HPEMC AlmaLinux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [almalinux-9.4.z] (JIRA:AlmaLinux-34953) * bnx2x: fix crashes in PCI error handling, resource leaks [almalinux-9.4.z] (JIRA:AlmaLinux-43272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libperf-5.14.0-427.24.1.el9_4.aarch64.rpm 31333b639b938d23b9eaea6c6f9bd1e47b3a1e5157be64570018765a4cb7f849 kernel-tools-libs-devel-5.14.0-427.24.1.el9_4.aarch64.rpm cb74ce65e3a718f2915a47d5074dc63c9ebbb0c0305e3d7109f6d443c21cb012 kernel-cross-headers-5.14.0-427.24.1.el9_4.aarch64.rpm ed0cb95802fef4493cca43941fb7148825b58b2dd6401e4548b5898f3f96b5f7 ALSA-2024:4439 Copyright 2024 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.132 and Runtime 6.0.32. Security Fix(es): * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.132-1.el9_4.aarch64.rpm ecd29d2737176eb09397b679d960da29f5c502b90fa4f37406d3fe243552c383 ALSA-2024:4450 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7. Security Fix(es): * dotnet: DoS in System.Text.Json (CVE-2024-30105) * dotnet: DoS in ASP.NET Core 8 (CVE-2024-35264) * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.107-1.el9_4.aarch64.rpm 27f52f72f3d001e069b2bf45c82c6fbc44468caa78105811c78e82224fb49216 ALSA-2024:4563 Copyright 2024 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-1.8.0-openjdk-headless-slowdebug-1.8.0.422.b05-2.el9.aarch64.rpm 0c35ef5f279b490fdf9104d4860f1beaaf7ac99893e8f142ddcafbec586d6aae java-1.8.0-openjdk-slowdebug-1.8.0.422.b05-2.el9.aarch64.rpm 0feee955088143d98b2c3091773717afdd0ac09af503cae5a20ca34f50b62fac java-1.8.0-openjdk-demo-slowdebug-1.8.0.422.b05-2.el9.aarch64.rpm 1773100c39cb7c3f7a44a5a2e1b7e0825d3494716e87a17c3b4efcda1a505812 java-1.8.0-openjdk-src-fastdebug-1.8.0.422.b05-2.el9.aarch64.rpm 1aeeecfe3d6e3af5d5fe6de8bf1819c28ebc99871cff95f1ed6fda11b6f08764 java-1.8.0-openjdk-headless-fastdebug-1.8.0.422.b05-2.el9.aarch64.rpm 58de7d7b3884b51603c37e4b2a41899b36a6301aab9b306338a8efb5e6db02e1 java-1.8.0-openjdk-devel-fastdebug-1.8.0.422.b05-2.el9.aarch64.rpm 624fb8eb6e724908e74cb4f36dd6e3b80b9ecd0b3852270f5e16ac919a6bb8ef java-1.8.0-openjdk-src-slowdebug-1.8.0.422.b05-2.el9.aarch64.rpm 82802b2422031340a4368753c7f075c38220c92ba65c00eab99d194a92a89c37 java-1.8.0-openjdk-devel-slowdebug-1.8.0.422.b05-2.el9.aarch64.rpm ac3c84c5e2bf505c4e22753f9b167ae9202e6d61fa1b58af312950a82b677ac0 java-1.8.0-openjdk-fastdebug-1.8.0.422.b05-2.el9.aarch64.rpm b573829a43e0745ca3329c893f61374b9462cfdd439252a0f4fa635434aec61a java-1.8.0-openjdk-demo-fastdebug-1.8.0.422.b05-2.el9.aarch64.rpm f034ccae68fe14498f22be697187d164d333225ebf95a937e591305e565709bd ALSA-2024:4567 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-11-openjdk-demo-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm 0dd017a8df3f89e3b22bea4bff1062c82b9e1e32fbd574dc105eb3008d6737a4 java-11-openjdk-static-libs-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm 142af121d67bb13d5f5ceca872fc456ecf1838a13bd23363b9c244a3cf72bc51 java-11-openjdk-demo-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 48e000611c98b6f69bb441f48a5c0828e2e33d5690c1f6cc815e2dd040d9ea52 java-11-openjdk-headless-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm 4c13599c51cb30b56a0382cb18b7ab07dbce8025aa9dce07b2c78462fde0c8e2 java-11-openjdk-static-libs-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 5b077a8e31a4612fb9a3ac7f8cd8942165551f854617b91800169a82cfe4ab32 java-11-openjdk-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 6012aad4d6b5da6d6b697443cd4420bf769101e70df3913c8883c6b6ce8b6551 java-11-openjdk-devel-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 6b91e39e7f26a666ab84ff8ee10374dbaa867bf9e29758ae1faae732ce217d8a java-11-openjdk-src-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 731913d203a955a5c364e48411de0160e88b3e605fef41933d56d1d50efe9964 java-11-openjdk-jmods-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm 82b98ba71097a9b7e88b58b489c13da941049f358431931d817c5cec3bdc28c3 java-11-openjdk-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm 974860944b765b25b59f34cbf6a5b4df9bcaa8f87fcced6513f3e63048b49f5f java-11-openjdk-headless-fastdebug-11.0.24.0.8-2.el9.aarch64.rpm dfcaf9dd5e5613810a666215818c25cbfc2f5505836df71bdca9ff0b98708bc3 java-11-openjdk-src-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm e761179255de1c940a250cc9f222f21a9e0844910213cdc7949577510657fb2f java-11-openjdk-jmods-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm ec30da3e577d56cff6d727026c95be50b4e6cb8a3d95ba30eca6601c3374c0f6 java-11-openjdk-devel-slowdebug-11.0.24.0.8-2.el9.aarch64.rpm f74ba05cd99b9a30cdad294cb8105681266b644e10b257a32a05ca20a032da88 ALSA-2024:4568 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-17-openjdk-jmods-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm 3deb179a1d93ed3feddb42e87a7257343284ed18aa4053fb1ff9c735ed232f85 java-17-openjdk-src-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm 4770f9088ec67851afc7d164d703e7f9825fad8ad9261d4de0940a8c9e929e71 java-17-openjdk-static-libs-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm 72ce46ae182c867be270447b13a4e95d2bc3295c459bc36554ca7570c1570a14 java-17-openjdk-devel-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm 75bf948c5fa98bec21d78bcb6476ff4194ceaa37a0953835c337dab0517c8e3c java-17-openjdk-demo-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm 7bc19468bd3205d311132e5ed80bbf55fb9c9329b6f9a57f8ee440160a6eeca7 java-17-openjdk-static-libs-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm 909fa8e8bd10a5872c110a8a05e325b61de0dfd6604360b735697a45904a8078 java-17-openjdk-src-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm a436cd548f52f7a0a920054051c1f214f176701241937d13cae415cb9acbf7f7 java-17-openjdk-headless-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm d16a6517497484cfaa13e623fb4d2eb1e62f8363a1a7746d3670e8f5e2f7770c java-17-openjdk-jmods-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm d27f6a0c7a4a10087bde77202345a194ba3dc879a2c849b1e8e5795471554123 java-17-openjdk-headless-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm db96d50092b99f02fba0368f133a567823ae4cc988c8fcda63c96e39414187b1 java-17-openjdk-devel-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm df30f816be639068d6845a90ee7829d7af4350beeb79814eba1d9dca332cee59 java-17-openjdk-demo-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm e4af933c6c870360628519ff331c68478c796bcdad69b3497000ccc99158af6c java-17-openjdk-slowdebug-17.0.12.0.7-2.el9.aarch64.rpm ed6162e0300d86d0856d59242ff21ef2f5414536d9ec52da21f5018508cbe90d java-17-openjdk-fastdebug-17.0.12.0.7-2.el9.aarch64.rpm f8b0d87283c53cf41771ab22ef05a909a0acf1e405b1cafa2d11866481050978 ALSA-2024:4573 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-21-openjdk-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 0023a7f6999f32efeb7634570caaaa28b50b2730899a2299e452745f7a9a83e3 java-21-openjdk-headless-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 16cccac954bb84b3c04f02f043a818443338f996ff4eb02e5ba51b5c37d13cc9 java-21-openjdk-src-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 1c6943191f295730105cb9ad606fb8a1d87356dca441a7949dc3952c6f5ac148 java-21-openjdk-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 1e567e8590fdd7a3d2ec4c844b0d5af2de476632164a26f1de45f0766624eb8e java-21-openjdk-headless-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 26ce910ec4d39cd8975806a6d4147822da2087fe68bd4cc10a3d6a15f5d213d9 java-21-openjdk-demo-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 2c59e1ef8a66cf553ce17aaf097fa95216561047c17b4c55073a154f01e08879 java-21-openjdk-static-libs-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 4105b5c61a9f149c564e46d983a6b090bfd0c942ab6751519e56974bea2dfc2d java-21-openjdk-devel-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 44c50b10db711e44d85bfc4fc32745544cdd1f17189408dc2114d95451bb7c1c java-21-openjdk-devel-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 7b1bcac1e52c0935c4323005717153187cacafe2f264592b7a70f75a890f536f java-21-openjdk-static-libs-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm 9ce079bfbc22af989c608254987f67769654daa4d8cb28e2c0d5e3386191058a java-21-openjdk-demo-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm a861187cc90e21e606d39dac2698d652af50a1e1524195787d42ff214e754581 java-21-openjdk-jmods-slowdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm be6654d820acb9fc32505781a9fdf77d0e4f99603b266e75bc2d475593ffb0e1 java-21-openjdk-jmods-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm e8448f9ac788a457518e16f7e02e6d08d9aa5e01d3a94c4cb1e07c1c57f50422 java-21-openjdk-src-fastdebug-21.0.4.0.7-1.el9.alma.1.aarch64.rpm f1960bc2a0e6049ddc768ede7823137c232ea40c5c1d3cc68c0be42dc6474a8e ALSA-2024:4583 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (CVE-2024-26858) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435) * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958) * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904) * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543) * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593) * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957) * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.26.1.el9_4.aarch64.rpm 031d535e88f0bed84e9ee02ce0885a9e83daacd6bf67661b302c6ed7e3dca845 libperf-5.14.0-427.26.1.el9_4.aarch64.rpm 556c6719799124a576dae1cce0a4b67d42e23496b5a82797810a9f58bff03fde kernel-tools-libs-devel-5.14.0-427.26.1.el9_4.aarch64.rpm 754348d2873c6dca24d43b52260ce5e5de5b482b5d45e9ecac43f1e789750d5e ALSA-2024:4623 Copyright 2024 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-10.el9_4.aarch64.rpm 85e482552b3e5679293b9fe32b617d9c498d6c8af9b39317bfcf0b63f4be9959 ALSA-2024:4749 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default edk2-ovmf-20231122-6.el9_4.2.noarch.rpm 07ab65898528b14bd133dcc29037207a0575b113ba24d06b8ec9fb9a2740a4a8 edk2-aarch64-20231122-6.el9_4.2.noarch.rpm 9a5248396531529aa0a93ef15d4a30176a9c18dced35b724cbc45a4b1e0b3784 edk2-tools-20231122-6.el9_4.2.aarch64.rpm a37b1abcd086ada56a23b2fc5caf23952b18b9a7dbe8c5da55a161f9834fff01 edk2-tools-doc-20231122-6.el9_4.2.noarch.rpm c756059b460fd70f02088389aa5bc06026f457801491df61042de96189563f25 ALSA-2024:4756 Copyright 2024 AlmaLinux OS 0 1 Moderate

libuv security update

libuv is a multi-platform support library with a focus on asynchronous I/O. Security Fix(es): * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libuv-devel-1.42.0-2.el9_4.aarch64.rpm f6b30820f6298311ae7dca875e6b8422b4bd45874b5a4eb7ed5d637321534686 ALSA-2024:4757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: stack use-after-free in virNetClientIOEventLoop() (CVE-2024-4418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.6.el9_4.alma.1.aarch64.rpm 308a7e830cd7866304da89d1447f5877bb4f0851eab9ad3d2a1158e19ab59e01 libvirt-daemon-plugin-sanlock-10.0.0-6.6.el9_4.alma.1.aarch64.rpm 3a705ac547e17700d342907b1a9bf190db3ab6541b93f7ee3094e23f62108b5b libvirt-docs-10.0.0-6.6.el9_4.alma.1.aarch64.rpm d8bbc5c24597da98c5ad0923b9c6338ee189ca10b37f60f7464447c8c738d194 ALSA-2024:4766 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.3.aarch64.rpm 17a60306d6dc4206383c3ca8457341d0d70fb2984a9ed3f4a1a64562cf88d511 python3.11-test-3.11.7-1.el9_4.3.aarch64.rpm 89fd71106af347e943dd527a13fcb1420709911ebfb752c556c1cc725a9d2141 python3.11-idle-3.11.7-1.el9_4.3.aarch64.rpm fd4ce0ca613856c35149004cbfed5c1a5bb10c0a0c83f574136e436f7e757ae8 ALSA-2024:4779 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.3.aarch64.rpm 5e812ffcd0112d7e69acd20b24b162b6ecd9c90693992161f5b7e18c3ff8f914 python3-debug-3.9.18-3.el9_4.3.aarch64.rpm 6ac32016143fb34696cac0d732cb90f3c964457200048700502ee2dca9bc79d2 python3-test-3.9.18-3.el9_4.3.aarch64.rpm df8bd36c41f5f827ed4f92842d4c0df5da02ec39a0f936a68ddbfbd2aed7bf48 ALSA-2024:4928 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458) * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773) * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737) * kernel: dm: call the resume method on internal suspend (CVE-2024-26880) * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852) * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) * kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046) * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030) * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857) * kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907) * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885) * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809) * kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459) * kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924) * kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952) * kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743) * kernel: epoll: be better about file lifetimes (CVE-2024-38580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libperf-5.14.0-427.28.1.el9_4.aarch64.rpm 47d9350ef213a16e6ac50734e6b11dd2142b7a8cd9ed2a9339f7f7108d2a98b5 kernel-tools-libs-devel-5.14.0-427.28.1.el9_4.aarch64.rpm bd66c994ba27b8ea0c07dcf28bfb320fba2beed25d6fd9ae4d9f45850d092945 kernel-cross-headers-5.14.0-427.28.1.el9_4.aarch64.rpm cf889d197884fac02d6eebbcd8c3a645e9c8b5bbda0304a3a26fa41d9f283036 ALSA-2024:4935 Copyright 2024 AlmaLinux OS 0 1 Important

freeradius security update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: forgery attack (CVE-2024-3596) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default freeradius-sqlite-3.0.21-40.el9_4.aarch64.rpm 03d44c55f7b7db7cc107850a628d67843040f80c8d27202240a36be20b5b54b9 freeradius-postgresql-3.0.21-40.el9_4.aarch64.rpm 069ace9f2e0f1b295ee984ee2831d831ec67b99011f824b25ea540afc22bb996 freeradius-perl-3.0.21-40.el9_4.aarch64.rpm 0726ef61f57c819680148cd6c0322068be176d18376d5d25cfd51b676212b8c3 freeradius-rest-3.0.21-40.el9_4.aarch64.rpm 6d43d6ad52041b34825eb8aaf7b177cb269943cde6eb548e21b6311489c9eee9 freeradius-unixODBC-3.0.21-40.el9_4.aarch64.rpm a09694fc3f7cf1bb61478e40889f83cbdbc3da919985b0edab34682606c4e19e freeradius-mysql-3.0.21-40.el9_4.aarch64.rpm c58812347c2683672522df4ea25b94a7dc2b3221d93b796d778556b7198491ba ALSA-2024:5192 Copyright 2024 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953) * 389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request (CVE-2024-6237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-9.el9_4.aarch64.rpm e0fd820f5a57cf508707adc2ecba139fcd29961812a55696be945fdef00064ce ALSA-2024:5231 Copyright 2024 AlmaLinux OS 0 1 Important

bind and bind-dyndb-ldap security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam (CVE-2024-1737) * bind9: bind: SIG(0) can be used to exhaust CPU resources (CVE-2024-1975) * bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content (CVE-2024-4076) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default bind-devel-9.16.23-18.el9_4.6.aarch64.rpm 553869277a16cfe0907b023158774c145a56152b6bb74589dacf883c7c7a70f5 bind-doc-9.16.23-18.el9_4.6.noarch.rpm a5ec8a6da6cd1f20a2976b83bb6408fc04182069d72450b79a1f8eac28b51e2b ALSA-2024:5334 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.108 and .NET Runtime 8.0.8. Security Fix(es): * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.108-1.el9_4.aarch64.rpm fc4d2aa28570434893c5e24d04d225bc94423f2fd33693ad445cc5e23c2f1ec5 ALSA-2024:5363 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: phy: (CVE-2024-26600) * kernel: netfilter: multiple flaws (CVE-2024-26808, CVE-2024-27065, CVE-2024-35899, CVE-2024-36005) * kernel: cifs: (CVE-2024-26828) * kernel: wifi: multiple flaws (CVE-2024-26897, CVE-2024-27052, CVE-2024-27049, CVE-2023-52651, CVE-2024-35789, CVE-2024-27434, CVE-2024-35845, CVE-2024-35937, CVE-2024-36941, CVE-2024-36922, CVE-2024-36921, CVE-2024-38575) * kernel: nfs: (CVE-2024-26868) * kernel: igc: (CVE-2024-26853) * kernel: dmaengine/idxd: (CVE-2024-21823) * kernel: ipv6: multiple flaws (CVE-2024-27417, CVE-2024-35969, CVE-2024-36903, CVE-2024-40961) * kernel: vt: (CVE-2024-35823) * kernel: efi: (CVE-2024-35800) * kernel: mlxsw: (CVE-2024-35852) * kernel: eeprom: (CVE-2024-35848) * kernel: ice: (CVE-2024-35911) * kernel: platform/x86: (CVE-2023-52864) * kernel: i40e: (CVE-2024-36020) * kernel: rtnetlink: (CVE-2024-36017) * kernel: net: multiple flaws (CVE-2024-36929, CVE-2024-36971, CVE-2021-47606, CVE-2024-38558, CVE-2024-40928, CVE-2024-40954) * kernel: ipvlan: (CVE-2024-33621) * kernel: tcp: (CVE-2024-37356) * kernel: virtio: (CVE-2024-37353) * kernel: tls: (CVE-2024-36489) * kernel: cxl/region: (CVE-2024-38391) * kernel: bonding: (CVE-2024-39487) * kernel: netns: (CVE-2024-40958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libperf-5.14.0-427.31.1.el9_4.aarch64.rpm 798a53810732ab5fa19671036e5cf85ed4e77bb1751cc1fd04d07e633ebbbf8d kernel-tools-libs-devel-5.14.0-427.31.1.el9_4.aarch64.rpm c5a1c4beabf48f6c1faa276412065a66fca418f28cf6c4a2e304bd19a40d77b3 kernel-cross-headers-5.14.0-427.31.1.el9_4.aarch64.rpm fb58c6767cced27c1b24421f5d6910caa8a11b362d0b8b119f0694671f1a1e90 ALSA-2024:5533 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12-setuptools security update

Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.12-setuptools-wheel-68.2.2-3.el9_4.1.noarch.rpm 131b0a0f2d74e9412a6cc9f472ba83b59d41a1569d92fe31ea3e11e061212f48 ALSA-2024:5928 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nftables: nft_set_rbtree skip end interval element from gc (CVE-2024-26581) * kernel: netfilter: nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) * kernel: vfio/pci: Lock external INTx masking ops (CVE-2024-26810) * kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CVE-2024-26855) * kernel: x86/xen: Add some null pointer checking to smp.c (CVE-2024-26908) * kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (CVE-2024-26925) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019) * kernel: netfilter: flowtable: validate pppoe header (CVE-2024-27016) * kernel: netfilter: bridge: confirm multicast packets before passing them up the stack (CVE-2024-27415) * kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898) * kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897) * kernel: netfilter: validate user input for expected length (CVE-2024-35896) * kernel: netfilter: complete validation of user input (CVE-2024-35962) * kernel: ice: fix LAG and VF lock dependency in ice_reset_vf() (CVE-2024-36003) * kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race (CVE-2023-52771) * kernel: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (CVE-2023-52880) * kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (CVE-2024-36025) * kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608) * kernel: crypto: bcm - Fix pointer arithmetic (CVE-2024-38579) * kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (CVE-2024-38544) * kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540) * kernel: net: bridge: xmit: make sure we have at least eth header len bytes (CVE-2024-38538) * kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (CVE-2024-39476) * kernel: ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905) * kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station (CVE-2024-40911) * kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CVE-2024-40912) * kernel: mm/huge_memory: don&#39;t unpoison huge_zero_folio (CVE-2024-40914) * kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CVE-2024-40929) * kernel: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (CVE-2024-40939) * kernel: wifi: iwlwifi: mvm: don&#39;t read past the mfuart notifcation (CVE-2024-40941) * kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957) * kernel: scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978) * kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983) * kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090) * kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091) * kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041) * kernel: NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076) * kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (CVE-2024-42110) * kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.33.1.el9_4.aarch64.rpm 796a65b2c6768a37043544ce1ce617966425b7fe6d4682bee9cbbec8c6117b5e kernel-tools-libs-devel-5.14.0-427.33.1.el9_4.aarch64.rpm b4f5bb1523261e4d378068e2053de9798d5b0a9411ce76ef7bbea70c67a6cfff libperf-5.14.0-427.33.1.el9_4.aarch64.rpm ceb85b1279fd21ba6e5ac516315e44c73223ca07be2f0a7e2a9766a8c27b4f7a ALSA-2024:5999 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default postgresql-server-devel-13.16-1.el9_4.aarch64.rpm 13fce2cbaf06d3fc47e2f33eea684ae801cb9116ca25b3ae5823ea45b09e7251 postgresql-private-devel-13.16-1.el9_4.aarch64.rpm 3be16229464ba1a200cf093cda18a8cced6b8b1a56616c21b47fa5d25c3becc0 postgresql-test-13.16-1.el9_4.aarch64.rpm 3fa261e9b55cc556a7b0cacb821189e3949c1e80a4ac1f9f1db1a4084054a264 postgresql-upgrade-devel-13.16-1.el9_4.aarch64.rpm 616f92b42b10529b8155f5a17c2dac472694161749d21170d25aff602f2d279f postgresql-docs-13.16-1.el9_4.aarch64.rpm e800033c5eab3e33889cec204699d40e42cbef94b1e0b2695dc82565fba49d80 postgresql-static-13.16-1.el9_4.aarch64.rpm ef09a69e1bf0339e5d34b6d6214e3bbb1d21204b78839429feaf397d234f853c ALSA-2024:6146 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.12-idle-3.12.1-4.el9_4.3.aarch64.rpm b1530a1a123df0c663c6cc49ae7588a0f634e92db04a336ee97ef626913c52a7 python3.12-debug-3.12.1-4.el9_4.3.aarch64.rpm b9cbb5a615e55e4b4b6b6c1cb2d698facd3ce2acbdcfde755ab79198e2d663ab python3.12-test-3.12.1-4.el9_4.3.aarch64.rpm c516d61519dbbe6fe4ec8290e008b24ecdfab5e11ce92c56caaa7cdc2350367b ALSA-2024:6163 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.5.aarch64.rpm 15a5d51139501ac2dae1cf322327c4b293191f6df72576006914893ed822e171 python3-debug-3.9.18-3.el9_4.5.aarch64.rpm afc13b605cf45739c2e5d8d63814cc05e7be40330276c5bce1671a37608631c0 python3-test-3.9.18-3.el9_4.5.aarch64.rpm ec62155cf74facccee4bf0a68dc0133e9dd94e415bfa93d962aa189b643eeaf8 ALSA-2024:6179 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.5.aarch64.rpm 1acf602dec87dd011636bc693483d5805688a7940b6af20febc8e83ff545ebd9 python3.11-idle-3.11.7-1.el9_4.5.aarch64.rpm 3427ead8b10e7d6759889fbef013cbc94da21834c7c0c56f6fd31679ac20d90d python3.11-test-3.11.7-1.el9_4.5.aarch64.rpm 4f9197e97cd47f67cdb3f77e6526fbf099357725f42509d066e1149af5bbe408 ALSA-2024:6197 Copyright 2024 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: format string injection leads to shell command execution (SAFER bypass) (CVE-2024-29510) * ghostscript: path traversal and command execution due to path reduction (CVE-2024-33869) * ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths (CVE-2024-33870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libgs-devel-9.54.0-17.el9_4.aarch64.rpm 706dc43209e1913976e6b9142b078215b6ae4d6f113e1d254f2b403aed41eff5 ALSA-2024:6356 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default flatpak-devel-1.12.9-3.el9_4.aarch64.rpm fdf42c339826cd9ea8e2c18c8842bca7b23429d1da92f0d26c272329a6555500 ALSA-2024:6464 Copyright 2024 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default glib2-static-2.68.4-14.el9_4.1.aarch64.rpm 14e1a5824bfd15ee31b00e1ff1664609ac4a05b2acdd7670f6021ad587e6a5ca ALSA-2024:6529 Copyright 2024 AlmaLinux OS 0 1 Moderate

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dovecot-devel-2.3.16-11.el9_4.1.aarch64.rpm e63d32e3b6c4c2ff632911daed9e65b0989885c7015f9d0b23503b9e3fddb120 ALSA-2024:6567 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) * kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886) * kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946) * kernel: KVM: SVM: Flush pages under kvm-&gt;lock to fix UAF in svm_register_enc_region() (CVE-2024-35791) * kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797) * kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875) * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000) * kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801) * kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883) * kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019) * kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) * kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979) * kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) * kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927) * kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936) * kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040) * kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096) * kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082) * kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096) * kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34; (CVE-2024-42102) * kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131) * kernel: nvme: avoid double free special payload (CVE-2024-41073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.35.1.el9_4.aarch64.rpm 34962bd18a47c5147633afbf8671c6d74224ae50716fc238ed49e0b5b6131f88 libperf-5.14.0-427.35.1.el9_4.aarch64.rpm 6e7e5ca3be198ac98e8401985b3fd572d762eb19202ce16812670c593e5088bd kernel-cross-headers-5.14.0-427.35.1.el9_4.aarch64.rpm a4cdf85049a84958f3a3026f33374bf8aea056f5a0868508cf938afa54f94f57 ALSA-2024:6757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: NBD server improper certificate validation (CVE-2024-7383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default ocaml-libnbd-devel-1.18.1-4.el9_4.aarch64.rpm 0f00c0872a575d013a8caf0aa31f348c23dae0be5531c891b4edae83fbd1d038 ocaml-libnbd-1.18.1-4.el9_4.aarch64.rpm 52ac10395ab1a63dafe873a32174932b22be85af313b7758f51ff8b24804b5db libnbd-devel-1.18.1-4.el9_4.aarch64.rpm 63e1ebfafa109487c9562ddd3bb59cffeaf9c71500329e953d153e85739eae8c ALSA-2024:6997 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439) * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739) * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947) * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931) * kernel: scsi: qla2xxx: Fix double free of the ha-&gt;vp_map pointer (CVE-2024-26930) * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929) * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022) * kernel: KVM: x86/mmu: x86: Don&#39;t overflow lpage_info when checking attributes (CVE-2024-26991) * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895) * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899) * kernel: cpufreq: exit() callback is optional (CVE-2024-38615) * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601) * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573) * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570) * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562) * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884) * kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; (CVE-2024-40984) * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071) * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225) * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.37.1.el9_4.aarch64.rpm 2e0091eba0cef1ba05a2b4044b4954623b7b73a07bd68b9dc9e7df59c96e3e06 kernel-tools-libs-devel-5.14.0-427.37.1.el9_4.aarch64.rpm bf5bf897d6fede05fc8143b85a262f92d2d40e159fae8e981598ac474d9486c8 libperf-5.14.0-427.37.1.el9_4.aarch64.rpm c182815583e202d59fbb4a47d5edc45823e733c033cd5505b129ef3bcd3c3851 ALSA-2024:7346 Copyright 2024 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source () * cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes (CVE-2024-47076) * cups: libppd: remote command injection via attacker controlled data in PPD file () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default cups-filters-devel-1.28.7-17.el9_4.aarch64.rpm ecef93815a7ded59c96304ac40c03d8213ec7eb496709a4d15ceb9b8ef108684 ALSA-2024:7867 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35. Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.135-1.el9_4.aarch64.rpm e7237740400acf30984a8b00b363f004471dcc938e3d433e3c2fb62150e2c5c1 ALSA-2024:7869 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.110 and .NET Runtime 8.0.10. Security Fix(es): * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.110-1.el9_4.aarch64.rpm 8c97270b368b9566ace69c7e13c68b7da971396ba56b6376c128941dc742ab5a ALSA-2024:8037 Copyright 2024 AlmaLinux OS 0 1 Moderate

OpenIPMI security update

The OpenIPMI packages provide command-line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. Security Fix(es): * openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator (CVE-2024-42934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default OpenIPMI-devel-2.0.32-5.el9_4.aarch64.rpm 73f244d23ec235efab6cff6c826b208e62ba7e34943c9f7a8001ef664d3bb51d ALSA-2024:8117 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-1.8.0-openjdk-src-fastdebug-1.8.0.432.b06-2.el9.aarch64.rpm 018ace70405f35f8c3e558d0e1a7ca65c3e8c5a6e180fd351e6effb7683dfc27 java-1.8.0-openjdk-headless-fastdebug-1.8.0.432.b06-2.el9.aarch64.rpm 3c81b2e2aa6a7d04f66b96460aee0a90bf91c2afbf5a4385addf5218803b892d java-1.8.0-openjdk-demo-slowdebug-1.8.0.432.b06-2.el9.aarch64.rpm 4276651f9df4ead78f64465d2563477216da84443e909a024b2dd36f1f25cf0c java-1.8.0-openjdk-fastdebug-1.8.0.432.b06-2.el9.aarch64.rpm 5e13d255aea44e81d738e9f89d4c2c24c65aa21bc25e75d527cfe4605a398e4c java-1.8.0-openjdk-headless-slowdebug-1.8.0.432.b06-2.el9.aarch64.rpm 74be0dc61116a41bb026b21da55a801ba06812f83ab5684e6368fe6ae9909e2f java-1.8.0-openjdk-src-slowdebug-1.8.0.432.b06-2.el9.aarch64.rpm 9f6f733c4e9a85e15b71c838cd9fa64c9b6d3fc2aff72e89ceb9267d95cc7a5b java-1.8.0-openjdk-devel-fastdebug-1.8.0.432.b06-2.el9.aarch64.rpm a3363e5da6e96e315b638e98533aa0ebcaa54a2883fa61852b9c5991410cc60b java-1.8.0-openjdk-demo-fastdebug-1.8.0.432.b06-2.el9.aarch64.rpm a7dad5444cf1d1e4dfdc78b61ca44e52ceedc25ed76edf283e48c41d0ebbaa5d java-1.8.0-openjdk-slowdebug-1.8.0.432.b06-2.el9.aarch64.rpm ae10b6168818e6004ba61716fda61bc731322d7f6a635bcb6e11f5b0870dc154 java-1.8.0-openjdk-devel-slowdebug-1.8.0.432.b06-2.el9.aarch64.rpm c304b5013249c1689d176e36fd2036e634140e9b2b5eb7fab68b8ba58a1444b4 ALSA-2024:8121 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-11-openjdk-static-libs-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm 112901886f58dd16b13d17019667c682e6fadc3843a63bec2f13b73363d54d54 java-11-openjdk-static-libs-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm 22e3ed40d2ce84ace537209db96a5a0571b5f3380e5078820b9685317cbac09e java-11-openjdk-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm 31d81c6c4b206f30e56643ed090e3163d0e9de951db369188846b4cc95fb7c8f java-11-openjdk-src-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm 381a7dcc4a67363018c5f64e52696d990603739930b92634bff2cb1b3e54e39a java-11-openjdk-demo-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm 5600622772b8fe38e856b7d33af840b497ff3e8a1efda70319ecf1a2d435b18c java-11-openjdk-demo-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm 6c545d028cd4d2244704f316663bad8bf15fc472cb9846011595f86b88317baa java-11-openjdk-headless-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm 7190b1f8ac0010926365ecdaf60f7a485f9b451e3d5da90bbf194beb1d1548e9 java-11-openjdk-jmods-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm 97662e615afde8e816e80f93c5f99a0e598f99ec6e3b43a5df9b9d2310540263 java-11-openjdk-jmods-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm afe52167edb0f80eed016cab1e1b1c47493024fda29cc277b13fde68045d47f6 java-11-openjdk-devel-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm ccea00246ff82efffcdeec33d9777a0827185264304759e4c7dd6e3808e1b169 java-11-openjdk-devel-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm d382726a7384036929a73a32cfd603977a20746110b213979ae8414f4b1f911c java-11-openjdk-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm d6ee4e34c2f4e1410465731f8f9578ed64228b841fe0ebcfd17acf135c495b5a java-11-openjdk-src-slowdebug-11.0.25.0.9-2.el9.aarch64.rpm f4de156733f684e010ddc0621dd73e68d68a5b13e4be9ef0053fbcf5b71aa5ac java-11-openjdk-headless-fastdebug-11.0.25.0.9-2.el9.aarch64.rpm fdf9030fd5609e7a602c0a2806ea507fcaf8884b419d3f7b3a41e1846685cdf4 ALSA-2024:8124 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-17-openjdk-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 0b4909eb8d5c89b29915625a5e240cfa378219eae61cdbbd86481fc18e77ee5e java-17-openjdk-jmods-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 1246c4318e4978aa9430a112bb3d2b3b8776421659c7151aec79b0139bd884eb java-17-openjdk-src-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 15d6b3115ca10c076eb9002135cad8d174e4a2743bcc03183a835a2cc6e1d630 java-17-openjdk-static-libs-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 321cb99119e8153dcb15120cee42946e1b3dd2d045aa7990bc657551b5e1cda4 java-17-openjdk-headless-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 37329b80e2b0e9a079e07c55be67778b8e8ccc72ee29bd6652e8df1dbd398138 java-17-openjdk-devel-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 4a54e287c4aa63c38ff1ab2de44cb5c90e5b21ac0cea1e72a13f2354172b2d10 java-17-openjdk-demo-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 4cfd00486d1ad1036dc99e19fe020879a270f90643cd81b22b027b75423469a6 java-17-openjdk-static-libs-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm 7c377f9c9cf8a7a7b393362aeae9e8d47c700281d92f2d72eb364042bbab9d30 java-17-openjdk-demo-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm adb6e8306e6fdeb517790c5b1a787fd145730fc03fd389d42f17894732f102d6 java-17-openjdk-jmods-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm ae8d8df66115b6b15be734285be3fe4ad1ef24f4ccb6440ca542eb49603fda48 java-17-openjdk-devel-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm d8f70568acf7fcff593acbeab3f639cf02136b44db56aef176d5340d87601c3c java-17-openjdk-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm e5183f76c45ca92b8b0777464179a07d6a1672ef6ee633726c8ff22b670000ff java-17-openjdk-src-fastdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm e6a27b81bf9c24b9353ae472349c2150af8210e2fc262cfa723b686aa2cf0f65 java-17-openjdk-headless-slowdebug-17.0.13.0.11-3.el9.alma.1.aarch64.rpm fd4bef3b65f6eb2d2e84b4cf48b4a467dcd2d01e654530e59e5280481839c6fa ALSA-2024:8127 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 runtime environment. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default java-21-openjdk-static-libs-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 06bf319cf6cccb9e086e1eb009d8a37bcda37922df37859ce35cd779e54900fb java-21-openjdk-devel-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 08053b689f800adf709afad0b11d2c1e8c2ec17a9bf5266db2d4ebcc735e8778 java-21-openjdk-demo-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 18c68309a8d512243bd5ff94dd4a0ad95316a4b73dc2591a677b5f000841488f java-21-openjdk-static-libs-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 1f0d2ef92d66691cb169907ee32a6626b6824e6682be9d37bc2bc91abb1c126b java-21-openjdk-jmods-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 4b9e03caa8821b9d8c920b9729f801019aa0133e99153feb2199099e69496557 java-21-openjdk-headless-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 55a4e50204034dd5aae67483e989fc5ace83809d95497fd8c9d76f50d9ca4e39 java-21-openjdk-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 6918dfd446b76725a34f857e669f43a8551d5a16024ee854b7e5e1f9935269c3 java-21-openjdk-headless-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 79f16d841fa4cf1d621cb4afc5942469624f83b99458efe9accd7dc3de9b3821 java-21-openjdk-jmods-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm 9284d094b766b203e018fedf6075576159f83a94c4bcb6dfdcb12578be0702b2 java-21-openjdk-demo-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm a6b75d6d25b39c113a32aeb8de695f0b9ba1feeae988d0cc274d9ac1fb704cf3 java-21-openjdk-devel-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm a8a40c80f8cf98897981db0958656564a318df4587f4ce77e15dfd0c20b5e08b java-21-openjdk-src-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm b788f566552049437a9df5a3afebc02c3c98c23bc9bd056f9696d22c72b7d8f5 java-21-openjdk-src-slowdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm bcb126fa55c69ec7748009ede6458ac5fc28589998ad818dd7f99335591170d9 java-21-openjdk-fastdebug-21.0.5.0.10-3.el9.alma.1.aarch64.rpm dca3c11f7b1705d256c9c6da1775a37c8a917ce7e0f4c934a1f63f0b9b640ec5 ALSA-2024:8162 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Local information disclosure on Intel(R) Atom(R) processors (CVE-2023-28746) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34; (CVE-2023-52658) * kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989) * kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47385) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) * kernel: net/mlx5: Add a timeout to acquire the command queue semaphore (CVE-2024-38556) * kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVE-2024-39483) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959) * kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079) * kernel: sched: act_ct: take care of padding in struct zones_ht_key (CVE-2024-42272) * kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.40.1.el9_4.aarch64.rpm 8667afef4107abbab2530f93f555171eec9bb9dc176d7fe6a2cfb054534c82e9 libperf-5.14.0-427.40.1.el9_4.aarch64.rpm 9d658e6f55f5be6ced621eca3c9ebfd962fc9cf9b766eb8f0fd9bfff2f8de8c6 kernel-cross-headers-5.14.0-427.40.1.el9_4.aarch64.rpm f0988ef70551f66f564ad58a4d8445be0eb2bd4a91e446859f25564ad7a4edb8 ALSA-2024:8374 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.6.aarch64.rpm 1b493fc17c9ba1e97091b33067b8a99edb366ee1706c3909d6c094eb85638745 python3.11-test-3.11.7-1.el9_4.6.aarch64.rpm 676046ef24156f488562f5eea0bd798c325e2f133003fdc99cb8c86c534a8ff8 python3.11-idle-3.11.7-1.el9_4.6.aarch64.rpm a3b11f298b79fe74f0ab435c2b2d3355665bfa480e0bf7f3804220af0caccf83 ALSA-2024:8446 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.6.aarch64.rpm 57e18b7002530871906a0a9cd46bd908466459a434a1b0548a6e8d5e4b8a1f08 python3-debug-3.9.18-3.el9_4.6.aarch64.rpm b846aabb53dfae26563e563bbc120b9d13581c390712b4bddcae4bccacabade8 python3-test-3.9.18-3.el9_4.6.aarch64.rpm e64422515ee982bb9ad862a2cccbae3f2751f6324c209bab7f8cf594969ab288 ALSA-2024:8447 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.12-debug-3.12.1-4.el9_4.4.aarch64.rpm 38047db63b798ebe202777a49c051e51149c5b5c1be5f65edaef9a899ccc5e90 python3.12-idle-3.12.1-4.el9_4.4.aarch64.rpm 7f774318311d14b6e5115a8af7ec0a301b8919fd149a736d94328150572b1b5c python3.12-test-3.12.1-4.el9_4.4.aarch64.rpm af81b3eeedc48a543237b56bcf0fa354fdae9bb16de43d2b2f23b280597470d7 ALSA-2024:8617 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923) * kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961) * kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935) * kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383) * kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244) * kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472) * kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504) * kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904) * kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931) * kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960) * kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972) * kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977) * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995) * kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() (CVE-2024-40998) * kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005) * kernel: xfs: don&#39;t walk off the end of a directory data block (CVE-2024-41013) * kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.42.1.el9_4.aarch64.rpm 8258bf9c6b772af3c4092993ae0f5017823edd71132d0905e6d685dd7afc9530 kernel-tools-libs-devel-5.14.0-427.42.1.el9_4.aarch64.rpm b6460add1ffda315d63f34e3402108dfa8722cb86aea2fedaed637e05a287e8f libperf-5.14.0-427.42.1.el9_4.aarch64.rpm df1d435a40ace019fc5377bb24bf4fea1f09f94ab1d0d21babd8a267c685ae09 ALSA-2024:8800 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_4.1.aarch64.rpm 2253293cbe4f234dbaca9b919234cf6cef05600a3b6e7972a31ea5cd16bffbbe ALSA-2024:8914 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9_4.1.aarch64.rpm 0a2cc8ea252dc3f41cad1952cb419f05bfffe7f565df83d5546720946d7456d5 ALSA-2024:8935 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default edk2-tools-20231122-6.el9_4.4.aarch64.rpm 67fdee0cb6921c55cd576b19e460144bf0e8f513f23991a2fe90023d65052933 edk2-aarch64-20231122-6.el9_4.4.noarch.rpm 6ead2d3429f2753faeac142fafcbdb556ed7e654686566cc8c3c51d6d0443a73 edk2-tools-doc-20231122-6.el9_4.4.noarch.rpm ba46cd872396c59af904379ce10005c4a600251e4545cdf711095752271afbd0 edk2-ovmf-20231122-6.el9_4.4.noarch.rpm f240e4196ec775d8927b7347b3954c802adec030b855c4acc8bda3228f24530f ALSA-2024:9088 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129) * openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237) * openssl: denial of service via null dereference (CVE-2024-0727) * edk2: Temporary DoS vulnerability (CVE-2024-1298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default edk2-ovmf-20240524-6.el9_5.noarch.rpm 3528b27d7d11bfda697bf5473dd8035de0ba56571ec5a5d94fd68b6948e6a27c edk2-tools-doc-20240524-6.el9_5.noarch.rpm 4abac5ddb9cf5e935717a02dfcab6de42d97baf7fe07f016bd130036a1619678 edk2-tools-20240524-6.el9_5.aarch64.rpm be7947a173399935f14c69efd38bea6d90835a5994d4a75f42479ceb929107af ALSA-2024:9093 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default xorg-x11-server-Xwayland-devel-23.2.7-1.el9.aarch64.rpm f6e31ff8246b3d620050cc248c5d2834ac3e39755a52253e7d025bedc0045a65 ALSA-2024:9122 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-26.el9.noarch.rpm 04014f59feac5b00a0590cbb6cacb7c373f1b5fc9e24cb3e7ba498b0e97163f9 xorg-x11-server-devel-1.20.11-26.el9.aarch64.rpm 08fc9e7cd31b2964430df6907acef58fcf7f79d7939f79821894377acfbc65f3 ALSA-2024:9128 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Crash of virtinterfaced via virConnectListInterfaces() (CVE-2024-8235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libvirt-daemon-plugin-sanlock-10.5.0-7.el9_5.alma.1.aarch64.rpm 0bc97e005e46d72f9c07841f33309067d55079277ad1470c1d81c1638a8114c4 libvirt-devel-10.5.0-7.el9_5.alma.1.aarch64.rpm 3f5c50b4370aa0ee92fe5e765d22711074cb86a6db262b5d005a3623497b3de0 libvirt-docs-10.5.0-7.el9_5.alma.1.aarch64.rpm 80b9cf5a9ff4db0c7b4a5a0d9f02e01e1fb244b7d40938590748a9f73ce8e458 ALSA-2024:9167 Copyright 2024 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default poppler-cpp-devel-21.01.0-21.el9.aarch64.rpm 66835b068ed60bb2db8b2eb0439ddb9ae4f6b65679217e68da46247a5b63421a poppler-glib-doc-21.01.0-21.el9.noarch.rpm a61fb4d179262e8f7b527744c120382860ebb8da6f1f7d37d23fde01e3e82987 poppler-qt5-devel-21.01.0-21.el9.aarch64.rpm baee131b1a6b97465759748d0a8bfbae4863e4e5a724ef4cc3dcd3e90332d8cd poppler-glib-devel-21.01.0-21.el9.aarch64.rpm baffb18f9be7960e38953f635037cc69cf98b7ccb5bbb8dc96f153502f5837cd poppler-devel-21.01.0-21.el9.aarch64.rpm c9389537a8ccc5daa437e16a3f724c0c8e8fc4cd1bb83bb86ab95b580badbc4d ALSA-2024:9181 Copyright 2024 AlmaLinux OS 0 1 Moderate

jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * jose: resource exhaustion (CVE-2024-28176) * jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libjose-devel-14-1.el9.aarch64.rpm 00f856532a96fac634b258a9542cc56ecb73eb7851cd6fba1dcc0233118f1105 ALSA-2024:9184 Copyright 2024 AlmaLinux OS 0 1 Moderate

gtk3 security update

The GTK+ library provides a multi-platform toolkit for creating graphical user interfaces. The gtk3 packages contain GTK+ version 3. Security Fix(es): * gtk3: gtk2: Library injection from CWD (CVE-2024-6655) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default gtk3-devel-docs-3.24.31-5.el9.aarch64.rpm 430675964ef34d68f86b11a97834d39b74044a251a40a696c19a7f2c4f14a7b4 ALSA-2024:9187 Copyright 2024 AlmaLinux OS 0 1 Low

bcc security update

BPF Compiler Collection (BCC) is a toolkit for easier creation of efficient kernel tracing and manipulation programs. BCC uses the extended Berkeley Packet Filter (eBPF) tool. Security Fix(es): * bcc: unprivileged users can force loading of compromised linux headers (CVE-2024-2314) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default bcc-devel-0.30.0-6.el9.aarch64.rpm ac01f935b1e99cb5e3419e8d7f169ff049232ba49674a2e7924c3eee6f362105 bcc-doc-0.30.0-6.el9.noarch.rpm bfa0e15890e368fcde724436ef7855beb8037f5b9570b22facd5dbaf178346b0 ALSA-2024:9190 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.12-test-3.12.5-2.el9.aarch64.rpm 3764413696d2e462eb9454859656b6f39d9fa2d5649f82a8b4a33d0ed6e65345 python3.12-idle-3.12.5-2.el9.aarch64.rpm 756b623dd6586a6e75d7da046510dc436798ebc0450935203d993c00b105be9a python3.12-debug-3.12.5-2.el9.aarch64.rpm f34659f64cca45576bae298b81600d19ba688752b127bc9ed332758fcdd2b0e6 ALSA-2024:9192 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-test-3.11.9-7.el9.aarch64.rpm 06e17cd151d64b557fe9265f7579d78e3aeb34b715240f7451534eda4feb5e8f python3.11-idle-3.11.9-7.el9.aarch64.rpm 0e37a6c7be54a86bc91b7a413c66dc315fa8b00c9688815c12accb3578ae0d49 python3.11-debug-3.11.9-7.el9.aarch64.rpm 3f57125e8f2c29ad8cec1bf68a5283cf8b4e4aba8bf0ac8e89d1d1c9513a308e ALSA-2024:9317 Copyright 2024 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: Denial of Service (CVE-2024-6501) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default NetworkManager-libnm-devel-1.48.10-2.el9_5.alma.1.aarch64.rpm 597e0b33c11c8ffd73e267cfb999a504aa01788ca306c122b1b9cd171a27b8b7 ALSA-2024:9371 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-debug-3.9.19-8.el9.aarch64.rpm 09af025e19bb98b29d122acd662f36642535bdda1030e619d48bf3213987e19d python3-test-3.9.19-8.el9.aarch64.rpm 5edf796c0bae2cae0562000268d21576897cdc0484f27db97094f0f689b08098 python3-idle-3.9.19-8.el9.aarch64.rpm 622d691e065e30f627aeeabcd449ae53bfe22af469d2a25f2db14948d244c831 ALSA-2024:9413 Copyright 2024 AlmaLinux OS 0 1 Moderate

bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files. Security Fix(es): * bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default bluez-libs-devel-5.72-2.el9.aarch64.rpm ae673a31906e3049f6a8fc42b3a33d2de142d991071648594b3df5dc0da456e3 ALSA-2024:9439 Copyright 2024 AlmaLinux OS 0 1 Moderate

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082) * fontforge: command injection via crafted filenames (CVE-2024-25081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default fontforge-20201107-6.el9.aarch64.rpm d66c8ff824d5c7d8a6a928435a0b417625a515339a9e615d6d057ac7f3a91f7d ALSA-2024:9449 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default flatpak-devel-1.12.9-3.el9_5.aarch64.rpm c526204d51da945dcb36ae1b1d37742bbdc9cc959fb6cba9ee289bb425455a8d ALSA-2024:9450 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.11-debug-3.11.9-7.el9_5.1.aarch64.rpm 25b0569c00cce428802ce2a28d9cdca9e255e39f869c9161dd65afd114369889 python3.11-idle-3.11.9-7.el9_5.1.aarch64.rpm 430bdc397fa08e91c162d4f34aa4a2ccfbda8f3c065b64c94e1e2a5cdb14eb4e python3.11-test-3.11.9-7.el9_5.1.aarch64.rpm b58e71a1d7b76200a42415d93480c2e439ce3ae62a581d0f9a622adf06e1dfe4 ALSA-2024:9451 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3.12-debug-3.12.5-2.el9_5.1.aarch64.rpm 83a695fb8b6b01924871ea379b2a64ee164041651805b174436ed4fa15beec5f python3.12-idle-3.12.5-2.el9_5.1.aarch64.rpm e2113baa58b467f2fa4ccab29a5a36e3ec24a296538c23c9746a240fe49dd74e python3.12-test-3.12.5-2.el9_5.1.aarch64.rpm f93a77cc8ce400c6bb1abe2330e9d419903296e4e4e650161cee167f401e589e ALSA-2024:9468 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default python3-test-3.9.19-8.el9_5.1.aarch64.rpm 0b128e0c3d94f11bfdbb80efade7073303ba67c4afa048e3c7ddd048a0949348 python3-idle-3.9.19-8.el9_5.1.aarch64.rpm 61be26d27b516da872f222abb4836639971c0bb5b734970a4fe1981a6ef6fe7c python3-debug-3.9.19-8.el9_5.1.aarch64.rpm f14f7ec86d4ac9cc5b42a2fb1dd36552b446bf80ac89198cb83d42fd00554e03 ALSA-2024:9543 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.100 and .NET Runtime 9.0.1.0. Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default dotnet-sdk-9.0-source-built-artifacts-9.0.100-1.el9_5.aarch64.rpm 42d41121cf337183f41264316ece74388f54d3c721ef7703f7feaf31dda43b3d ALSA-2024:9548 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_5.1.aarch64.rpm 6ef74b3c20ca62eecca57bd5c3502efc57a99458fba1b09ba1ae538e3a7c5d46 ALSA-2024:9605 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283) * kernel: iommufd: Require drivers to supply the cache_invalidate_user ops (CVE-2024-46824) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libperf-5.14.0-503.14.1.el9_5.aarch64.rpm 1c0427062518037546e18ccce19dda914440c4bd144e9eb048d0673c179b2c61 kernel-tools-libs-devel-5.14.0-503.14.1.el9_5.aarch64.rpm 91c97bfa3c33db86496c0f6ee80a8cff299fe522ce5c6dab89c02b034501ace7 kernel-cross-headers-5.14.0-503.14.1.el9_5.aarch64.rpm d504fcf2079e2da8fca4b09e8319e420a540b0f3e217192c4b38ed9dc507e97d ALSA-2024:9827 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_4_default libvpx-devel-1.9.0-8.el9_5.aarch64.rpm f93e3ebf11f4e3a734f91cb0f4bd3558c465cceef3e18aa39d6d51721fc96251 ALSA-2025:0059 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: perf/aux: Fix AUX buffer serialization (CVE-2024-46713) * kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (CVE-2024-50208) * kernel: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CVE-2024-50252) * kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (CVE-2024-53122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default libperf-5.14.0-503.21.1.el9_5.aarch64.rpm 003ce920d7fb442cd8688ccb781231427754cbaa8a45472f63396f28f073ef5c kernel-cross-headers-5.14.0-503.21.1.el9_5.aarch64.rpm abdabfe9c81bb6936e57ac62681b74084bab80548b28426619258ec8fdf01c0c kernel-tools-libs-devel-5.14.0-503.21.1.el9_5.aarch64.rpm f6048ef27aba4540fbf2b878ae42adf25dc5ee859120ed9f5559b4e14748392c ALSA-2025:0312 Copyright 2025 AlmaLinux OS 0 1 Important

raptor2 security update

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default raptor2-devel-2.0.15-32.el9_5.aarch64.rpm f42ce3c8279e7d332c3c457abcc7875f8d21343898a85453c7241ef244c24462 ALSA-2025:0334 Copyright 2025 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: Administrative user data leaked through systemd journal (CVE-2024-11029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3-ipatests-4.12.2-1.el9_5.3.noarch.rpm 63c9534df50cf8bcb1e19b77e31e903b15a1c98caad904dce2fa4fe6deeae352 ALSA-2025:0377 Copyright 2025 AlmaLinux OS 0 1 Moderate

Security and bug fixes for NetworkManager

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security and bug fix(es): * Routes in table different to main are not deleted on reapply [almalinux-9.5.z] (JIRA:AlmaLinux-73013) * Route to VPN server not stored in routing table that is specified by ipv4.route-table [almalinux-9.5.z] (JIRA:AlmaLinux-73166) * VPN connections do not support ipv4.routing-rules settings [almalinux-9.5.z] (JIRA:AlmaLinux-73167) * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic [almalinux-9.5.z] (JIRA:AlmaLinux-64726) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default NetworkManager-libnm-devel-1.48.10-5.el9_5.aarch64.rpm 54ffc3882264b9d084835694c0192f6461b21ccea2a5cafe9d0fc8180bc18d6a ALSA-2025:0422 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update for AlmaLinux 8.6, 8.8, 8.10, 9.4 and 9.5

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) Bug Fix(es): * The AlmaLinux OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later AlmaLinux versions (AlmaLinux-73867, AlmaLinux-73871, AlmaLinux-73872). For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default java-17-openjdk-headless-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 07e195bb38d9ec1bdf342060772d26ad2ce921ab8596f89ce243f21db59f2a54 java-17-openjdk-devel-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 1a96de0eafd8ef257ee4049f25775858ed2d5d2775950c5d4f9682096c118e15 java-17-openjdk-headless-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 4c03fc39bc769bd6507b631a1a113ab5f4d9e8ad0032af9dd1595a02bc4c4786 java-17-openjdk-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 4f3ce804672351cbe8e5ddb8290b7dc88f4d3e172dd8ca09e0a3ff0474a95635 java-17-openjdk-src-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 762dbcc4ebbff4783a13102b8da00e25c83b6ac484ff3bece68583ed8237623b java-17-openjdk-src-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 7cc44fc17e88ea6b4cc2cf3084c95a893d04bb519cd7270ccd41d3d31f54402a java-17-openjdk-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 8e9623cf4be7afbe9f05752bec1470677c2959af2fb91811f997046154976350 java-17-openjdk-demo-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm 9c78e27bc53962ad1e1b1ac54bf7fef2620c489f627de4dd28ff3cdc6eac3351 java-17-openjdk-demo-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm a32beb4b9bcee606b20450ab98d135b9407bfe4b6f5c4203174537414a953e2b java-17-openjdk-static-libs-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm a8ad32ac7f2e7712879db3c17745e97b23a7a69b5004e5fa6946e11b56e3ea8d java-17-openjdk-jmods-slowdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm d77fb930307ff6ee20c43ba23e89b2fa0b0c6c5616028643ff1bc296be8b44ff java-17-openjdk-jmods-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm d97b387f547a89aec1df20c081ed2c7628fd2f48dc85b232a99d808524fc9cf7 java-17-openjdk-devel-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm f06b65ecdb297f382f67a8e03910b89415f12e4f2efac810217506236ba9e490 java-17-openjdk-static-libs-fastdebug-17.0.14.0.7-2.el9.alma.1.aarch64.rpm feb60abc6c5cac4c9d8b5cdbf4d608120f75bf1029c28c53a10f1e48d3ff9017 ALSA-2025:0426 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update for AlmaLinux 8.10, 9.4 and 9.5

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default java-21-openjdk-headless-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 020decda8f837164a2d2991252df2c4f09917786383b12429b6d849a407015b6 java-21-openjdk-src-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 1a6b7e4793832412f862b460f3eadf5dad7967e35a23f3493843a6e527c70966 java-21-openjdk-static-libs-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 2f854a49cf451fcb44dc1801097f71707eb0d449dab8815d6e8818b3ed630a14 java-21-openjdk-jmods-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 33842a91ba42975c23504184fe2438f45db0cb22a1bdfa700b7441cbe303be52 java-21-openjdk-jmods-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 721df69248e4466756193f55aaf3184168bb6fba7529aae94085a116c107e778 java-21-openjdk-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 7573c0d1eec13de88b25580d3e5cf83a047a70f940195b1fd90fa530e6acc019 java-21-openjdk-static-libs-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 79f24dc33d146e39c5b8297cbe7b0ea037d357ab7a6576bae4e2f936424aa674 java-21-openjdk-devel-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 96f4c61d9a17b7430a146d3382b16fc03b7ab5b0904edd449f1a43427c80881c java-21-openjdk-devel-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm 97ee918da58d1e8d41dd9a542d6acc77d215d6b6b01bf6df00fe1985534cd05d java-21-openjdk-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm a7e35f765bdd6bf0a32c81a5013cc4908de2faf9bdf5438c3c5d3ca1ad516b28 java-21-openjdk-demo-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm ac9296f8a4bcbd605d53af278dac6813e6cd2a35f98df8385f97a899b723e62f java-21-openjdk-headless-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm dbe8cb3493c309b7b108d39ddf3525f948b631db19b583bc77b2bfc3274884f1 java-21-openjdk-demo-fastdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm dd813557e98dbd197012ea9b0f5212d88a246d596658d38af1ce850dd923dc52 java-21-openjdk-src-slowdebug-21.0.6.0.7-1.el9.alma.1.aarch64.rpm e55693d28a324049a6b99ca948dee879e57f8a65b6fccbabb16d701efc38cd1a ALSA-2025:0578 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp/dccp: Don&#39;t use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154) * kernel: arm64/sve: Discard stale CPU state when handling SVE traps (CVE-2024-50275) * kernel: i40e: fix race condition by adding filter's intermediate sync state (CVE-2024-53088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-tools-libs-devel-5.14.0-503.22.1.el9_5.aarch64.rpm 0a667fc44ead40888fa0b7c3249b90c74f773e1bd1b434cbdfe6d4b355a0e9f1 kernel-cross-headers-5.14.0-503.22.1.el9_5.aarch64.rpm 77578daef03248373e72d9e934d5356ee9fb506d0df46cbd976fbbfc19ffb843 libperf-5.14.0-503.22.1.el9_5.aarch64.rpm cda111bb05716846092e7e48970ed9360fbe932b0551288199ddf37101a74d3f ALSA-2025:0914 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22084) * mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024) (CVE-2024-21096) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default mariadb-test-10.5.27-1.el9_5.aarch64.rpm 0ec69c3cf460f0c5709450063378aaa4b494b7bdd8ea8f10d9877c9122a33c02 mariadb-devel-10.5.27-1.el9_5.aarch64.rpm 0ef29bf478c0490b12cec62933a550a6eab3db969b676ec6172cfa6ffc7a0617 mariadb-embedded-devel-10.5.27-1.el9_5.aarch64.rpm 1f117d63e5e0021c5ff887a6d0f8ab3a80522874aaa6219e1abdb4d36293c736 ALSA-2025:0936 Copyright 2025 AlmaLinux OS 0 1 Moderate

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default mingw32-glib2-2.78.6-2.el9.noarch.rpm 128871448c9b21e7438cc3cd483f74cabf6ad09cafb61734200e78dde1ff505f mingw32-glib2-static-2.78.6-2.el9.noarch.rpm 14c2bcca8f6ae2d21d055d6512d0ab1fa9240841b82a53c8867c02309045b42c mingw64-glib2-static-2.78.6-2.el9.noarch.rpm 80af2ec3a3e874c32f2aea0701782b80a34937781e0e90351ad79d08faad2031 mingw64-glib2-2.78.6-2.el9.noarch.rpm 8db5e55d188be13f2170097af43b9038911ee0712db69a4a9363fe07c8ff5010 ALSA-2025:10136 Copyright 2025 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3-debug-3.9.21-2.el9_6.1.aarch64.rpm 290414934c376c86792e517bf1820d761eca8d64df07468d6a7327b70fe05dff python3-test-3.9.21-2.el9_6.1.aarch64.rpm 49c9e8cb1ed614eec2ae44be614a6f049e55e3d8417619079ee3ed56535265b8 python3-idle-3.9.21-2.el9_6.1.aarch64.rpm fd0e4fcb465d7b918a7bfeffbe6c596a20f5bd39aabf939375daf2fed6c1bcaa ALSA-2025:10148 Copyright 2025 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.11-test-3.11.11-2.el9_6.1.aarch64.rpm a4f6562553dbfabb7b3d7a83b09f1054adc3b8e46995ce258ffb294d8a0b6550 python3.11-idle-3.11.11-2.el9_6.1.aarch64.rpm c782019747b5cd3e38dd668bc33897e093bd164db9f87032f466f55a45c0956c python3.11-debug-3.11.11-2.el9_6.1.aarch64.rpm c9254527646be7b96e2f65191c863d5265f39c8bed11e572e7097c0406d59b44 ALSA-2025:10189 Copyright 2025 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.12-debug-3.12.9-1.el9_6.1.aarch64.rpm 00a31f92c2f9c532caef5a390e3333f3317dc72bc02c821b5122e0835c8cb327 python3.12-test-3.12.9-1.el9_6.1.aarch64.rpm 13b69787b4c508967e03449701eefe1fd1176e3dcfd4be52a9f99cc93a996c50 python3.12-idle-3.12.9-1.el9_6.1.aarch64.rpm 24d00d8b61ff021d183d1cc55e9df29c3ffea3b51380ece425b3d0c5bf47e41f ALSA-2025:10379 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887) * kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004) * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846) * kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.25.1.el9_6.aarch64.rpm 3f35e262d551f135b6fa246dc8ef030cf790bd7e0ab58e30433dbb56434f9ecb kernel-tools-libs-devel-5.14.0-570.25.1.el9_6.aarch64.rpm 4a2a2729c97e1502ee5a824014ddf0617f7f48ea709c513967a4a41ce5ab404d kernel-cross-headers-5.14.0-570.25.1.el9_6.aarch64.rpm 68e80741710e92cc06363051d9acd6eb02c696d17177b4c9ee57456d8722b690 ALSA-2025:10585 Copyright 2025 AlmaLinux OS 0 1 Moderate

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337) * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default jq-devel-1.6-17.el9_6.2.aarch64.rpm 9ce84d6f1d1e3282d818288a870d64f6016110a03f8e26252b85753a65c90734 ALSA-2025:10837 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.26.1.el9_6.aarch64.rpm 7b465fcdc544572dfdb1de6f02aef9dff4da5e28b416fea8bf335c59987a53dc kernel-tools-libs-devel-5.14.0-570.26.1.el9_6.aarch64.rpm 7c63f2083eb762f59f8c18551823bc24fa4aa94626f4e8f32a8aa018b286e9cd kernel-cross-headers-5.14.0-570.26.1.el9_6.aarch64.rpm 81922534087a9b7ea2764e173527f69b67372640dd4bade6f871dd4e480ca069 ALSA-2025:10862 Copyright 2025 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve scripting supports (CVE-2025-30761) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to -Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method's behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (AlmaLinux-102904, AlmaLinux-102905, AlmaLinux-102906, AlmaLinux-102907, AlmaLinux-102908, AlmaLinux-102909, AlmaLinux-102910, AlmaLinux-102911, AlmaLinux-102912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-1.8.0-openjdk-demo-fastdebug-1.8.0.462.b08-3.el9.aarch64.rpm 1aeac0bd73786238db0e8e1dca1c233f4403116a75088c11ee431d64ffd83bec java-1.8.0-openjdk-headless-slowdebug-1.8.0.462.b08-3.el9.aarch64.rpm 3e0482283ee2e3642d047378281c854593823d9a4a20faa7c2c0d1f5a54b1f02 java-1.8.0-openjdk-demo-slowdebug-1.8.0.462.b08-3.el9.aarch64.rpm 527a7ee4fffcf6ad43fd62136f41127c6fbd47f132f9b8268396f0e819eed662 java-1.8.0-openjdk-src-slowdebug-1.8.0.462.b08-3.el9.aarch64.rpm 6d25e17e38d5e5586c18be208c99e5661936cf5c87f4a88ffdc08e6893e318d0 java-1.8.0-openjdk-devel-slowdebug-1.8.0.462.b08-3.el9.aarch64.rpm 7ecf78743c134f2d2c4f0b1f506cab6f1bf4d9084a0410c68e33a40dcb5da8f8 java-1.8.0-openjdk-src-fastdebug-1.8.0.462.b08-3.el9.aarch64.rpm 8e52579f6cdea55f69798d06fbb5f8f568801e225341a205145f550bee728522 java-1.8.0-openjdk-devel-fastdebug-1.8.0.462.b08-3.el9.aarch64.rpm 9730af3ed6cf7d7bbb271d0cd0df10840f168766fbdb9a10851e6691ae4af9cd java-1.8.0-openjdk-headless-fastdebug-1.8.0.462.b08-3.el9.aarch64.rpm c5cac7042fdc40f9bab8d5d57bce71394cc1f88be91b633c44f145a7639f707c java-1.8.0-openjdk-slowdebug-1.8.0.462.b08-3.el9.aarch64.rpm d453a6ec8a91d87c6719d7961968bfed4d9c39eca9989765c911a99bd65d6a6a java-1.8.0-openjdk-fastdebug-1.8.0.462.b08-3.el9.aarch64.rpm d8edb9fb9a72eb6131f6f765c48408d91f8593e6918b2deac8736e9700ead138 ALSA-2025:10867 Copyright 2025 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102668, AlmaLinux-102669, AlmaLinux-102670, AlmaLinux-102672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-17-openjdk-devel-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 0dca31d586d544fa6ab763fb131dc9a2cb6bd2e0467608e80bc5924b503f144b java-17-openjdk-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 1b5ec9c972418f720411ef96cda088bb601ed9a04a07d06bc313fbecd89973aa java-17-openjdk-src-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 208a822b7624ff1265bfeccd135874c6fd330528f5ebc2a3f8c92a642576a4a5 java-17-openjdk-static-libs-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 2e36a3829202983ef0da23cfa75744979099ec46435e18340c01b3a1f358dd15 java-17-openjdk-static-libs-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 3aebf1881714c17d5d203af88637a9f7cb661c886a6425bdce0dfb2491be938f java-17-openjdk-demo-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 53e62ce394dc90bb909e912eb7c57b3e94c58128b00d7319053da71defda64a0 java-17-openjdk-headless-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 7b9b736757eefc7c2540cc295b5403170cc2e32052dfe73f1ba7198aa12f1d5c java-17-openjdk-demo-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 8016265a383a8e8a1fec70b913856aa85b57114bd950f631e5aaea2ad332fcbe java-17-openjdk-jmods-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 810db8f34e6bbc730e90cc8cb63e0d766a5e432dd2a17f435cadc541d59fb8b9 java-17-openjdk-devel-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm 9cdac9650c3e2ab10223bc4f210ef38c7d58505ea128291a475c72091b112084 java-17-openjdk-headless-fastdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm cbabc692ed02c661eef700440fb0069aaed9fb7f299872f147ee0d7f0bc37086 java-17-openjdk-src-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm dd195425c52a4e6ae1adc283782703ac9bb81b8b9f2580719ca27a79b35606d5 java-17-openjdk-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm e979d6681fa355f443bd17f1bf3d5de1e8a724a75826f5c4cda653ca3ab465c3 java-17-openjdk-jmods-slowdebug-17.0.16.0.8-2.el9.alma.1.aarch64.rpm eae783728117da75483bd4eef6b9c49e5017d69d063e3f97a390658a8efd535f ALSA-2025:10873 Copyright 2025 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-21-openjdk-static-libs-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 076d0eb138c2cdfe7234da79ce41d0dcd97a9c8af951a1f352fe3cba13a2c2b7 java-21-openjdk-demo-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 18a469f96b901d4824ded497be97a57ab8ce5349a2718c24c1cfe72536b890d2 java-21-openjdk-devel-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 2db47d2ba6796bcfd9d63a8fef363bec81111c4dd5f0de3cb0e41f6978c38cac java-21-openjdk-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 3d642b729797a59f7da649bfddbbf2b9b0851629d8c841810bbc34f39e2bf650 java-21-openjdk-src-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 5298c42b1cee6564a64d7908394c1452cd875304820fcab193cacc50fca2aa3d java-21-openjdk-demo-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 5b3110ca7382e0fadd613b39e684ee76d0d4b7b2b1ac214b2aa73d984f4230be java-21-openjdk-headless-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 6551f3ad788524fd9732fbfb6b9eaea635bd77d18018ae515b2fa3430b51e043 java-21-openjdk-devel-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm 8116d289927643e8311599f13705a7383e294259ec7cf929c37faa64e7ccf6e8 java-21-openjdk-static-libs-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm a2205910048b4fcfbb1c2ad323e42954ee1cde08db4a0060e9b4a23a9664297e java-21-openjdk-jmods-fastdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm d079e98925447fcff4be36efbb5bafd3b764af16ef695bf0dbc87cf7954eb8f8 java-21-openjdk-headless-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm d62e8fd08c2e09e516a135a1f358740e477e4d8b120231a74027db0fb484aff3 java-21-openjdk-jmods-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm e81e3b843d6542bcd8be75cb10e5f2aefdde160365f1d547cbeb0a0bff532dcc java-21-openjdk-src-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm f7ccf66500aaa19a4b07f3dac8898a211eaeb0f3c8a65da6bcfd3aaea50e108c java-21-openjdk-slowdebug-21.0.8.0.9-1.el9.alma.1.aarch64.rpm fffc445391e18f335303178345ec22691e242d56fa32c4e7b96f98f561267a52 ALSA-2025:11140 Copyright 2025 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) * glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default glib2-static-2.68.4-16.el9_6.2.aarch64.rpm 147f625abca8d3c0a298541a528bb2a51224d1872bb35b5d3e0ce07b101915bb ALSA-2025:11411 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.28.1.el9_6.aarch64.rpm adf0ce3cbee5c7d373a947eb504c0db7fcf57230719791b4b8a5ab5653683807 libperf-5.14.0-570.28.1.el9_6.aarch64.rpm d43fd47d183f82c843abd4b521735c455207bfbf72b4405c794a27ca07e35081 kernel-cross-headers-5.14.0-570.28.1.el9_6.aarch64.rpm f4eca397a1a046fd1c40412b1bb1572b6e106f9ede80c9b87b88a3e926a0cc2b ALSA-2025:11849 Copyright 2025 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default unbound-devel-1.16.2-19.el9_6.1.aarch64.rpm a3b9033f6f06eaae12c561721bb70f2f737f1c09757bb6f8852b9248032040f0 ALSA-2025:11861 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091) * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.30.1.el9_6.aarch64.rpm 313e6b14347f98176b8b9393240cecdab0a33391f35f5a5934e1e8499ca1ef50 libperf-5.14.0-570.30.1.el9_6.aarch64.rpm 645561da899846e0248662dec657c7cfc6110cf32e787c6afc5d526843a2657b kernel-cross-headers-5.14.0-570.30.1.el9_6.aarch64.rpm b53badd110fdf2301541a8919f78d3e78a92c328820bb16d0bec33d21c31c1fd ALSA-2025:1262 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-tools-libs-devel-5.14.0-503.23.2.el9_5.aarch64.rpm 0ae383d5b1e97cf6c21c7062a9e9e100d7feccfd0c033569685d12d3c3c8c606 kernel-cross-headers-5.14.0-503.23.2.el9_5.aarch64.rpm 5d26451006680c6abe6c5cee4dd36cbc64e9240fe6214210504aa1c74aeebc63 libperf-5.14.0-503.23.2.el9_5.aarch64.rpm 88fa30027941bfeb4cca693e80803cfb2f7a93abe685e32081231d78b55c6d6b ALSA-2025:12746 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.32.1.el9_6.aarch64.rpm 2256908760188d7a2c81a9f60e504352c8956cf4fc332bf411136d77a78a290f kernel-cross-headers-5.14.0-570.32.1.el9_6.aarch64.rpm b8acfb7774fbfb05fa9e435e9e31d3d659e9077ef3d8678932be80a272eb18a4 kernel-tools-libs-devel-5.14.0-570.32.1.el9_6.aarch64.rpm f7b5fa1a824c4c6899e31088b64d84f5cf0ff335f6ffb912b00b4938b239dd53 ALSA-2025:12834 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12-setuptools security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.12-setuptools-wheel-68.2.2-5.el9_6.noarch.rpm 83201e0efc35e4acac2f56109e56c0bfecd0dcf82c365da609724664ce30f19b ALSA-2025:1329 Copyright 2025 AlmaLinux OS 0 1 Moderate

doxygen security update

Doxygen can generate an online class browser (in HTML) and/or a reference manual (in LaTeX) from a set of documented source files. The documentation is extracted directly from the sources. Doxygen can also be configured to extract the code structure from undocumented source files. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default doxygen-doxywizard-1.9.1-12.el9_5.aarch64.rpm 7eb784a0e338ecd9dfeb43485660d242a2790794adc77b3b5c1c92251f84b66d doxygen-latex-1.9.1-12.el9_5.aarch64.rpm d1fc7c626fbc5216c607f408e5ee321c69e7d955d2bc9d433ec95566ee3a83cd doxygen-1.9.1-12.el9_5.aarch64.rpm eb5d034202345893bedc8d25f8dddf11c44a0929afff5c0c7a1703bae8fb073e ALSA-2025:1346 Copyright 2025 AlmaLinux OS 0 1 Moderate

gcc security update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default libstdc++-static-11.5.0-5.el9_5.alma.1.aarch64.rpm 233e688caafef78368cae17021aaa1839d25b5607bf0b815fcc7abe55e3cfeb0 gcc-plugin-devel-11.5.0-5.el9_5.alma.1.aarch64.rpm 90e775cf1a7f7ecdec8c1085793c92f34d45fa0c80337ea28f48ceb510c8c068 ALSA-2025:13602 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) * kernel: wifi: ath12k: fix invalid access to memory (CVE-2025-38292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.33.2.el9_6.aarch64.rpm 4049d3b76954e1766633e122f11be4c5725462845eb2fadae7928f75068e31f6 kernel-tools-libs-devel-5.14.0-570.33.2.el9_6.aarch64.rpm 43f3943a7bee86816460f558216753e37650af05427b713394811cc3ef388840 kernel-cross-headers-5.14.0-570.33.2.el9_6.aarch64.rpm ba4014349d5a2efb2c4d1e0bf5bcc59043ab68d0c3ebbcda0fc9d7672ba1d66f ALSA-2025:13962 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867) * microcode_ctl: From CVEorg collector (CVE-2024-28956) * kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084) * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) * kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124) * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380) * kernel: tls: always refresh the queue when reading sock (CVE-2025-38471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.35.1.el9_6.aarch64.rpm 0fcb5c547fe83f43098798c22d520b652a087d4d2d7d9a7b9b4ae31d1229497d kernel-tools-libs-devel-5.14.0-570.35.1.el9_6.aarch64.rpm d010830e91de34456b7bb1b64dd56608b2ee6b52f02e403b2701ca85147f61b8 kernel-cross-headers-5.14.0-570.35.1.el9_6.aarch64.rpm ff20edb30a528f00986e11d3780bd68fcac906d7a0d08069a51256e5ad5ff0ae ALSA-2025:14420 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Fix memory accounting leak. (CVE-2025-22058) * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.37.1.el9_6.aarch64.rpm 441ee4135a45201399097f2aac02ebfa679a5d6ef3870db902077539da32f706 kernel-tools-libs-devel-5.14.0-570.37.1.el9_6.aarch64.rpm 9a61a6b8094f0180c9484f2a6c59aac36db1fdf17c6a1d50394bd75ff6b72e6f kernel-cross-headers-5.14.0-570.37.1.el9_6.aarch64.rpm d5bee011da2b476ad95d9387e9ee656e55615fd856cefa46bf56a66af4dcfb80 ALSA-2025:14878 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default postgresql-server-devel-13.22-1.el9_6.aarch64.rpm 05b9ca996f40a5ad77911117c9f11d91acb9cc445d6e389215081f36348711bc postgresql-upgrade-devel-13.22-1.el9_6.aarch64.rpm 2e4665c7e396561a1100987fb49fc05c140147c18d0a6b7e18d0727f9b6fc0af postgresql-static-13.22-1.el9_6.aarch64.rpm 605519cfcaf50897b0c74f5c9630ebac49b252d67afef5649cc1efc85ed36893 postgresql-private-devel-13.22-1.el9_6.aarch64.rpm 71cced2884545d4f9d4b3ae07d0053e1472f880610c45ead21c1f7994847b56d postgresql-test-rpm-macros-13.22-1.el9_6.noarch.rpm 88c18db9bf4a72203801e595dd0f50c658e931d0189ebe0d2fb782adc972a2bf postgresql-docs-13.22-1.el9_6.aarch64.rpm 8afd3554e892ba33e37edb7c211e0a6c29545d942af9a10e0efdc0405fc2c367 postgresql-test-13.22-1.el9_6.aarch64.rpm 9c91c12fc78c673bb73bac94167229e508a336fa476b98da928dd55ba2629d3e ALSA-2025:15007 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.12-test-3.12.9-1.el9_6.2.aarch64.rpm 2d55c352f1802fcaf0517454ef0f68a30e7f9ff35f638eb435d41725d949b267 python3.12-debug-3.12.9-1.el9_6.2.aarch64.rpm 31b3e75f243c2d26d78fd29e9c810c9c6bcc08dabdcee765d8de9b6af5dc139f python3.12-idle-3.12.9-1.el9_6.2.aarch64.rpm 8356f372bdf6aba5ac86e67222d2433f77044b29947e5069c0865165c1a3775d ALSA-2025:15010 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.11-test-3.11.11-2.el9_6.2.aarch64.rpm 2d71b0eabb25b492d9293be81dc3a9ebe7a256a57fc0305b24c5aec95a7d6ce3 python3.11-debug-3.11.11-2.el9_6.2.aarch64.rpm 6cca7f7e2f8f1b4c292ae04893dc7fc2dd47ac950dd6ae446978354be93ea735 python3.11-idle-3.11.11-2.el9_6.2.aarch64.rpm 705a6f66dcfd527d75e3a4cf5a624e8f09a2456c7e124813afa2eb6979215f99 ALSA-2025:15011 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823) * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461) * kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.39.1.el9_6.aarch64.rpm 4f68ad9ad7b3a49aa06f2359de3f6e42d4e1a7dc26747a796dcb8c49d9fb0cea kernel-cross-headers-5.14.0-570.39.1.el9_6.aarch64.rpm 64c0aa92f3f7927f8fe856da3aa43d0426f9474ce07161ecb416bd219c0caa88 libperf-5.14.0-570.39.1.el9_6.aarch64.rpm e62111124d9bc1b2164d2a69fe669b51c389099f406386472f363ed9864307b5 ALSA-2025:15018 Copyright 2025 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libudisks2-devel-2.9.4-11.el9_6.1.aarch64.rpm c69ecd581980c287a818b5b3bf8f1226fd9931b0f05437183232aacf6a64f01e ALSA-2025:15019 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3-test-3.9.21-2.el9_6.2.aarch64.rpm 0457cd864dd9e0245b73140ce63afb2bc20a9cb094c37cebee6f935b2a5fcac4 python3-debug-3.9.21-2.el9_6.2.aarch64.rpm d08fe682c931d21237380bf425fdbdbf32158cda0b18cbf5805bf7711fd9646a python3-idle-3.9.21-2.el9_6.2.aarch64.rpm ff12d34c2b094f6bbab133cac7514b7b769588b1218a2cd705f421a2dee20f01 ALSA-2025:15429 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.41.1.el9_6.aarch64.rpm 64b973f8c75f80befb8c50b5334f1707b0fac55be099a2c60a011c15174d4798 libperf-5.14.0-570.41.1.el9_6.aarch64.rpm 9f030b90509f025acbccaaab3e66a5a5928099e93683c3f92e12d90c563f4e29 kernel-tools-libs-devel-5.14.0-570.41.1.el9_6.aarch64.rpm f29866d87b141d3c2fe96e11cbcf24abc684f132466d2f7459f10aeb95b9a906 ALSA-2025:15661 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.42.2.el9_6.aarch64.rpm 935e8d23424af6cd8ef20946304628574be3b22377bb7de508141820897cd8a3 kernel-tools-libs-devel-5.14.0-570.42.2.el9_6.aarch64.rpm bea6b91260fc352a534adf8ecf68b9c03fea480b7237cabe6eb50ece38e4ae24 kernel-cross-headers-5.14.0-570.42.2.el9_6.aarch64.rpm e0bfde957f0c518cd51ee773b72485baefe1c0bc3376c29daa4227e365718476 ALSA-2025:15740 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.44.1.el9_6.aarch64.rpm 52e483adc124df0e973ba74a1df6625b371e96ddcb8e4b503b09da521af3391b libperf-5.14.0-570.44.1.el9_6.aarch64.rpm cac8c1fbdc82a963b656872039aa29cac677e5096a2c83b8e7ea0d8da1e5d382 kernel-cross-headers-5.14.0-570.44.1.el9_6.aarch64.rpm f2573f12526f3585c7773f1da108cae9ce41355cb79ff8e21cc1f5e774ff10a0 ALSA-2025:16086 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688) * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699) * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575) * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092) * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077) * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085) * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082) * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087) * mysql: Replication unspecified vulnerability (CPU Jul 2025) (CVE-2025-53023) * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084) * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default mysql-test-8.0.43-1.el9_6.aarch64.rpm 056df5d42ab78148043c263ca2f2bb47facd50c143ecba49d668b50bb46ee229 mysql-libs-8.0.43-1.el9_6.aarch64.rpm c35c9a27fde4a366bfd74bc32e0e63035a27133ef5c0ca2e5102bc1f87a66ad7 mysql-devel-8.0.43-1.el9_6.aarch64.rpm d825e597429c154335937437d3e42402a9a0c9265a9fc5c52f645cbe7a320a62 ALSA-2025:16398 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125) * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.46.1.el9_6.aarch64.rpm 2ee03f217df6faccea0b2a067319c4fa99a151b74cba283b7872df84fec19a67 kernel-cross-headers-5.14.0-570.46.1.el9_6.aarch64.rpm ac465b943872485f8199edea9fb2664bacc5e68a6d11569c78419fb86174b620 libperf-5.14.0-570.46.1.el9_6.aarch64.rpm fbcfe27c0de7b97b2518ba04148506ac8630a167dff8f94e6d0d43439bdb808a ALSA-2025:1659 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: mm: migrate: fix getting incorrect page mapping during page migration (CVE-2023-52490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.26.1.el9_5.aarch64.rpm 8cd43e2741f62fb41dad4f712ca5c27e4ccb12279dbb41ac94f2dd54206e4455 kernel-tools-libs-devel-5.14.0-503.26.1.el9_5.aarch64.rpm b7b334cfdb8af7cafa22469d48bf32fa191056c920ac90648efd51c46a2640c4 libperf-5.14.0-503.26.1.el9_5.aarch64.rpm bf76997c4a764ebda6874d7c1bcd1766302c2ed0349c777b1289c0dc7f7d29f0 ALSA-2025:1670 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVE-2024-12705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default bind9.18-doc-9.18.29-1.el9_5.1.noarch.rpm 77c63238095876975f73c8eaaf24d184ac4b256cba65b144aebfaaff277235c2 bind9.18-devel-9.18.29-1.el9_5.1.aarch64.rpm ee03d1a4ecb6c022b99bf850e9817ec28c6f290f4c24396b5a3427fe7fff730f ALSA-2025:1671 Copyright 2025 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) * krb5: GSS message token handling (CVE-2024-37371) * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264) * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238) * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241) * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231) * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236) * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237) * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203) * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212) * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199) * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193) * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198) * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239) * curl: curl netrc password leak (CVE-2024-11053) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497) * mysql: MySQL Server Options Vulnerability (CVE-2025-21520) * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555) * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491) * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501) * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519) * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559) * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523) * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default mysql-devel-8.0.41-2.el9_5.aarch64.rpm 017ef38b485a7f976215b1d53b4e547ce2a57d1be891ed810b20488110c47d0e mysql-libs-8.0.41-2.el9_5.aarch64.rpm 5e74671f2d4e3d801a9e5d7e69af1c0f943099c3d88148464952fb64c8aad93a mysql-test-8.0.41-2.el9_5.aarch64.rpm dfa3ca754f169ba43f4266bb625ecc5c6964a416906c744531ed588feae9c4c5 ALSA-2025:1681 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default bind-doc-9.16.23-24.el9_5.3.noarch.rpm 045097af79111a6f6690a054d83f198561c6696a82ba817f9b4b1ca59004895a bind-devel-9.16.23-24.el9_5.3.aarch64.rpm 9f0dc26482f1e9f3cd1a96f68efb727d9ad3f72e1fe2703b6a9e7ebba466b688 ALSA-2025:16880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472) * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) * kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682) * kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.49.1.el9_6.aarch64.rpm 5860b20cbe45da26901c1f6b0587cb0546dc7121c58868159c07e13f9d4b1fbd kernel-tools-libs-devel-5.14.0-570.49.1.el9_6.aarch64.rpm 5e35ca0400333333827f1ea09e999a64d965fcfc32bf17d97af74232c48de5e2 kernel-cross-headers-5.14.0-570.49.1.el9_6.aarch64.rpm 9a278cae8506096e22c77d804990e7f7439419b245a4820598df5057c61c78e2 ALSA-2025:17084 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.5.noarch.rpm f11bab0e5d897b89c5f9cda819ac846db881e4a46077033f48563660e1fc9dd3 ALSA-2025:17162 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fix(es): * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default perl-JSON-XS-4.04-1.el9_6.aarch64.rpm c6acc2cac70223b0a9c5f3ea97fd4dab80606960e65e2818d9028a9c68f47b02 ALSA-2025:17377 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301) * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.51.1.el9_6.aarch64.rpm 3cbd2f34ec66f537ec210ea5ea4c16db8ceae64489a0b9b912cc9a9ce5644544 kernel-tools-libs-devel-5.14.0-570.51.1.el9_6.aarch64.rpm 4c6bc35adafe39aadfd3c102f38ebd5076218f6bf1d55ebf7fe3b3367b2b1e0f libperf-5.14.0-570.51.1.el9_6.aarch64.rpm bafe905296dc65c5368f94ca51d0ef6b04ea8d55cdbb37cbedfa9899fe561922 ALSA-2025:1742 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default postgresql-test-rpm-macros-13.20-1.el9_5.noarch.rpm 167bf6673ce0e88f70019e49d0937948c321511b6c62d9f015003e4796450bab postgresql-test-13.20-1.el9_5.aarch64.rpm 33ea7007efc3cdb694ecfe95fb8fb64fc38dbbbd89d219fa400dff3e37ccd53d postgresql-upgrade-devel-13.20-1.el9_5.aarch64.rpm 4b6fa131fa29243f7c3a06b505ed0e7ff84d2c4b46f49ab90b49c7895c4c6f28 postgresql-server-devel-13.20-1.el9_5.aarch64.rpm 87f9b496233a8e31a8903a700139478c684bd30402de1cb97e974def2cb21352 postgresql-private-devel-13.20-1.el9_5.aarch64.rpm cbbd5cf7e8856d6aad4a0f87d70b5c28f4e6a9aabc75d876833349efb8ccdbd2 postgresql-static-13.20-1.el9_5.aarch64.rpm e4e180c2c01b4ae0dbf70a7385c2764ab23887308340bf82d1ca0d87d10a7cba postgresql-docs-13.20-1.el9_5.aarch64.rpm e6aec80684713289eead56794efaabe00237381c93f058b0c847785b49ac7158 ALSA-2025:17760 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614) * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.52.1.el9_6.aarch64.rpm 19dd1e071af7e2d6c1f5e6dbd5ea52eae90b3b3256ec359412f7ed23350b5129 kernel-cross-headers-5.14.0-570.52.1.el9_6.aarch64.rpm 7e09b27cc6201ae05ecfabda113f826bfc05bf9e05b363e5722383f1ac90a15f kernel-tools-libs-devel-5.14.0-570.52.1.el9_6.aarch64.rpm daa6409cfc64a08734d96a9d744dcdc3e2ab661c723bdbcf162f206fc6ae6398 ALSA-2025:18149 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6.aarch64.rpm cd8353ddab531de76e857fa84c1740d6dee2b71ef078b66905b681f4bfabdd2d ALSA-2025:18151 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el9_6.aarch64.rpm aa6f9deacc419917ed9343ebe5767c462c722f48d7affcfbfbbb5b20c99ca9d9 ALSA-2025:18281 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087) * kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571) * kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566) * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849) * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.55.1.el9_6.aarch64.rpm 70956335a3270c11b31ffeb5095831deedc4471251ba31d8e894bf5c56f71cd5 kernel-tools-libs-devel-5.14.0-570.55.1.el9_6.aarch64.rpm 7646b5c754be04725e3eceb903f70dd478c5fed329ade713429658c46719e5ad kernel-cross-headers-5.14.0-570.55.1.el9_6.aarch64.rpm aed6170c62263a9422b1b0f8cd304adec5b2587f85783ad58c103b8daacf2cdf ALSA-2025:18815 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) Bug Fix(es): * Since the 8.8 release of AlmaLinuxand the 9.2 release of AlmaLinux OpenJDK 8 has used a single build repackaged for each major AlmaLinux release. With this release, this same build is now also used by the following older releases: 8.2, 8.4, 8.6, and 9.0. On AlmaLinux systems, this means that OpenJDK's FIPS mode will now be enabled by default when the system is in FIPS mode. To revert to the previous behaviour, use -Dcom.AlmaLinux.fips=false (AlmaLinux-118777, AlmaLinux-118778, AlmaLinux-118779, AlmaLinux-118782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-1.8.0-openjdk-src-fastdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm 143d9b5d0b23940a949d5a89e6c7a942d1f7e65b743305afa72c425658f7aac9 java-1.8.0-openjdk-headless-fastdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm 55900a3a9bcf7364aef6170386231431f9c507c3fa742637f8f9f43307c9c2c3 java-1.8.0-openjdk-headless-slowdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm 66e66e119e515fdc6b9703cf26c6395f152676942ca77c7dc5b2f6d2fe0d6126 java-1.8.0-openjdk-demo-slowdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm 6970dbccdb66207a5560deb1d1374456842367981a83b0c59ef2d68462309c5d java-1.8.0-openjdk-slowdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm 8b00ae66dbf93c3a2b475dd2adc26195a5d9e2616e0e2508b5b8dc14c4b906e5 java-1.8.0-openjdk-src-slowdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm b6d90839dbd4ac902d789b51fc1f5cc5f5bdbc43885419e17d6dc4d2e32f7afe java-1.8.0-openjdk-devel-slowdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm be197e687872df7f84d2907bf284dec0d3092966c7fcf0ce191f17089d7c4ee4 java-1.8.0-openjdk-fastdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm d3a2ecaee964ea0ac15fc5e9b530110bd88ddb9b4023340f5c42f87712598f79 java-1.8.0-openjdk-demo-fastdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm ec1294302ebbc348355efee1a5cabc453d223113e80b537848b05e771c9b62ef java-1.8.0-openjdk-devel-fastdebug-1.8.0.472.b08-1.el9.alma.1.aarch64.rpm ec2c3af68842748d55337be9f4e91d29baa0984e1eaefdf2e3f73e18970f579b ALSA-2025:18821 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) Bug Fix(es): * Since the 8.8 release of AlmaLinuxand the 9.2 release of AlmaLinux OpenJDK 17 has used a single build repackaged for each major AlmaLinux release. With this release, this same build is now also used by the following older releases: 8.4, 8.6 and 9.0 (AlmaLinux-118788, AlmaLinux-118789, AlmaLinux-118792) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-17-openjdk-jmods-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 1d506787749e9cf8e27e1179ec490045f4504500031dce5263f73bfc8631ec4c java-17-openjdk-static-libs-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 3022cc1fc11978494fa5b34e33292b116f9ccf4bbc2f30bb6b97edbc91d9c99e java-17-openjdk-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 30662d3d9b3ead0a10dbce0ede187adad42654a68b16c25eba1c16a89a175e53 java-17-openjdk-devel-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 3cea5e1b17e839a6b115182ac43a6f3747d058819fb30650510aeb2191216364 java-17-openjdk-demo-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 410f5dcd1e9e0ba619dcf2344103fa8b4aa7d88b65615736eb402485f61a4653 java-17-openjdk-headless-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 422e6374f90c3970c0948315a6cfd93b93f4c87ee1304b25fb73f76aa5d9727f java-17-openjdk-devel-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 813412d1b320f7ab597363ce0ebc922a094f36b82d538d49724ea690caae88d8 java-17-openjdk-demo-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 83401d0af803b7c5625741cdc94e7a30606bfb4f1cc92ad2a6256b4138acb263 java-17-openjdk-static-libs-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm 94d9e312fa77962d405a4ad390cf2f775a6981fae448dc785741adb75f8453e3 java-17-openjdk-headless-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm a2037dd52db12aea87374b9201f67268710c4bf92e47d7e81d90c94c36037795 java-17-openjdk-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm c15712c819c0fa485d929c7b62cc40c101a34548e59fbe016614394066a6e635 java-17-openjdk-jmods-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm cb6fdde1b15bb159b02b790515ab4adfc2ddc8086396506b60c74aac75e4033b java-17-openjdk-src-slowdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm fe6cc9dc7f07416483fd688186048e3edf29143e5949199ee8c98b4fcc69e219 java-17-openjdk-src-fastdebug-17.0.17.0.10-1.el9.alma.1.aarch64.rpm ffb2a4e11efbb8c635d0cca60ebd82af3fb6f29b45ffa65eb8727d5f20233797 ALSA-2025:18824 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) * JDK: Enhance String Handling (CVE-2025-61748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default java-21-openjdk-demo-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 0487c59499321f4121c712bd7b7d40bc15c668f1c20292277c42f467fc6f9267 java-21-openjdk-headless-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 09ba9e6b1abcd678640609943afd8b7f9fc5f2cd5278f2b8fc6d5be015784047 java-21-openjdk-devel-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 2689d620f741dc0eb7a04c50a058262e4d7b3d04343bcfb52f0bda4efa4b73b8 java-21-openjdk-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 2e8336ca3d06ab1ea795d43f971c9921b138df698e3b143f8252e874961bb93b java-21-openjdk-jmods-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 41439f8ee3f131469929db6965630c1185f9bebf723456e27221b8230d16f514 java-21-openjdk-static-libs-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 54aa2e6e4edc0ea168564b52c93c9f205deb1eb676a683d6039eea75dc6379be java-21-openjdk-jmods-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 6b381814eca08d5fdca46148470e43f205ba5dd929a346f9fd51b82b97ed2927 java-21-openjdk-demo-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 71180adab2f0c92e543695a10f77fd5d56cd90f3f23944742bddf3ddd3c4dd54 java-21-openjdk-headless-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 72d7a652561ace5265a47b00342fafb2eb04da20f4bf73bcea0c5e38e7ec5038 java-21-openjdk-devel-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 77de7ee70f7e44bfe9f40289bc1358dcc15f4897ae622b021911c6c4a9ec35cf java-21-openjdk-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm 97c8b653a40f0cfd01e7ad32e86c7ca89d6f8dc23344dcda8f3541236f8e167e java-21-openjdk-static-libs-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm a69ec3c453d32523648371b0697753edd49837fabab37d5542ec106f3c7e2c88 java-21-openjdk-src-fastdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm cdf6a5f876ebf6eaaf867ef749728b26a6da7e86252fe542151fe73afa6ba7e3 java-21-openjdk-src-slowdebug-21.0.9.0.10-1.el9.alma.1.aarch64.rpm d0360cdb082c32086936b89e122ee6fafd6e1024e7719a927230ef5427577ed8 ALSA-2025:19113 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libtiff-tools-4.4.0-13.el9_6.2.aarch64.rpm 711cf90c33d7c879c3ac7474a0ebb75e970d8aef9643163e30fba555fc5fcfe9 ALSA-2025:19409 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702) * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367) * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.60.1.el9_6.aarch64.rpm 0dc3a5fd87e5494679f049c87ba602d85e6eb4b03ed9a27a4cdf8f7e181f6ada kernel-cross-headers-5.14.0-570.60.1.el9_6.aarch64.rpm 23995e8870e140ad76843d364a9945aa0aa592ad8dac48d5813b70625d5001a2 kernel-tools-libs-devel-5.14.0-570.60.1.el9_6.aarch64.rpm 77691ad0086bb98f1565221914d1c63b996d301c65a344c4969292d2ebd66021 ALSA-2025:19584 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

Galera is a fast synchronous multimaster wsrep provider (replication engine) for transactional databases and similar applications. For more information about wsrep API see <https://github.com/codership/wsrep-API> repository. For a description of Galera replication engine see <https://www.galeracluster.com> web. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default mariadb-test-10.5.29-2.el9_6.aarch64.rpm 09c34be4b76ac1cc663319e07a4effb3b3ccc1bc6d95943000db715c1dd7f96a mariadb-devel-10.5.29-2.el9_6.aarch64.rpm 492a3c8d112f12af06d149afc3c441943b5fe7c4401a9812df4c76cd8191ec80 mariadb-embedded-devel-10.5.29-2.el9_6.aarch64.rpm 91c5b676007e833593f3ceedb0e4f49d552a62b113e5a6365a7ee8f2e1e089a7 ALSA-2025:19930 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-570.62.1.el9_6.aarch64.rpm 089499b353b2b6bc063b322d2013cdc2b3d2ed17839d575d47b2eb6e5001e41e kernel-cross-headers-5.14.0-570.62.1.el9_6.aarch64.rpm 299f4b4f2045a6e397736b81ebdea9c6cab063dbb12d233f3f21725d5853022b kernel-tools-libs-devel-5.14.0-570.62.1.el9_6.aarch64.rpm ff5c101da69b3e9091fe5c554f8e08096cdc335911f5430c96f5c1d4e207f5cd ALSA-2025:19950 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default bind9.18-devel-9.18.29-4.el9_6.2.aarch64.rpm 22cd1b1e02143e36939baec0c2607d6a274228b5f2ac6ce23b9b51c17b75a943 bind9.18-doc-9.18.29-4.el9_6.2.noarch.rpm 96d3c97bb463ee4e457f2ba7e81f71eac1d9181a66f082476952e3305244b877 ALSA-2025:20518 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830) * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689) * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744) * kernel: vfs: fix race between evice_inodes() and find_inode()&#38;iput() (CVE-2024-47679) * kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727) * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864) * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060) * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024) * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195) * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294) * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052) * kernel: afs: Fix lock recursion (CVE-2024-53090) * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119) * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135) * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241) * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229) * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170) * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216) * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672) * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662) * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675) * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690) * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709) * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739) * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786) * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332) * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680) * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648) * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647) * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631) * kernel: zram: fix potential UAF of zram table (CVE-2025-21671) * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672) * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696) * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702) * kernel: usbnet: fix memory leak in error case (CVE-2022-49657) * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432) * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672) * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353) * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437) * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627) * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670) * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269) * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643) * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623) * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357) * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443) * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648) * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746) * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795) * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728) * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456) * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987) * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014) * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988) * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714) * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570) * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (CVE-2024-57993) * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729) * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989) * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015) * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998) * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739) * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786) * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738) * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986) * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726) * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791) * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787) * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981) * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790) * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990) * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765) * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012) * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745) * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806) * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072) * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068) * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062) * kernel: idpf: convert workqueues to unbound (CVE-2024-58057) * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828) * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083) * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826) * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077) * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075) * kernel: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" (CVE-2025-21829) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837) * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851) * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855) * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844) * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853) * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847) * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864) * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088) * kernel: acct: perform last write from workqueue (CVE-2025-21846) * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861) * kernel: io_uring: prevent opcode speculation (CVE-2025-21863) * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848) * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056) * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845) * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116) * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.5.1.el9_7.aarch64.rpm 2aeca2da0cf5adb1169fd5462ca53f53c007cc0d6c803756a470d9838dbcc22e kernel-cross-headers-5.14.0-611.5.1.el9_7.aarch64.rpm 5245b8502b1f9bda57fd3ad35b6ea31718b193d7cdf8eb308f1acbe922809d2d kernel-tools-libs-devel-5.14.0-611.5.1.el9_7.aarch64.rpm c7becbed69cf67d63d826ce4065e6261a5ad8b885f65d0ffa0b8322e7bb46e8a ALSA-2025:20559 Copyright 2025 AlmaLinux OS 0 1 Low

shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default shadow-utils-subid-devel-4.9-15.el9.aarch64.rpm 52c49709d41c782eeccce2c1e262c05309b3ffeab6e1edde060abc0ed18517bf ALSA-2025:20838 Copyright 2025 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default zziplib-devel-0.13.71-12.el9.aarch64.rpm bb61bcc87e24418d7526fed2bfaf27bc8393e61454d915f19e32a12c7e6c5093 ALSA-2025:20928 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-ipatests-4.12.2-22.el9_7.1.noarch.rpm 73735cb3f9e7836a82214b31eebc711a3dab45d846b482e539c88ccd41cc2083 ALSA-2025:20954 Copyright 2025 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libsss_nss_idmap-devel-2.9.7-4.el9_7.1.aarch64.rpm bf87b3290ec4e70d14d407d09c061d31c41ab85977d3c99e81a615fbf86ea5bc ALSA-2025:20956 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.2.aarch64.rpm 61c4b59e34cfaaf6b128a6fce67d767be090e56ad68b2c1758ae619e3fac4368 ALSA-2025:20960 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-5.el9_7.aarch64.rpm dec942d174566bdedc8e0c93f8e9554c7bdcc4017938a91cc6b5d91cbab23924 ALSA-2025:20961 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default xorg-x11-server-devel-1.20.11-32.el9_7.aarch64.rpm 4c646a500f1a303b4ab56d872c8681492060fd415f3a08a64f9eb6582e26724a xorg-x11-server-source-1.20.11-32.el9_7.noarch.rpm 95e1253a06af7d378305502d5dbb69dbe4f15e3169d304ac2956aa023e59f083 ALSA-2025:21110 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default bind-devel-9.16.23-34.el9_7.1.aarch64.rpm a9641e712e9319beade08b7ec472dac3cd5a193c959da6e5811cc052335e3330 bind-doc-9.16.23-34.el9_7.1.noarch.rpm d5fe5e92ce924c40cfb8e5ffee39962cc0864de759ade57a74b9aeafe5b15352 ALSA-2025:21111 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default bind9.18-doc-9.18.29-5.el9_7.2.noarch.rpm 3e89b39addd198c4c8835a6dd4053f4cd2690e3e639cf581ebcd64478a751bd8 bind9.18-devel-9.18.29-5.el9_7.2.aarch64.rpm 674cc3a154417043359b2b861b7f07411a08525453a292f7da38702c44f0e098 ALSA-2025:21462 Copyright 2025 AlmaLinux OS 0 1 Critical

lasso security update

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fix(es): * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default lasso-devel-2.7.0-11.el9_7.3.aarch64.rpm 056ef86a0f57d77e11b284e88107e2e63b24c9379883c9995d096ddf84ad2d21 ALSA-2025:22405 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.11.1.el9_7.aarch64.rpm 22ca31e53beb434ae1b7ff7ef159ed99069bcc2a702052a3d41187b3b232d9c3 kernel-cross-headers-5.14.0-611.11.1.el9_7.aarch64.rpm 407b6ae5bc66c82704ffcfde68380a77b8d64f918e1809d6c3701821bbc7a9e8 libperf-5.14.0-611.11.1.el9_7.aarch64.rpm b0fb06a95c23ab31845baa06ae11957e45dc5b1d148b0874014c5bcc9df10fa5 ALSA-2025:22865 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.13.1.el9_7.aarch64.rpm 371c335a9be89462c5fc7b7067ba713ef54e5f91d2516f873c5817da77533229 libperf-5.14.0-611.13.1.el9_7.aarch64.rpm 5218e17505a581e58f059af4eb4441266bf22370654b9deac084c0cdfe087409 kernel-cross-headers-5.14.0-611.13.1.el9_7.aarch64.rpm fbbffbe587f45900fe6a2a19c31075d1cbe8212f3876862f54272f8dfae79457 ALSA-2025:23109 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default mysql-devel-8.0.44-1.el9_7.aarch64.rpm 0983c7645e3ce3a3a1503eb2a7a1c715905cae5a6631f3474a70cb6c77c4bcbb mysql-test-8.0.44-1.el9_7.aarch64.rpm a36619b4111098b507772ad4a3a9ca414b3af401069a0236c4bb982cc9fe33aa ALSA-2025:23142 Copyright 2025 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default wireshark-devel-3.4.10-8.el9_7.1.aarch64.rpm 6444a398deaa21f15000c36ed689aa2705aad7f8b8f95349f4109d70a1d618c8 ALSA-2025:23241 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499) * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966) * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.16.1.el9_7.aarch64.rpm 1befc470d33d5752cf79d88f87c5b4b99f2048dad1cc802faab3e2429873e805 kernel-tools-libs-devel-5.14.0-611.16.1.el9_7.aarch64.rpm df711da8e8dbcbf66dbb31b4d0a2b526126032b88e1a9891f6249733de53c9d0 kernel-cross-headers-5.14.0-611.16.1.el9_7.aarch64.rpm ed2b6275e03376dfa91ea103cbb10bd463201ac0135608207e22c7a6d4e497d2 ALSA-2025:23323 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-debug-3.12.12-1.el9_7.aarch64.rpm 0d15d59359e4b0dd8df22104d5df9662cdffe58a60963cdfcc6e5121eb01b9b7 python3.12-test-3.12.12-1.el9_7.aarch64.rpm 93fa03bfc67ae90c05f63990f63861d7c0a63fdae1cdeccea41d8dd30cb07f16 python3.12-idle-3.12.12-1.el9_7.aarch64.rpm dcd5dff9c8ea858d68f485785222ee3dc89e970f8b158ba873f047a3d45bc72c ALSA-2025:23342 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642) * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-idle-3.9.25-2.el9_7.aarch64.rpm 30ea4bdf4ec838effe0c255ecf7dd11eaaaf5c2c8be0c487e62a4c644b5b51e9 python3-debug-3.9.25-2.el9_7.aarch64.rpm 94a161e24503c07e0e5e46e095b58e127db9e6203cf5b1d02c2456c706787467 python3-test-3.9.25-2.el9_7.aarch64.rpm c93a3a85075557703577afdf48437011f82422ef39510e5bc066f9c74932b91c ALSA-2025:2627 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ACPI: extlog: fix NULL pointer dereference check (CVE-2023-52605) * kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264) * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302) * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922) * kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (CVE-2024-53113) * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVE-2024-53197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default libperf-5.14.0-503.31.1.el9_5.aarch64.rpm 3a6379a728ad564402cfc6ccd5564b09273d900eada83d6d4af10cf43f328512 kernel-cross-headers-5.14.0-503.31.1.el9_5.aarch64.rpm c780c4393a925ed4de9c87227d447df8e435ee3c92cda2cdf1c5ae38738a169c kernel-tools-libs-devel-5.14.0-503.31.1.el9_5.aarch64.rpm d37db14e874160ec9c59f764024a5d53a7beb92fe7e7ab39aac9187257e51ec5 ALSA-2025:2668 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default dotnet-sdk-9.0-source-built-artifacts-9.0.104-1.el9_5.aarch64.rpm 0bf89b7612bbf3e7b3169c99bf66a04547ad4ab41a33b279a737bee0905ce642 ALSA-2025:2669 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default dotnet-sdk-8.0-source-built-artifacts-8.0.114-1.el9_5.aarch64.rpm 34341f8c8713ddf0f40975ed210099e865a943a8266cc3e176ef73cd94a2333e ALSA-2025:3631 Copyright 2025 AlmaLinux OS 0 1 Low

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3.12-test-3.12.5-2.el9_5.3.aarch64.rpm 099033c864725b0a76e76be60a04b5d6d70711b270a23f104f516422881434b0 python3.12-debug-3.12.5-2.el9_5.3.aarch64.rpm 5911a15cf59b8f27d54b318495325e5dea1e3fd8fa496985e35ad3bf07931fbb python3.12-idle-3.12.5-2.el9_5.3.aarch64.rpm dfbfde3c962af0de1c544a7b4270bed16aa9953188ba4851f047ca639818965b ALSA-2025:3634 Copyright 2025 AlmaLinux OS 0 1 Low

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default python3.11-test-3.11.9-7.el9_5.3.aarch64.rpm 71aac801954be2bd98d3f73636a40ec3ee46755a9c5b8330348acf1734b95d68 python3.11-idle-3.11.9-7.el9_5.3.aarch64.rpm ab7712c0e85ca8844db280d1ac23ad5bb8dce86417d22c57f9a4732d24bb3409 python3.11-debug-3.11.9-7.el9_5.3.aarch64.rpm e120c1f9a19b7bdc18a4d274aa33460df08c358f59870cb782575d4cc809f410 ALSA-2025:3845 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default java-1.8.0-openjdk-src-slowdebug-1.8.0.452.b09-2.el9.aarch64.rpm 24ff90eba5d361b420771c31362af4c6649f838b012fe3609764b58695d700ac java-1.8.0-openjdk-headless-slowdebug-1.8.0.452.b09-2.el9.aarch64.rpm 50891ea2e400d9b8dd033e57830c78f18280acc2465b7c57e291049acd7a5bbb java-1.8.0-openjdk-devel-fastdebug-1.8.0.452.b09-2.el9.aarch64.rpm 72245e9a529581c6d9c9a5e9f169c6276a32401cdcd87279cd581dbe4ac283f6 java-1.8.0-openjdk-devel-slowdebug-1.8.0.452.b09-2.el9.aarch64.rpm 8f290b9f8f9660f05751b6b6245d29ce504afc649572bd2ec009a9c14c37ae97 java-1.8.0-openjdk-fastdebug-1.8.0.452.b09-2.el9.aarch64.rpm a1577afd5eb0b8f091cfedfa2ee2b65d6e2b5c4bb91ca6ab8b28f8f770b770a5 java-1.8.0-openjdk-headless-fastdebug-1.8.0.452.b09-2.el9.aarch64.rpm e9252decf32028a3e555fc3adf9b519d29921d33b2d85dad176c133544c536ec java-1.8.0-openjdk-slowdebug-1.8.0.452.b09-2.el9.aarch64.rpm e9c9f04eca47f5fd902e071be9ee272784d0a24c7236fce81c809e8bc1883936 java-1.8.0-openjdk-src-fastdebug-1.8.0.452.b09-2.el9.aarch64.rpm ed910035bf2cfe218916481667bcc759417e17a59e54665b9fb4967121219a54 java-1.8.0-openjdk-demo-slowdebug-1.8.0.452.b09-2.el9.aarch64.rpm ff37742cfabf180428166ab3c569835e0c173897616470cc47b53e255875b760 java-1.8.0-openjdk-demo-fastdebug-1.8.0.452.b09-2.el9.aarch64.rpm fffb21553677a6aadc392f0eab46f2cdad86454f92128e74ff78e94c6c9cd7ca ALSA-2025:3852 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default java-17-openjdk-devel-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 1111f2a92e5d2c141a654cc410eb455878e4268b87fc43777c042a8596fa88b3 java-17-openjdk-src-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 388b4bf4d1313fa785b29eb011bfac6daa755628028ddd10fcfa41b47489366f java-17-openjdk-demo-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 49959a28f1f5d9ff28e6dad4905649179b84750b94344be1f18fdb9023f57420 java-17-openjdk-headless-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 4ed630f2b8cb5a1bf7eca4c22f803cb0c941d1dc2288c12f79065f4519e4c59a java-17-openjdk-jmods-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 52277e656b5f62fb4d926d163bf8e8dc7cdb3719117ea2bff395141bfcc12e97 java-17-openjdk-devel-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 58e8804eafb4db88ec9da3be0d22c24fadbc4a9bb0596eba95e7544b2224aeb0 java-17-openjdk-headless-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 5c15e631f2fbda4b7c74d5549dc0ced453b6ac443ae7c4d0222ed27815daadf7 java-17-openjdk-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 5cf50784339d3886c0cd9a71f8a8e6f6c6edac5e00863f3cf7897c342178771e java-17-openjdk-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm 8411c51fed663f0c52ed45ba62fe03672f7fadf936641043e9db706e701ea6a6 java-17-openjdk-jmods-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm a496d717a29ae939f06c482a5355aa802a3cb83d60ccd707e9bd1aa94206269d java-17-openjdk-static-libs-fastdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm b7ade52701d2bbbcb0f4b052aa587a100f8200c55a92cd24c432bd65116434bb java-17-openjdk-src-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm b97cc57f127e2285d3eea48d11665fe98a5309f86ab68f0dfbf15d5c115fd5ef java-17-openjdk-demo-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm cc47b7a592a6fb031e234720ca3e78cfe679dc3c3273cb3ddad52bb1f8421847 java-17-openjdk-static-libs-slowdebug-17.0.15.0.6-2.el9.alma.1.aarch64.rpm e24aae4e116c141106ac525114b9510c0112d753b5b6420cd28d3afbb87c7f19 ALSA-2025:3855 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default java-21-openjdk-jmods-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 0b79bff8ceafcea9622eb3b4eae595351aaf5f6f943152d7de40622ebb91e670 java-21-openjdk-demo-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 2d8d6f244dd7acb073ff511bd0a0151fa7967a4529cebf74f480736432e0a2b9 java-21-openjdk-static-libs-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 3818b4366904423acc594e5064dfa7c8d9e48fa105e6670dfbb7440a1e38bca5 java-21-openjdk-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 3d600277d7f6143aedcb1d594c8ac30a1acae14c44eed1f48e4e4d80476eb996 java-21-openjdk-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 465b6036c02c17582cb2704e4e41eb29a141a016aa3d60fe9b7811bbccffa5da java-21-openjdk-jmods-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 488a91a5e2cc76b982939f299d31e08d97c918d9a7d9a3db0696fd2f7f77c890 java-21-openjdk-devel-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 4f5f524e9395253c7bad921edc4f6e72b34ba312314d2fb149fabf4668813c0d java-21-openjdk-src-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 6a6c4915abecee4031980693639ddb97b50fae44c6f74508519a7c8221a89f98 java-21-openjdk-demo-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 7fa00385ca083e5b051261f322d9635dd8d78cf9133d0eb79ce9956153d8eaee java-21-openjdk-headless-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 809cacf18c530b1f2d16d3c9614a6476afa646c9733250936c85122976198c8b java-21-openjdk-static-libs-slowdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 90afdefe2054aed67f87f610ee93dda20223dc66e649e3f0b3bf70b7d6f4c156 java-21-openjdk-headless-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 914601ab7fdcb97734325c91e8e8385bf59db4b431f7bfe17f0575de82de6769 java-21-openjdk-devel-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm 979463e95354de6287d9b4dccb999868af6deb42ef1abcf55a7342f81e5254fe java-21-openjdk-src-fastdebug-21.0.7.0.6-1.el9.alma.1.aarch64.rpm c81de65504179a6dc8d1512814039072bedc080e429c4885a12da492da596598 ALSA-2025:3937 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.38.1.el9_5.aarch64.rpm 72ad8864e12e194c9725648bf6ce79493e81d5d8a2c508bfde0207b82fbef8fe libperf-5.14.0-503.38.1.el9_5.aarch64.rpm d140af465b9495436ba8e4939400adcb924d338ba6c9fd36c319c8377af59bda kernel-tools-libs-devel-5.14.0-503.38.1.el9_5.aarch64.rpm dab044510260041f8417d06c89699b27a930851030ceae1ebd4cc479b4343e25 ALSA-2025:4244 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default nss_db-2.34-125.el9_5.8.alma.1.aarch64.rpm 23e1eee13784261e37a175ff5ab3ad2088e9ab2666f249e524d7805be9a24ddc glibc-nss-devel-2.34-125.el9_5.8.alma.1.aarch64.rpm 3959d942f5f47e8fbafefcc11bf0f2b6a1b76e9c767ca349dbc889f34df6e17d nss_hesiod-2.34-125.el9_5.8.alma.1.aarch64.rpm 53384a00d07134da6f964f0e9817f1271c5d29be7bbe0688c0c3b8f2c8b5ce3c glibc-static-2.34-125.el9_5.8.alma.1.aarch64.rpm 8d196658cb4a590bd1d587ced02f2396d8db3ce47d12b9ed1c5aba0f4ab57fbb glibc-benchtests-2.34-125.el9_5.8.alma.1.aarch64.rpm bf236e1da63efb8dc5149c94272feb4051048954abb39702367f5e6776ea162d ALSA-2025:4491 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_5_default 389-ds-base-devel-2.5.2-9.el9_5.aarch64.rpm c6a3af40009eeacada723dfeda56184ed1f217ebc6155add125e9d471bc0e75f ALSA-2025:6977 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3-idle-3.9.21-2.el9.aarch64.rpm 96e60f0b2d47d5dd4ce1453ebadfc3f911868ed268594572ce1bd1c77189eb9b python3-debug-3.9.21-2.el9.aarch64.rpm 9a62cb61a244cc90d77fd6ded9ed56c59c22134f35d23e231167e842794b1c52 python3-test-3.9.21-2.el9.aarch64.rpm c17a790465ca5663dc7ca915949dd89f48bfddb7a5cd8a468c9bea47734fe97a ALSA-2025:7107 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.12-test-3.12.9-1.el9.aarch64.rpm 2a0e1c452f70cd1e8ead2e819808266407a1a54e363fca7657e84549ca84dfe9 python3.12-debug-3.12.9-1.el9.aarch64.rpm d399fa19e8e19f6f7615ca3b18217bfcb2bfedaf0944caba789afc961fc6424f python3.12-idle-3.12.9-1.el9.aarch64.rpm d5806d03b308ebe6e1d2a9fe2ec86fc41721ecf5fa02632862e1c28b547ccc3d ALSA-2025:7109 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3.11-test-3.11.11-2.el9.aarch64.rpm 4177f1de6ec504489f20ea4fd8f720210fe21660c5a1c66872bbea6d5a3c8ed2 python3.11-idle-3.11.11-2.el9.aarch64.rpm a62eeac77ecb25940587a2995d519458d63fd66604b9fe922ffe0ac50734d35c python3.11-debug-3.11.11-2.el9.aarch64.rpm bb89054e9de201618a14c59713d98aff7bc10fa3fc28135a35fd4b5cf55cca82 ALSA-2025:7138 Copyright 2025 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default protobuf-devel-3.14.0-16.el9.aarch64.rpm 02cc39fb06da092b8672bd5cc14e3a47c8cbc97e902687a093a90803b8ec7c7e protobuf-compiler-3.14.0-16.el9.aarch64.rpm 6bf5ca22609ce0a3fee925aa4e33b47e2d21e472b3102a87c1763e4128773589 protobuf-lite-devel-3.14.0-16.el9.aarch64.rpm b8eb8fac65672063f5ae7432734fad5181e1d3f1137abb36a984db5e258bb9b3 ALSA-2025:7163 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default xorg-x11-server-devel-1.20.11-28.el9_6.aarch64.rpm 1331cd5172ff3510a4eb4928cb2dfa0b7f18f1a3d4549b066330627bff783f4e xorg-x11-server-source-1.20.11-28.el9_6.noarch.rpm 3b5bd53a2a3f676acc5de9d501d20df93aa48d19e1ee9f9f51594d08563b468b ALSA-2025:7165 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default xorg-x11-server-Xwayland-devel-23.2.7-3.el9_6.aarch64.rpm d59800c78259bb7c62411f737e6b36730c8acdd53675d12138749eba96e11919 ALSA-2025:7178 Copyright 2025 AlmaLinux OS 0 1 Moderate

gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fix(es): * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453) * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-3.el9.aarch64.rpm 5e003993d5cddca9651604cd94a4e3be5af4b9b622eaef1249edcbf2c89057ad ALSA-2025:7201 Copyright 2025 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default corosync-vqsim-3.1.9-2.el9_6.aarch64.rpm e110dc4a8f166f970f62f96c357a54f3da43a942e1b4880f275bbb7585f2fdd1 ALSA-2025:7309 Copyright 2025 AlmaLinux OS 0 1 Moderate

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: heap buffer overflow in bin/common/color.c (CVE-2024-56826) * openjpeg: heap buffer overflow in lib/openjp2/j2k.c (CVE-2024-56827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default openjpeg2-tools-2.4.0-8.el9.aarch64.rpm 2ab806ee1bfb587509b3b789a1f8057974b73ca926f1f1d8cb28ea3a09901321 openjpeg2-devel-2.4.0-8.el9.aarch64.rpm 483431c4e1c61b56e3740532c84b06b9ce46b88f18af0b7760b1decb5b5b4137 ALSA-2025:7350 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-Module-ScanDeps security update

This module scans potential modules used by perl programs and returns a hash reference. Its keys are the module names as they appear in %INC (e.g. Test/More.pm). The values are hash references. Security Fix(es): * module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default perl-Module-ScanDeps-1.30-6.el9.noarch.rpm 58e02999f61c36061ec35282d70735bc5f2aa26e5cd90232472bc3205b37ee54 ALSA-2025:7395 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default 389-ds-base-devel-2.6.1-8.el9_6.aarch64.rpm 07c6c159b0f632573a3c98da2fc0f9ac511157d73e9e35eb71f67d33c5293388 ALSA-2025:7402 Copyright 2025 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Memory corruption in the ngx_http_mp4_module (CVE-2022-41741) * nginx: Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742) * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default nginx-mod-devel-1.20.1-22.el9_6.2.alma.1.aarch64.rpm d6807bcabb6b611ca42ed491a097079e7b21080d18b68d2727f03da93555db14 ALSA-2025:7422 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: dangling pointer in gdev_prn_open_printer_seekable() (CVE-2023-46751) * ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952) * ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951) * ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954) * ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953) * ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libgs-devel-9.54.0-18.el9_6.aarch64.rpm bde3c893fdf2f3c1b34929adbf376e55cc7c3a478a3e91a331dd166bf93a3d10 ALSA-2025:7423 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633) * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005) * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) * kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927) * kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CVE-2025-21993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.16.1.el9_6.aarch64.rpm 196dcda94500d8fc1726b96a0170e7673bf0fa01ae48c7aa3198c55697961b87 libperf-5.14.0-570.16.1.el9_6.aarch64.rpm 1e2cec0c097883728aef5075d18b43b4a2c05e43e6c2b38e6b0c80ff7a786f15 kernel-cross-headers-5.14.0-570.16.1.el9_6.aarch64.rpm c9a70affb8c4e4d4f080d29470844bc2253550796c67d7214cf79360b04c987c ALSA-2025:7430 Copyright 2025 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: Arbitrary file read (CVE-2025-3155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default yelp-devel-40.3-2.el9_6.1.aarch64.rpm 8affdf2efbcc5752d64c72758793cdd216cf3d24db9396045512236b6b51de86 ALSA-2025:7437 Copyright 2025 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Avahi Wide-Area DNS Predictable Transaction IDs (CVE-2024-52616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default avahi-gobject-0.8-22.el9_6.aarch64.rpm 0816d64db7d7eec3a247206e3e80a1e778c6672766fe88a97d8b8fbb6f9be2df avahi-compat-howl-devel-0.8-22.el9_6.aarch64.rpm 66680ba49567511fe3fac84c0470a92d3cf047df70cc835d45804867cbeca5ce avahi-devel-0.8-22.el9_6.aarch64.rpm 86bc4b013d080e138030fa3eb5fa956470b863601059c2596547be6b2b8a7559 avahi-compat-libdns_sd-devel-0.8-22.el9_6.aarch64.rpm 8c47f39011643f2bfbbf30bbaf1266505b04037708fff5ce1b49ee7dbc0c804e avahi-glib-devel-0.8-22.el9_6.aarch64.rpm 9463e79764664f9a0973beafc929f048a27226c1b0fb1cbf7ea4e7de3461cdaa avahi-compat-howl-0.8-22.el9_6.aarch64.rpm db9cf8d30e1c8190b581fa2a0e4c229da62f342d2beb8d7faed29fce60297f85 avahi-compat-libdns_sd-0.8-22.el9_6.aarch64.rpm dc5fda9806fe9ed1bc66945b4ee692fae3db48b0230e9716a6a25de48ddff7ca avahi-gobject-devel-0.8-22.el9_6.aarch64.rpm fa9312115517757f4b4ca805f1607ba917178b06bafc2d2cd20aadb1334d4fb9 ALSA-2025:7586 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libgs-devel-9.54.0-19.el9_6.aarch64.rpm 0f93220794964d4007419bf55b7831118ed60d3a969e56142fecb59915e208de ALSA-2025:7598 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.116-1.el9_6.aarch64.rpm a7bb661df7150911097a8e097b45c03633b0450664aea1f6824be5c46e3e7215 ALSA-2025:7600 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.106-1.el9_6.aarch64.rpm fc677a59d883d963b60ea63efeb2caf18696fe1ab18c6b378841f979b028572e ALSA-2025:7903 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756) * kernel: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CVE-2025-21966) * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.17.1.el9_6.aarch64.rpm 6c88e9eaa22de74ee9c0836a11b038cba6becefa7b9e9b6b12f4034ee8667b83 kernel-cross-headers-5.14.0-570.17.1.el9_6.aarch64.rpm 7aa90ed399ed8a4fc98b69b70e03e42cfe8a9aa95a4590a521ee196387f9fa5c kernel-tools-libs-devel-5.14.0-570.17.1.el9_6.aarch64.rpm 90b9c19fa5aed53c1a4f015dd68bee8a57ba5f0bb51b1d145e9dd3d0d5db0d3d ALSA-2025:8142 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.18.1.el9_6.aarch64.rpm 596cf8fd87609adf9cee5649caa865fc687a562dd25c4a9e34c83f57b12c01a7 kernel-cross-headers-5.14.0-570.18.1.el9_6.aarch64.rpm 7666e98a25945ff25db67fedc1afa551b284d8302973a5180d9ff2b9fa7213a0 kernel-tools-libs-devel-5.14.0-570.18.1.el9_6.aarch64.rpm 993e0ab15ec3693a5ae0dbd0d3f286bcfe35ba184c469f080bc78f63f44b9af6 ALSA-2025:8183 Copyright 2025 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-4.el9_6.aarch64.rpm 46f671a516aeab15e7c286af293bf3d42e89b9786943ea7b150888922b0be01e ALSA-2025:8333 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Use after Free in gru_set_context_option leading to kernel panic (CVE-2022-3424) * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.19.1.el9_6.aarch64.rpm 237f6071a7bba38163d35500f2556f085e6909b0cf39ce2a4ab68546f9536790 libperf-5.14.0-570.19.1.el9_6.aarch64.rpm 26c215ec47fc1171a8822304d937886ee7ed4cc570a3e97e8e4f76596031e794 kernel-tools-libs-devel-5.14.0-570.19.1.el9_6.aarch64.rpm b2fe4c7dbf0400d2581b30b6892c393ba414813b9ed8b1c687e580f7652d9ebe ALSA-2025:8337 Copyright 2025 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: request smuggling attacks (CVE-2025-47905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default varnish-devel-6.6.2-6.el9_6.1.aarch64.rpm ebca1a963bf365773075f321673a20567d354e116b7027d8c9b42a59d2c17cdb ALSA-2025:8643 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926) * kernel: vlan: enforce underlying device type (CVE-2025-21920) * kernel: xsk: fix an integer overflow in xp_create_and_assign_umem() (CVE-2025-21997) * kernel: net: fix geneve_opt length integer overflow (CVE-2025-22055) * kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785) * kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CVE-2025-37943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.21.1.el9_6.aarch64.rpm 21059a674a15032675a3c8523614787ed0d5829c970951f229360f9ee7b4d8c8 kernel-tools-libs-devel-5.14.0-570.21.1.el9_6.aarch64.rpm 6ff8c19ea043237bd7ff51ea27a9308483991665781750fa79e7f9540927bc6e kernel-cross-headers-5.14.0-570.21.1.el9_6.aarch64.rpm 825ad98a0ca074fca40f4abfb8a00c5a874e59ced4a5a59cabd5e8d0d7bc0d5a ALSA-2025:8655 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default nss_hesiod-2.34-168.el9_6.19.aarch64.rpm 07917ee1dffca30c6b67a65bef67d817b78521d5e02adc9a7dbe7b2e05bbc9a8 glibc-static-2.34-168.el9_6.19.aarch64.rpm 40f09f7b4e7d9a65fe92e00772d6cd906ba228d3e27568452381a2c999c752aa glibc-benchtests-2.34-168.el9_6.19.aarch64.rpm 6926bcb7c06c1a1653380f4efd29b404ee1096c2668e8777040eff05b884c069 glibc-nss-devel-2.34-168.el9_6.19.aarch64.rpm b290cf4bb96c8c4734b71cf72d59c710c55962e89539ff6b2a8e6156db578fc7 nss_db-2.34-168.el9_6.19.aarch64.rpm d587cd23fa4a4da39a74e1da6133756ece4b88309bf41314154d6b1e8f17e2f2 ALSA-2025:8813 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.117-1.el9_6.aarch64.rpm be0d25d09af771eb321ca65498f59b3f44636c7036b30c4b573ee8da409cc54a ALSA-2025:8817 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.107-1.el9_6.aarch64.rpm 3f24aa288cadcb2a042decef55b659fb2792717d28ecb3370582d0f794b30cbb ALSA-2025:9080 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961) * kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (CVE-2025-21969) * kernel: cifs: Fix integer overflow while processing acdirmax mount option (CVE-2025-21963) * kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy (CVE-2025-21979) * kernel: proc: fix UAF in proc_get_inode() (CVE-2025-21999) * kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126) * kernel: smb: client: fix UAF in decryption with multichannel (CVE-2025-37750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.22.1.el9_6.aarch64.rpm 670d72db6e07f4f0dc71ebb4d9e2b712db8d649648916eed194f9889891cb21b kernel-cross-headers-5.14.0-570.22.1.el9_6.aarch64.rpm afc03f092a00bd73bb57cdb4bfd423bc49655701adba6df7aa80df0998588a1d libperf-5.14.0-570.22.1.el9_6.aarch64.rpm bdad3bba70d4202f115c80e3e4abcf454f864c6fbab8fee8759cda022982d3f6 ALSA-2025:9114 Copyright 2025 AlmaLinux OS 0 1 Important

apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default apache-commons-beanutils-1.9.4-10.el9_6.noarch.rpm d5abbee0a7923ce4b894aea8eec8e6a87711d651ce8d72837dcad10c7084c5ca ALSA-2025:9118 Copyright 2025 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double-free in libvpx encoder (CVE-2025-5283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libvpx-devel-1.9.0-9.el9_6.aarch64.rpm 9fd03dd1e4dbf0f83a46aaf949c2a9769a16cef0f895603338e5a5b831842455 ALSA-2025:9184 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.1.noarch.rpm 331040804a9215b0f5fbcec70e7f800344c4d1f1a1394413916a202c09c06a91 ALSA-2025:9302 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883) * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919) * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104) * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150) * kernel: ext4: ignore xattrs past end (CVE-2025-37738) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default libperf-5.14.0-570.23.1.el9_6.aarch64.rpm 803b131a2935794a8a0e80829b912d55e247c8a3ebd18fc768e86dda54a7ce8c kernel-tools-libs-devel-5.14.0-570.23.1.el9_6.aarch64.rpm a726cd51aee83b383a4cc55092db55966993af286444bc38136fa6496065b3f3 kernel-cross-headers-5.14.0-570.23.1.el9_6.aarch64.rpm ca59d1dc329bf9202027260d08fc1c183213f484722bf950f4a3cd1314e476cc ALSA-2025:9303 Copyright 2025 AlmaLinux OS 0 1 Important

xorg-x11-server and xorg-x11-server-Xwayland security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default xorg-x11-server-devel-1.20.11-31.el9_6.aarch64.rpm 3b8c2e4c79f7db7dd27562be618888ccc7c30d7be7e548cafd87a2e356ef3220 xorg-x11-server-source-1.20.11-31.el9_6.noarch.rpm d0597aa66c866770c5ea810962474f4c55c86264f84a5f75b4e92f416e1c22a3 xorg-x11-server-Xwayland-devel-23.2.7-4.el9_6.aarch64.rpm d0bf71fcf036fb762c202ba49b42ad7b2febcb7a88ab2daa42f2d6ccce7c57f2 ALSA-2025:9330 Copyright 2025 AlmaLinux OS 0 1 Important

perl-YAML-LibYAML security update

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby. Security Fix(es): * yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default perl-YAML-LibYAML-0.82-6.1.el9_6.aarch64.rpm 89d008fc67253de823687af38e8a2eb5105d7c624f2cdf768aaab3274475e278 ALSA-2025:9462 Copyright 2025 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default qt5-qtbase-static-5.15.9-11.el9_6.aarch64.rpm d532bcd05cb2c6df7fbffff78325bafb560bead02abffdfee0f8381fc24bfec7 ALSA-2025:9517 Copyright 2025 AlmaLinux OS 0 1 Important

perl-File-Find-Rule security update

File::Find::Rule is a friendlier interface to File::Find. It allows you to build rules which specify the desired files and directories. Security Fix(es): * perl-file-find-rule: File::Find::Rule Arbitrary Code Execution (CVE-2011-10007) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default perl-File-Find-Rule-0.34-19.1.el9_6.noarch.rpm 6e134185b9d45a1f2b199fbad1e1785420082f93ed527bddb5aa6eb456432605 ALSA-2025:9877 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Vector register overwrite bug in glibc (CVE-2025-5702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default nss_db-2.34-168.el9_6.20.aarch64.rpm 3676bae8945db52d7f8b1ced2cc115532f2fe2faa914bc1a2ea54201b4927b5f glibc-nss-devel-2.34-168.el9_6.20.aarch64.rpm 7de866e23d744c1a3208c616bc6701ba28ed31b3fc887c4a701c37448053ae09 nss_hesiod-2.34-168.el9_6.20.aarch64.rpm bf567b5080ad439f588725a553db2e0c7494de3e69afa3b6c0e0a3ed77aed11c glibc-benchtests-2.34-168.el9_6.20.aarch64.rpm d605079b3b10a8a1597fa7d35ab8b0ceefb9bf0143bf8530a36821186583a357 glibc-static-2.34-168.el9_6.20.aarch64.rpm d60e4852fed3e8175972902227fcb73dfcf7d2d375f61455c1a5b1d1fe66e811 ALSA-2025:9880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.24.1.el9_6.aarch64.rpm 5d85e53bfce273d801fb9ff1765f6bc61752da5bcd1b28d0c85675274becce53 libperf-5.14.0-570.24.1.el9_6.aarch64.rpm 863bbcd225821bab194f683082da2fb1957be69db06f5db6b519e89b669fd4b3 kernel-cross-headers-5.14.0-570.24.1.el9_6.aarch64.rpm e9857ecd55059a8f25e86d4f79ee2002e9c88c6407380ac61ee5d4b7560d989c ALSA-2026:0126 Copyright 2026 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default poppler-glib-doc-21.01.0-23.el9_7.noarch.rpm 2361e9dc4e8e5d5f1179ab44710407d24f216ee1d6c884ac602529632cff4d39 poppler-qt5-devel-21.01.0-23.el9_7.aarch64.rpm 375dc76ad408730962d39c1185110598405f0a50df619453c519dc51aebdffba poppler-glib-devel-21.01.0-23.el9_7.aarch64.rpm 4a424e632c8bb9e8f9d99672b9f20a47735ac3445ce5208565b21ac97bbfb353 poppler-cpp-devel-21.01.0-23.el9_7.aarch64.rpm dedc096ab2cbde700140ad302324645719cbd2f14f55ed49bfcbce2d55e4b6f0 poppler-devel-21.01.0-23.el9_7.aarch64.rpm f76ddc7e7f2942b9a4a8228a472d59d921a96dda579f7f415303afbbf1686977 ALSA-2026:0137 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default mariadb-devel-10.5.29-3.el9_7.aarch64.rpm 2e756adfb845b70b078abb9c38ea7df0c9b2e9b4d2f01578c8b27b99e020703a mariadb-embedded-devel-10.5.29-3.el9_7.aarch64.rpm 40d79e2bf12783a5c5d8f86af8ee1974c3f56dda913c7114560e6bb3f91af346 mariadb-test-10.5.29-3.el9_7.aarch64.rpm 5ba4a0ee855f5cb4f621b2da4b3b36e2776044c2fdc7757beb2edfb747233159 ALSA-2026:0445 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806) * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.20.1.el9_7.aarch64.rpm 392679917cb14ad97420ff05eb06a6537ac529acd79abc83caefc45516a9cde2 libperf-5.14.0-611.20.1.el9_7.aarch64.rpm 788d7f90162ce2a2891e4ae65f9c7776f3517bb2ebc38d6ac2727828d78a4f5a kernel-cross-headers-5.14.0-611.20.1.el9_7.aarch64.rpm f4c2970ba1d66bba923f54b61e607d8e281ded57dce2f1ffe72ed2ba66d1db62 ALSA-2026:0491 Copyright 2026 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default postgresql-docs-13.23-1.el9_7.aarch64.rpm 049728138028366756331c45f79e59c71b8ae3514a007f2d64c436106ab82bf4 postgresql-private-devel-13.23-1.el9_7.aarch64.rpm 33cae0f8b70f87ca14e8f8c7183414cd880287d158849404e9725f97a3b0f8e3 postgresql-server-devel-13.23-1.el9_7.aarch64.rpm 5387eebdfdbd45ea182cb1c47bf12f4ad4e001b8255cfab4e044ab8d931579b5 postgresql-test-rpm-macros-13.23-1.el9_7.noarch.rpm 8a5cd0ac240429ef34bfd5533793e0653bf11ce77496984eca7ac903213ae11d postgresql-upgrade-devel-13.23-1.el9_7.aarch64.rpm 924f1cccbcef52ea319b0cfecd1801dae795992f3af5668d712e9043f1de3e8d postgresql-static-13.23-1.el9_7.aarch64.rpm b0ddedcde6ab1cccfcf7ea7dbc5ffd774603caf675ef1d24dbfaac650dca02a5 postgresql-test-13.23-1.el9_7.aarch64.rpm c61c806d0d78cb85b108aff47b8b47e9758ec49b756f502de7546a31b81c7f3e ALSA-2026:0700 Copyright 2026 AlmaLinux OS 0 1 Moderate

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages. Security Fix(es): * xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default transfig-3.2.7b-11.el9_7.aarch64.rpm 4dc9ae2a71d4dd829093d49496f038e4b3c3ad520362c5880029403d66ea34da ALSA-2026:0793 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.24.1.el9_7.aarch64.rpm 94306d250dc02a5f7ba968796fa3d77f36b0a136dc07be19314d99000865f63c kernel-cross-headers-5.14.0-611.24.1.el9_7.aarch64.rpm d26fed12043f3c4173561952573ced2f1b379f819d2a1a35919234932a966a0d libperf-5.14.0-611.24.1.el9_7.aarch64.rpm f671e6050890eccee38c816164409ec0be617aefe3dc3c27c11fa52d616daedd ALSA-2026:0927 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142862, AlmaLinux-142881, AlmaLinux-142882, AlmaLinux-142883, AlmaLinux-142884, AlmaLinux-142885, AlmaLinux-142886, AlmaLinux-142887, AlmaLinux-142888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-17-openjdk-jmods-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 1d60c69766de7a670e2fa6b36b7c0ba24028b22da822f6436276802a9c6fadd2 java-17-openjdk-devel-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 24ee4c97b05fe762729a09f9d86954c7dfea1b18821fa6d980878ea2c233f2af java-17-openjdk-src-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 2af541c42f41cdc39f5a3ebf3a0e0055963c6429600f694c7ae9535cc36fdf14 java-17-openjdk-demo-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 3ce739b48a6131183d7cc785baaada58a743635a45fd1a4591a50f5cc7172606 java-17-openjdk-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 54079e0f6d6c1b7d375b8d88613b623883abfbc719aca47b855f8635992a30a8 java-17-openjdk-headless-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 68d600f1e848ac29c14a3dd30cbb95313ae4aa5dff14e05f645107df86332fec java-17-openjdk-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 72103cb85c7dde6a3b197d8c18e368b8f1ff376a6bf3e2d52d1124cc729986e7 java-17-openjdk-static-libs-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm 753d17471773ee69245bd515ff00573ae33d6d820a99c9bf211fc853a77c0a3c java-17-openjdk-static-libs-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm a8de9ab198a2944dda7974c2b249abf493dcff38979a68602c17c7c409809ebc java-17-openjdk-src-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm b5a0ef6e75dc76786445451d199513f136eb9597791c7a3912fd9ab3b4588a66 java-17-openjdk-devel-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm bf6e4c3ba5ac733a8ae6b867c4175a9294e52ac58f6f0bf0febbeecb1c7c167d java-17-openjdk-demo-fastdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm c95aa6649b82551b6975323249e757949af5d1291d94c32ec79e0f20dd665116 java-17-openjdk-jmods-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm ec80ce27c1692f8add826e3ea595cb43b8d03fd891a7d89ca4a1700521fc9d98 java-17-openjdk-headless-slowdebug-17.0.18.0.8-1.el9.alma.1.aarch64.rpm ed523befc6eb1166e42ebe8821c884e93126733cd5afc01142562b225653b954 ALSA-2026:0928 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142860, AlmaLinux-142876, AlmaLinux-142877, AlmaLinux-142878, AlmaLinux-142879, AlmaLinux-142880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-21-openjdk-jmods-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 20a73a15c8c97108b5fcb7e5ead1086c9d3c31515d020a1c082a2b79a39cd374 java-21-openjdk-headless-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 305858bda9731930c52e067f88fe1aceebc9d8542df74de5a4249b905d8057e0 java-21-openjdk-src-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 5591a94207a05ddb4c51f40371970352853567816ef1ebae79a7ba452cd62221 java-21-openjdk-static-libs-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 5a766f5edcada6450b23d36c8341973a9ce373a1c9e0f5dd70726d8b041e36e2 java-21-openjdk-devel-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 70dc7dd48d986a4432cab522d68bcd4e68740be572ec595728465f6c05f27abc java-21-openjdk-devel-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 7469fcc291a37cf95d1c453879fdeb3a84f95cf72f450e978e790ae60dcd4072 java-21-openjdk-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 77bf878d951cff4f03b4d1c5201d505d7bc5dac5f7e9478fe154f5f8574b565f java-21-openjdk-jmods-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 8bc6dffa7b65e93119109402e9ca4e47fc975567e5d808bf35757aec6f134341 java-21-openjdk-src-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm 905fbe9569a992780699de952b68aa8297d278a484e86e0a7c516d1c09c48c73 java-21-openjdk-demo-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm a3ad70d7db91509433e10789ab7e2a239320c85d4d8983c535571dda258530c2 java-21-openjdk-headless-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm aa0e6708719039f739e58566604d7e970b7a5ccb74f9980575e0ff6d4fa7ef92 java-21-openjdk-static-libs-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm ca07c8a55bc0db16a269cd3c6efd15e534497c12ccea46cd5b03bb506f03f29e java-21-openjdk-demo-slowdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm cf19c59235b0ceb9720646cda4f9926978e7ee438900294d057d55c1119e01ed java-21-openjdk-fastdebug-21.0.10.0.7-1.el9.alma.1.aarch64.rpm fe94ddfbbdfd11b14927e32eb40e10ef538e416043563481802e62af67540dd7 ALSA-2026:0932 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142865, AlmaLinux-142866, AlmaLinux-142867, AlmaLinux-142868, AlmaLinux-142869, AlmaLinux-142870, AlmaLinux-142871, AlmaLinux-142872, AlmaLinux-142873, AlmaLinux-142874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-1.8.0-openjdk-headless-slowdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 15359a18d61b44c34742c8900462237c625e2ef41ab4b9950200b20cfcb66488 java-1.8.0-openjdk-src-fastdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 2f7ba2c4fa1d746f6cbc82adf33d5cdc5f4fe44c632c571fbca9d3efe74bafdc java-1.8.0-openjdk-devel-slowdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 363d772cd7c4e866ae104745038ce38785fdefb81a120253f5a182ff993838a2 java-1.8.0-openjdk-demo-fastdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 69558d351b4c5e339413a0241c35073e0abe267470d4cb6811d00ebc201a8d81 java-1.8.0-openjdk-demo-slowdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 7b6ac8f719593cd0b194c38f5004eb01d35d120b65b95327e58be402087fe029 java-1.8.0-openjdk-src-slowdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 88d7b411522e19ca538a18a131ab1c29357ad216830f132dbc5b7899e7e9d0a9 java-1.8.0-openjdk-fastdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 98cc4cd09e2ad8811ab3c1415d428416e98cb846f2fa100417e20f6719f4b671 java-1.8.0-openjdk-devel-fastdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm 9f72a38bf6fdf74c5dfac33bf46df370cad114e5171f9330484bce7c886ca8a8 java-1.8.0-openjdk-headless-fastdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm abfc113453ba00cd1250b9996b3ecc3f46d9387937b2eb75b4ea4864f3d5a43f java-1.8.0-openjdk-slowdebug-1.8.0.482.b08-1.el9.alma.1.aarch64.rpm b791e9fd68d69b1768a856a700cdff9610d8aba1b3f7becdb981402e68c56fec ALSA-2026:0933 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-25-openjdk-static-libs-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 113ef727e2bf55ffd1c76b0283228e9eb85738b16e4cfb737952375dd895797f java-25-openjdk-headless-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 176d2fd45e7a6d88084cdc7d9f8d80e4bdd4b1c1536d65c4df05b2a6f960fe28 java-25-openjdk-devel-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 18383a2db575d629296a74f3d9de13145b79432ce1053680323484d36938f2c1 java-25-openjdk-static-libs-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 183f6bcc5d77decc75b7eaa376336bedb4e54c8c4c5906b290df6ca9b10ac683 java-25-openjdk-src-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 19ec06d9c3703bd20a8beacadec5ebbd95505ba78ba1345c8fcb850b61d2c6d0 java-25-openjdk-devel-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 22e39f8cf257cbd3bd22e9100741202adda391f3c3bf44547da276970f045c26 java-25-openjdk-src-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 2cea6cd9946de3d226119cf4267a7a4846d5572e9684f2f63a48b869ee1e5792 java-25-openjdk-demo-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 2e932120dc0af4ff593767f263dcbb2bc0bd2802073bfbecb55547c6ecc26cc7 java-25-openjdk-crypto-adapter-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 35945651421b056202bb9e45d3a0b4c315220431740167a0931b86f0900454ff java-25-openjdk-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 3c0cbfada733528706ac6f9cc71230cc00d397364f7e0d8c6bd301473507b9cf java-25-openjdk-crypto-adapter-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 543396f82f932cd7932760d010972c693ea37a5d87eb22e98529fdf727b45046 java-25-openjdk-demo-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 60df3e470e51a7dc9b49db4ca698a650e1f9c209d87313595a9108ed4c92669c java-25-openjdk-headless-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 6a0502bcacbb821f1ab86a00d42afa3508679062ebb61beb4305b9eb607d8c16 java-25-openjdk-jmods-slowdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm 98836dcf3b8e434c5bbf9cb329031c463a51f9a47b9206980fdf44181c5ae124 java-25-openjdk-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm c2853c81cc00814ee002693077e75d372d24f86b7559f584ca5bed5bfb7bd778 java-25-openjdk-jmods-fastdebug-25.0.2.0.10-1.el9.alma.1.aarch64.rpm c73ecc6d42ea494cb48e8eefcbb34a6fb3509bad4193d862939524a439ea8bf9 ALSA-2026:0936 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.1.aarch64.rpm 7270df11d7a95d70f0298c397eae4301d9112cac8615a82f509bf2035b906921 ALSA-2026:10745 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-debug-3.12.12-4.el9_7.3.aarch64.rpm 0559e5a2405d3e57f9ba0997bb6179b656003feb0e2187fca353fc76a0ffbc71 python3.12-test-3.12.12-4.el9_7.3.aarch64.rpm 1c901f990a9033cc8c868aa958d9c2b75c9dbb9de299d35d5a2ef901b46f6ce3 python3.12-idle-3.12.12-4.el9_7.3.aarch64.rpm e6eb37a85e72ccd8d96cc0add57c1e22183752371d4b2313feff3473b0e18ce7 ALSA-2026:10774 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.11-test-3.11.13-5.3.el9_7.aarch64.rpm 2e0b8be86c386e79c9553588ba5b07d6bfe24720429e08ce3b831d1928269017 python3.11-debug-3.11.13-5.3.el9_7.aarch64.rpm a278801fe0e1aac3d3a89496bb6acf02e32be78226dd58699a58652ad1267733 python3.11-idle-3.11.13-5.3.el9_7.aarch64.rpm aa43d559c2fa726051107d6186233f512e028536f4084a39583f7f244c49c7b3 ALSA-2026:10949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-debug-3.9.25-3.el9_7.3.aarch64.rpm 18e93aee911cc976c4b8848f7213b365f0e40104ab1c3c87a9121ba106028fcc python3-idle-3.9.25-3.el9_7.3.aarch64.rpm 4f12fb31d33ea176cbd96941c01343546f0d391c114353e8e4de18bea0f966de python3-test-3.9.25-3.el9_7.3.aarch64.rpm 554d11d8b19d38795cbdb344c1e9b64cd751604d517ad393c8751ba568bb61ae ALSA-2026:11369 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-6.el9_7.aarch64.rpm 7cbbb1baa199381f9a302c141ca3c5e809ff0af2b50f50f3855bfe477d5839ff ALSA-2026:11388 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default xorg-x11-server-devel-1.20.11-33.el9_7.aarch64.rpm 58c45684f812b9080e5653635a53500342afe25230f662647aea100f75797ce2 xorg-x11-server-source-1.20.11-33.el9_7.noarch.rpm 7977bc9d7b343335f336cba8f279e8bdf48d3f7f820fe02724c0c96b17777138 ALSA-2026:1143 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301) * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.26.1.el9_7.aarch64.rpm 036fd220df9b2ccb64a5289881b8c2b432978ab545b0f73666201860ad1e8f9f libperf-5.14.0-611.26.1.el9_7.aarch64.rpm 7cf188151701a80d34240c7b68fed22babccb89b8dffe104197f6bc9bc440e73 kernel-tools-libs-devel-5.14.0-611.26.1.el9_7.aarch64.rpm eebe5965627b633d5639bd75643906e51f6139b217de786b32e7790a3a2c3abe ALSA-2026:11504 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default PackageKit-glib-devel-1.2.6-2.el9_7.aarch64.rpm 42c220f0274f393543e82fdb03db4c83340336424f7f846342909a9f8a1f4280 ALSA-2026:12271 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.3.aarch64.rpm c70ef450c88ae8ca0cbe88e43c15c3dd6b51bcc6fea4b98e1e292c68e13528f6 ALSA-2026:13565 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.54.1.el9_7.aarch64.rpm 305d3c209e93c966d14998b3e90124657308834581ea8528e3e195107e20d844 kernel-tools-libs-devel-5.14.0-611.54.1.el9_7.aarch64.rpm 3aa1c9c313547667a768d1aa30f0965159c7a589cce56f12c1938926a83b0a23 kernel-cross-headers-5.14.0-611.54.1.el9_7.aarch64.rpm 3ca7cea1c470976eab7448eee9bdd1b81c16de6c74dbdb0eab54ad38702db507 ALSA-2026:13673 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default corosync-vqsim-3.1.9-2.el9_7.1.aarch64.rpm 4e49b5795adb57a10517789de1adf39660eb18db633df5b895a2e683bb3dc856 ALSA-2026:13857 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default dovecot-devel-2.3.16-15.el9_7.1.aarch64.rpm 53ce666f1a734bcfdf1cd6e364ac4b2084f616e8db992e6a5c8f1552288be538 ALSA-2026:1408 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.aarch64.rpm d904f51e0b751143fc6eec52b2ebd4bea034e8973d7f3d99a0a0ec6dcdbfecfe python3.12-idle-3.12.12-4.el9_7.aarch64.rpm eabe5b32d5d3a138b498dd54428741df688bb37337706cd8024f4aa182766e94 python3.12-debug-3.12.12-4.el9_7.aarch64.rpm f4efc1c5e36f03be6cf3fac1126c264d135a095f46202a2fdc0962f0a5f26ae3 ALSA-2026:1410 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.11-test-3.11.13-5.el9_7.aarch64.rpm 2759ab7070bc06b1ee3fbdee9b82331cce826d3beffe24853850393e13b4e99d python3.11-idle-3.11.13-5.el9_7.aarch64.rpm bf7e6202af528f2e6152bd86ed047435f0111220c8dd5dd27ff0fbead9fbfd4e python3.11-debug-3.11.13-5.el9_7.aarch64.rpm e94e4c2c661c0905d14daa4015248af53657f0eaa35e51115126d0c3665ce2b3 ALSA-2026:1478 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.aarch64.rpm 03f1a0452b4c64434d5c353f311b33927c08691e1da91be9c2a6d1f64dbb4a4c python3-debug-3.9.25-3.el9_7.aarch64.rpm 799eeefa67694ce75559c315883b89448ecfaafe2fafb674b16d9257956bf24b python3-idle-3.9.25-3.el9_7.aarch64.rpm 7ce0b9250c0331178d246b8964eb0214ac3ef6a9e5b9844d81974cef3d17de79 ALSA-2026:14819 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default freeipmi-devel-1.6.17-1.el9_7.aarch64.rpm 4ced92e413df3172b4c15b3f1159acf5cbe30b15d416a876454f0575965d773a ALSA-2026:15887 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.2.aarch64.rpm aab0b5935047f3ef62a57aefd35696d7b59d99695bac9104a9c5edb53bd3c005 ALSA-2026:15971 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.2.aarch64.rpm 3182a1836847ca869c711702cf8427625ddcf82e8200e0b47127453de1da1ecb ALSA-2026:1617 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.27.1.el9_7.aarch64.rpm a5cb2eea5743f6027a4cf4cfb112df071d6f6742269498a5b6a40525128e6cd6 kernel-tools-libs-devel-5.14.0-611.27.1.el9_7.aarch64.rpm ac355663d68c7c6401b68e347a8cd65621f32021a715c0b1597d0ea7994794ea kernel-cross-headers-5.14.0-611.27.1.el9_7.aarch64.rpm ad1571c2d99c9ff755724d032cd9fdbf732d234db3ac6bec043a28fb5d9b0c38 ALSA-2026:16206 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-611.55.1.el9_7.aarch64.rpm 14f6e7d9c859c509c398d7c864244eb55fb6b8c99d36ddfb504cfda1a2a13adb kernel-cross-headers-5.14.0-611.55.1.el9_7.aarch64.rpm 2ea573ce0f84e07802aca1107183481b3e569ba304e04fa005541199d92c9722 libperf-5.14.0-611.55.1.el9_7.aarch64.rpm 74098a9c2c066ec0821aa14950a6575a3254bfe2397847b02b79cb614b2fec02 ALSA-2026:16482 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.7.aarch64.rpm a753a5abb496fcd2b7a90cb1d4862ee66af4099102cf154f9b42a62e1b0889a8 libwinpr-devel-2.11.7-1.el9_7.7.aarch64.rpm cb70bac30e0c00c7d0784eae7f76b72ce05d62e127a7b62f1505f7db91e5ca16 ALSA-2026:16693 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default jq-devel-1.6-19.el9_7.0.2.aarch64.rpm fcd8d2675fec2395201f279461a174b8a30914af87bd7ee8f4c303a519f6a581 ALSA-2026:18029 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.3.alma.1.aarch64.rpm 00d8a3bb6feb6214d51b59951708fc1ef1971b375ef80a2e2680f3c6928c6798 ALSA-2026:18039 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default ruby-doc-3.0.7-166.el9_7.noarch.rpm dc441426fb8f8b1808179658f6ed2f8315c547c138f967c0ed5905c8f7bc328e ALSA-2026:18587 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bonding: check xdp prog when set bond mode (CVE-2025-22105) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (CVE-2025-38400) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.5.1.el9_8.aarch64.rpm bc01a6ec8cc63ed6248eb6fc47fc7b3ce9730bb58ed656bc9a3b3e3bd19efbda kernel-cross-headers-5.14.0-687.5.1.el9_8.aarch64.rpm d09e1923ca5ad7eceb137703501c938d5e796e5da256c22f6573576f3faf5578 kernel-tools-libs-devel-5.14.0-687.5.1.el9_8.aarch64.rpm ea09a3fdaf6aa321ea980fff7bb8d8023d577cff7ef4dfc7bafb34fad64414bc ALSA-2026:18597 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-2.el9.aarch64.rpm d2f1e88c8474ba487e297b5de2addeaa90d7c3f7a33f47f55ca32478bae107ff ALSA-2026:18748 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libvirt-devel-11.10.0-12.el9_8.alma.1.aarch64.rpm 2bbfedaee1536eefed038348291aabeaa8072ae3217eeaa5cce6fe34e1bf6b1d libvirt-daemon-plugin-sanlock-11.10.0-12.el9_8.alma.1.aarch64.rpm b20e0495294d69d3ec162baca63ba016b7f6e63aa1cd444c5bde116e478951fc libvirt-docs-11.10.0-12.el9_8.alma.1.aarch64.rpm e41217cd1c949e7d2ca69fcc8cee27c324d9468d3d88e2c1f5ee66b58fc6b0a5 ALSA-2026:18786 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.1.aarch64.rpm 0dbca2b9a06b5821c5fa9147a16c61236bbba2dc1179d0edcd37029f355549af bind-doc-9.16.23-40.el9_8.1.noarch.rpm 7a708ea0e5ade26de56d37e766f45520e410ae5dad31b2b35508a727f6a1907b ALSA-2026:18824 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libluksmeta-devel-10-1.el9.aarch64.rpm 2fb55bcbfa5078cf001b4d4340ee99d9d973b905657a98d6633a71d81be0cd68 ALSA-2026:18931 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-2.el9.aarch64.rpm 6a5d41e3ac2a763cbdcfc33682c213672bc55c47622f74f8d2e3ab3a366539e6 ALSA-2026:1913 Copyright 2026 AlmaLinux OS 0 1 Moderate

util-linux security update

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libfdisk-devel-2.37.4-21.el9_7.aarch64.rpm 7ddeea72705ab07f5801ec7cbb6c9d38804c4278a882becc761c45d6d1008cd2 libsmartcols-devel-2.37.4-21.el9_7.aarch64.rpm a462f675fa5b60da2d9d27a37259416c8cfbcab8006ec15e88b85d7e327b4a14 ALSA-2026:19175 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.11-test-3.11.13-9.el9_8.aarch64.rpm 2a03e749765730509a7438593456b7fa3a55847f4623ebe96bd6189d423344db python3.11-idle-3.11.13-9.el9_8.aarch64.rpm d15d1d40bfe46f2a548ff67a20e2339f1a65402520c20b3bc281401bfea93222 python3.11-debug-3.11.13-9.el9_8.aarch64.rpm e4d939fa9cfc9f8aacd3e7d36de4b1a94092d8475f7649b270ee09b55be80f3f ALSA-2026:19176 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.14-freethreading-test-3.14.4-2.el9_8.aarch64.rpm 054373044f3f22715f97824a30eeb8625f2cebbcd69c5e402a1602ed01497b65 python3.14-freethreading-debug-3.14.4-2.el9_8.aarch64.rpm 297da07aa6b4e3bab110ae0004eec5d6b01297cc1eecd973a54e3d84c43b708b python3.14-freethreading-3.14.4-2.el9_8.aarch64.rpm 2f4e4982b6f2fb0729048cf675c19dfbbb343aed9f3576767dff7a1bfe17d748 python3.14-test-3.14.4-2.el9_8.aarch64.rpm 32deb12d1c5aca5f853f4184220af7924eac39e3a9fe50f64e0090f0f3b293b9 python3.14-debug-3.14.4-2.el9_8.aarch64.rpm 33ee873430ef2d040fcf98ace2cfabafc7b5024cb70445c653d51838d045a82c python3.14-freethreading-idle-3.14.4-2.el9_8.aarch64.rpm 5741002695ea30f00d4feb7747d98f4be6a7eae895f0ebd3b83a574c48a0aeaa python3.14-freethreading-devel-3.14.4-2.el9_8.aarch64.rpm 5c99f97ae3144bb6a07c39fc89b8d2aee61dd4cd0c6754138c1c848acdd3f04d python3.14-idle-3.14.4-2.el9_8.aarch64.rpm 6a12620bff0a0592cc16114ebc39f20614bdf17daa2f32244a96474d6d1ced78 python3.14-freethreading-libs-3.14.4-2.el9_8.aarch64.rpm a4a4fc535d545826ea7b59ecc3dfd7b13d1433cc327b88eeb01d7bb839566913 python3.14-freethreading-tkinter-3.14.4-2.el9_8.aarch64.rpm fc3617fb9234c42b0ff16287f28b10fe3cdc4acbb39bcc2573a5ddba4e54456b ALSA-2026:19177 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.12-idle-3.12.13-2.el9_8.aarch64.rpm 7175035d154f8f5e83f75057f737bb931565bbfb150e64f68bfd19ccd4ff0913 python3.12-debug-3.12.13-2.el9_8.aarch64.rpm 7cda789dcaa77a767bb23e01a4123167dfa7e708f429e2597bac70f50ee68a9a python3.12-test-3.12.13-2.el9_8.aarch64.rpm 829c5b483dbfc6061a0dc98e27205c2b11635a13c529b22e3ae826eb88a1e6b2 ALSA-2026:19180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.aarch64.rpm 093428658235cca638f94feb694a555b3c63dff3d7b65d8d8581705e10e07a67 ALSA-2026:19200 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.1.aarch64.rpm f38f3b52cf25609f022dd0a49c76f3743fade57ac0dae7a04283b817374e8dcf ALSA-2026:19208 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default freeipmi-devel-1.6.17-1.el9_8.aarch64.rpm 41850678c12e544b4eb85245376ceff8322f9f5ed93f16b7fc586fb202ce37d2 ALSA-2026:19216 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-test-3.9.25-7.el9_8.aarch64.rpm 73ec33ca20c631bab809cde37b1c26af98e8abef09b6d5633cb2cae83bf4372a python3-idle-3.9.25-7.el9_8.aarch64.rpm 7efe5a28b53f7bfa72af6311a48adf52e6e9d045c09418afbd806a8ee3c877ef python3-debug-3.9.25-7.el9_8.aarch64.rpm bc79427ab680bc728858bbb221e237644d88f35a94989ae18b144bb0922119b2 ALSA-2026:19225 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.5.3.el9_8.aarch64.rpm 1077230bd14ed664ea71b2254a71f65e681168d5d90c6bb8b66e33d168971da8 kernel-tools-libs-devel-5.14.0-687.5.3.el9_8.aarch64.rpm c94d82105e2e4dcbba7105e2ede9abb6bdc353da1d7888201433482c50af9f14 libperf-5.14.0-687.5.3.el9_8.aarch64.rpm e4de96b48297823c118bd8bb037d7de108dbed6cf96f39f4548af8e7ae3c20f7 ALSA-2026:19343 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.noarch.rpm bb78b968af0f2f81e05afecea1ae46d98b6de0d70d3568bef2d7a8d1c64117a1 xorg-x11-server-devel-1.20.11-34.el9_8.aarch64.rpm c3f59bb84c4f35bafdd85efde9df4548cb09dc441c24a88de786c148d4d92553 ALSA-2026:19344 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.aarch64.rpm 813a6bb6ea32bd4c54b5d125685e3176a4072b46c7315fd704f8affe73bd398b ALSA-2026:19354 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default PackageKit-glib-devel-1.2.6-2.el9_8.aarch64.rpm 58cbaf94f8bb8171dbebd643fa792ac53521ead495bafdfc40fba7e4de8cf404 ALSA-2026:19358 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.3.aarch64.rpm 31d5406590234c676e2200e35f569fc8da85ea689922956a7a65ac410cf56745 freerdp-devel-2.11.7-7.el9_8.3.aarch64.rpm 54622ac61d2ecdced9c05565ae6546c339bcee6a050e8e04a7d1887d1a90833d ALSA-2026:19359 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.2.aarch64.rpm 1ce0dee4ef25891a6d983601282beeef5e48c57202f2a73f1270f81b4d60ad60 ALSA-2026:19361 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.1.aarch64.rpm c9e891db6088abaa5da753c4685cfe10cff179b03d484bec62e10ed28188a958 ALSA-2026:19363 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.aarch64.rpm 0a388c59a6eb086b5da41240b294debbef3d2c2a3c5523ba20800b2af8af5e1f ALSA-2026:19364 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.aarch64.rpm b48cbaaf45adcf11efbed7e978565c95ac92bc81e08166ab06e1a22c732e7fcd ALSA-2026:19365 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default jq-devel-1.6-19.el9_8.2.aarch64.rpm c8ecc41814c11ab3cfa1407bd1c9c2c36107b911aedd0413ca1dd2de6d703e8e ALSA-2026:19367 Copyright 2026 AlmaLinux OS 0 1 Important

giflib update

Please update For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.1.aarch64.rpm 82fed48815eb0f6cb6934fcc8bd4ff2d3c7ac7deeac7d73331114f2474796edf ALSA-2026:19374 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.2.alma.1.aarch64.rpm 35147e5b75c1ff8594439b07357a282fa317ebdaab32239e9676f88511042fa2 ALSA-2026:1939 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12-wheel security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-wheel-wheel-0.41.2-3.el9_7.1.noarch.rpm 436b6074dfdf7f27a4a5213aa406d06839c5599bd4ffee848fcac89755ee127a ALSA-2026:19568 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.10.1.el9_8.aarch64.rpm 0141f42f4ab79d804115c7db8a7d380a83f2cb343b7e7a3ed63f269ec09cc14f kernel-tools-libs-devel-5.14.0-687.10.1.el9_8.aarch64.rpm 6c0c0ec5b79584b2cd441a0294d7d179d88b103faa4bbc1e44dbb9b114da00b1 kernel-cross-headers-5.14.0-687.10.1.el9_8.aarch64.rpm b0cfb8f6625cba2fa5b193d6fdce3ab7f93e1abcdcdac35d130dd4bf717b213a ALSA-2026:19610 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libsndfile-devel-1.0.31-9.el9_8.1.aarch64.rpm f50540369c9cda9c9ef38ccfd1d883d7a1c01d1c12ef60f442a471552c55c126 ALSA-2026:2039 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default fontforge-20201107-7.el9_7.aarch64.rpm a4dcc8c46b505bff777ba982999c0889904224bff34d7f8824f1dc1a5eee1b1d ALSA-2026:2048 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.1.aarch64.rpm efdb49ce9f5a7c8394e92c4c1e861a5813477928bbe8ff0b16190d711b632d63 freerdp-devel-2.11.7-1.el9_7.1.aarch64.rpm f112643909e9fc1ca05fad5de4a9be22abe0c4cfd251b5e5ebcc220e4a460b06 ALSA-2026:20597 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nss_hesiod-2.34-270.el9_8.aarch64.rpm 424696e47ab082087804427fbde45c01d383985e63b3efa5ed58fe6b454f8c3e nss_db-2.34-270.el9_8.aarch64.rpm 4a55787c9e4a5b4cdaca9710a1359c720b963090fa552fb2e12a868327fc212d glibc-nss-devel-2.34-270.el9_8.aarch64.rpm 540ef59aa09c95f36d02b36273e9540cbad8848881e46c0f04c5f48eb97790dd glibc-benchtests-2.34-270.el9_8.aarch64.rpm 9d910bc1929835fe0b564bbfaf0c0a1dd77e64be6df1f60debdad93517b75ffd glibc-static-2.34-270.el9_8.aarch64.rpm e1f8f5abe0c55937524ca1cac3b0e21bf1d4949c5cdcedc426118a6fd0192ea5 ALSA-2026:21293 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.127-1.el9_8.aarch64.rpm 70a409f3eb580539736b522886bbdabefa1bb8ec8b88384a2bd58c9371bfd79f ALSA-2026:21296 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.117-1.el9_8.aarch64.rpm cbfdccceec498b42916dac3499e6a9f7444c3625d02010969529b7b4800998d0 ALSA-2026:21297 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.el9_8.aarch64.rpm 9d6d028266cbe62411b7cc4a568a74282c699d22117949aa7ac866d86e459cc1 ALSA-2026:21556 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.12.1.el9_8.aarch64.rpm 29b1edf089e5b6b4e139945d8e8f4be3e5eea72399a1cef1f49c6f86f5ab28df libperf-5.14.0-687.12.1.el9_8.aarch64.rpm 358ca8b7f539e500b27e2f77f8a56e87a0b89ba90727816db872e6660df8ac00 kernel-tools-libs-devel-5.14.0-687.12.1.el9_8.aarch64.rpm 9a606b41c87f6cd2f44ab72855d42e1c61d64abd51cef63f51ac215375c54fd5 ALSA-2026:21755 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.1.aarch64.rpm ad2e1c16ac8b9bcff6773541c9efad6888c3554c8bae64feda364176e5b19bc1 ALSA-2026:2212 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789) * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022) * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024) * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415) * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459) * kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269) * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.30.1.el9_7.aarch64.rpm 49d8445fd967bcdca2bfc80408257b00a275eb1addabf96e945705af8e2ab187 kernel-tools-libs-devel-5.14.0-611.30.1.el9_7.aarch64.rpm 6951df0f1ad6287a2fd461dd72dfcaca38c771e3f487cb2db57a3520008c5135 kernel-cross-headers-5.14.0-611.30.1.el9_7.aarch64.rpm 8c632458cd0378119475252f372de0d9d97d1f6c5f0b17262d0656345c792628 ALSA-2026:22553 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Information disclosure and crashes via integer overflow in Nikon MakerNote handling (CVE-2026-40385) * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libexif-devel-0.6.22-6.el9_8.1.aarch64.rpm d202fcd01b3bbc602cfd2a2db6e8ae680f8f05c8e8c629315fb0b996a440d203 ALSA-2026:23332 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-34293) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34267) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default mysql-test-8.0.46-1.el9_8.aarch64.rpm 1eb1ec1942a21d4b29866f6c4d771da1f075620f5e3b1cfe396af83645f76a5f mysql-devel-8.0.46-1.el9_8.aarch64.rpm 6572ad3f7a9f495ed209e25e87cd416b6a1370f27a054a30cfab761726fdf80a ALSA-2026:24367 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.2.noarch.rpm 61557bd6cb05170436252e5a32b80a4d838bbf099ce27f4a5fbaafc9065f9b18 bind-devel-9.16.23-40.el9_8.2.aarch64.rpm b73137f7ad810a9ebc5afbebe570e2cacb2aef9cb3d087375a5380946bcf1981 ALSA-2026:24368 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.2.noarch.rpm 68a27d03850179ffcde06f989314cd19345ba7c77add31751ac85aa364d71405 bind9.18-devel-9.18.29-14.el9_8.2.aarch64.rpm eb77401ae06335edf464011725a4347d009c1824909e44dcbc542827e2015e4a ALSA-2026:24369 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.1.aarch64.rpm 89e783b053c4c710bc0b24d39f8e234630a33e67f4c6e14c5d29b13e79c0ed89 ALSA-2026:24381 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.13.1.el9_8.aarch64.rpm 516a1993a4a26ac7490ec705cac0fe2202216507dd685ee71ad3b214cc55f219 kernel-tools-libs-devel-5.14.0-687.13.1.el9_8.aarch64.rpm 678ca3760c08aa5c18d136f4d7603f7d4eee029a22f5b179f5ff4f10adb9c5ea kernel-cross-headers-5.14.0-687.13.1.el9_8.aarch64.rpm b722ef12d45c7e641520f3724f9647dda42d5ea2b589c1c5485e063652fcc281 ALSA-2026:25049 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libldb-devel-4.23.5-10.el9_8.aarch64.rpm 06e4beaa5cf008a09af8722bd9f1c9b94d883a7d5c0990178af7edf1041e9f69 samba-test-libs-4.23.5-10.el9_8.aarch64.rpm 1ecf3652923e6f6297daae3a24b6a716f6f69f152c3b9120148ff777ce04cbfb samba-devel-4.23.5-10.el9_8.aarch64.rpm 1f7e61cde0547f7e0ac36c2bdd0be198621a104e0aa1d5641505abcb5e65b7aa python3-samba-test-4.23.5-10.el9_8.aarch64.rpm 508dc2d17f75e97e172615ce4df067c1dced5c5b43e639a42c5458c2e8dc977d samba-pidl-4.23.5-10.el9_8.noarch.rpm 82b6ede34ba8fb9ae0ea99f63c89050c550ba4960dcf6c895a11e28b43981c3a samba-test-4.23.5-10.el9_8.aarch64.rpm 90029d9fe1e83427c2eb30102a534693c528dacdd89741208a93b72f75c5f34a libnetapi-devel-4.23.5-10.el9_8.aarch64.rpm 950c497c7ff95fdd8e7526055525911087bf11e2713e33f380d6853eed63c622 libsmbclient-devel-4.23.5-10.el9_8.aarch64.rpm c45f384ee9f3daade7182a4706fed84de59bb31c9415216f169e47445a1a2ae2 libwbclient-devel-4.23.5-10.el9_8.aarch64.rpm ef2cbbe04071d1187750964cab5b8b80e7d35b3cd5a13a6ab3b5a1c99e830bfd ALSA-2026:25051 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libyang-devel-doc-2.1.148-1.el9_8.1.aarch64.rpm 003769e68a8a3f2030cc27d40239615a0683446513e853f16e8cc97ce85e85f3 libyang-devel-2.1.148-1.el9_8.1.aarch64.rpm 51d3e5d72d910f63cc85022f25e920711e8b08ff5d0584e9455714172b1cb951 ALSA-2026:25058 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default poppler-devel-21.01.0-24.el9_8.1.aarch64.rpm 294675374e04f08f2e8cf5975eeb1e7ae66f1cb08e3105d116b44a898255e855 poppler-glib-doc-21.01.0-24.el9_8.1.noarch.rpm 5d072daa7f6d715a1e707ca4de274071d907d17358f4152524745c4d42ea6ba2 poppler-cpp-devel-21.01.0-24.el9_8.1.aarch64.rpm 5d883f538662c63952c2fb8ce1b8396da5825827666083b8ac0f9a295832775b poppler-qt5-devel-21.01.0-24.el9_8.1.aarch64.rpm 79e15ca7ef70866aa42d1d2f93553f844407cf46623616a16b5a1ab1fc5d338f poppler-glib-devel-21.01.0-24.el9_8.1.aarch64.rpm e1f76d83878df74a8dbd956187afafd653da8e02e7f7aaf2de79a1c140892a1a ALSA-2026:25217 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.15.1.el9_8.aarch64.rpm 02d176ddfd5270a955d9840cdd8fcf1e30e531d293ea2d95f05cd1a72894d134 kernel-cross-headers-5.14.0-687.15.1.el9_8.aarch64.rpm 2bc959d94fa6368e7bfcb950c1f230e335bc009c9fc4718be17b12979256d954 libperf-5.14.0-687.15.1.el9_8.aarch64.rpm 9bca147f04510bf203b9fc228e38eaaaeab0d68ada0c9f7a663b173cf6424a6c ALSA-2026:25220 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.el9_8.aarch64.rpm 012a58cea17c80678b74656572d7a17e72a23fdb9eaa8d78b8811f57625ce934 ALSA-2026:25221 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.el9_8.aarch64.rpm 2a064c20296f6042fdf0476bc628fa9cb6a937d12834ad74c0ffb0fef4598b75 ALSA-2026:25222 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.el9_8.aarch64.rpm b4c49122cb6f180dbb73a431192dd67d89e319ea867b7c899176d7206a349cea ALSA-2026:26455 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064) Bug Fix(es) and Enhancement(s): * Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [almalinux-9.8.z] (JIRA:AlmaLinux-152356) * Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [almalinux-9.8.z] (JIRA:AlmaLinux-168967) * DS 12 does not handle escape char in bind user [almalinux-9.8.z] (JIRA:AlmaLinux-170269) * [RFE] Add OS-level thread names to all server threads [almalinux-9.8.z] (JIRA:AlmaLinux-174524) * Online export is failing when using the option "-s" [almalinux-9.8.z] (JIRA:AlmaLinux-180716) * Server shutdown during online reindex may lead to data loss [almalinux-9.8.z] (JIRA:AlmaLinux-183895) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-7.el9_8.aarch64.rpm d134a211878832adf06328b44d6501b2e337ff2904d77f3309acd38224f8a512 ALSA-2026:26590 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.2.aarch64.rpm 0b6e73157c21b8388d5471876f22a717d93b8bb95939843272affaebb01cbcfd ALSA-2026:26610 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security, bug fix, and enhancement update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xserver] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184288) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.2.aarch64.rpm e3533540893fa1314d23402ce3697f36aab1d7a092dd3bf5325a10b0a6aedf91 xorg-x11-server-source-1.20.11-34.el9_8.2.noarch.rpm fe8d7b998faa3cd785e1f21616963da47934a541405c9daba0277692995ea4cd ALSA-2026:2722 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034) * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304) * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322) * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349) * kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811) * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.34.1.el9_7.aarch64.rpm 27da26bf822a261bb3200449257e90a6d10f995909d2491b6c36b2ffa1d71863 libperf-5.14.0-611.34.1.el9_7.aarch64.rpm a48a3712213ff0fd763cdddec7b634cb4197c3f56ba3a8b5fe9b728c1680c1b0 kernel-cross-headers-5.14.0-611.34.1.el9_7.aarch64.rpm cb8d6d82647f58219605ff8be6da679fdd6ab11d288d9e53e080e8aefe26edcc ALSA-2026:27741 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default postgresql-upgrade-devel-13.23-3.el9_8.aarch64.rpm 04bea973e8bb347fd9a146d1d5cf25df04f2ae813b6be8698cba13a07fd9061c postgresql-test-13.23-3.el9_8.aarch64.rpm 2b6c0b3a902c4c1acc125f6c9576b572d84c1c618e0a6750c466c689b62b34a5 postgresql-docs-13.23-3.el9_8.aarch64.rpm 4ce1e4bff056e56388c905348eb3a71933aa4cdb3224acf19844990e3bb3025f postgresql-private-devel-13.23-3.el9_8.aarch64.rpm 9a0ba79796d0f80c2fc17fbb6c8846741893a72f6012f49cde7ca4705397b318 postgresql-server-devel-13.23-3.el9_8.aarch64.rpm f3c3c431e411058123f1c0c85fbdf9f18c1b0542af8fec22c7c52678b660ee1f postgresql-test-rpm-macros-13.23-3.el9_8.noarch.rpm f6060fb4be90b694977de0b268823c300ea7bb804cc5da4363f78ccda9909d03 postgresql-static-13.23-3.el9_8.aarch64.rpm f7eedc8476869536d7bce08829768b24080c7756f9ef0d25a9fa05ee80518f79 ALSA-2026:2776 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default edk2-tools-doc-20241117-4.el9_7.3.noarch.rpm 4b87347bffd1678e7310392c107ce78ebc719dac11d389efe0562315bfe5e98b edk2-tools-20241117-4.el9_7.3.aarch64.rpm 84726fc8b0d507378a0e9c486f709b74f0cf8bfa91b32ca7e66beb08b39251f1 edk2-ovmf-20241117-4.el9_7.3.noarch.rpm b5e7af0c61e51f6617ef9d9b9ae4fc554d01d0de332dade45c8bb7304457a20d edk2-aarch64-20241117-4.el9_7.3.noarch.rpm c529f43a57b1378db756550bd605d19c555f6d0c4d1b8d34861e2a5c1bfb655e ALSA-2026:27789 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048) * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699) * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820) * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823) * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308) * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.17.1.el9_8.aarch64.rpm 162d77d72cca785393a2380cd11c4c9897bfafbbfbdb74c1ebfb1e0d2efdbfce libperf-5.14.0-687.17.1.el9_8.aarch64.rpm e5da8a0653203f211fcd3e31b65c91d7a1af86341d6214663b7b217b1ebd1048 kernel-cross-headers-5.14.0-687.17.1.el9_8.aarch64.rpm e7a6ca6f61e630895c23f7e2f5eeff402869c7ae056888e44f8da05f80ff298a ALSA-2026:2786 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861) * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915) * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default nss_hesiod-2.34-231.el9_7.10.aarch64.rpm 2db55aa8bc88c10d7f9724c9a806e9ae469d60fa036d224c70fdbd43cdae433c nss_db-2.34-231.el9_7.10.aarch64.rpm 8a1d986c4e1c667aeecd5efb44682bea47cb02d08f1ccec401bfe4b25e17e03a glibc-nss-devel-2.34-231.el9_7.10.aarch64.rpm a979455516cb944d0e7608dd5849690f4655cec5d11147a7741b46edf832c949 glibc-static-2.34-231.el9_7.10.aarch64.rpm b8708c2b541109cc64b6880e36a656de2e1200075267f98402e117f2cf2342ae glibc-benchtests-2.34-231.el9_7.10.aarch64.rpm dd490062c7b0d08e34b304cec6c8e1c83856b38ae4ec19bced1c540aacf9ed9b ALSA-2026:28247 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.14-freethreading-debug-3.14.5-1.el9_8.aarch64.rpm 06826c821149eb2956dbc2c0ba7d55033c8ff8592713e4192a174ab998c13df0 python3.14-freethreading-libs-3.14.5-1.el9_8.aarch64.rpm 4c4d4958119abaa3f7cbd8d9758b9c4e00bf6c4b586d8af0217dbf4ff140fef1 python3.14-freethreading-3.14.5-1.el9_8.aarch64.rpm 61563160c6493ee3e83613f5dcfe22d9f992cba95524a1e45e9c1ff7b9b78661 python3.14-idle-3.14.5-1.el9_8.aarch64.rpm 6723d0a345a7279537dda0b7ab185c4470de2a50c50d1a6b4281809ce06107d1 python3.14-freethreading-idle-3.14.5-1.el9_8.aarch64.rpm 78a399e27d98a284aedc5a02f52fde52f58731461058acb702d02a55491c985f python3.14-freethreading-test-3.14.5-1.el9_8.aarch64.rpm 93f786808fb5e3936ed8c6f29e08f06c701c9dd1d55b6d8017ac70beac016333 python3.14-test-3.14.5-1.el9_8.aarch64.rpm 9522b33c0ae84bdb8ae7cb9285f22caa217ad9c57153ab4f080b803cf5ee72c8 python3.14-debug-3.14.5-1.el9_8.aarch64.rpm b2d188b46539bd4f4ab2f118f87aec6fdd41edcfed2e92891c455241653770a3 python3.14-freethreading-devel-3.14.5-1.el9_8.aarch64.rpm e2d601fa8b02cd6021f0400a1244ede2758928ef068a9754c0746f03f14434a1 python3.14-freethreading-tkinter-3.14.5-1.el9_8.aarch64.rpm f0f7166f50024d563fc8da68135031ca6c6b4b134d6a3ea42bbd7f4f20e2b587 ALSA-2026:28256 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects (CVE-2026-40253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default opencryptoki-devel-3.26.0-2.el9_8.2.aarch64.rpm 2b892887a3fcffbd4f28663b56b526c2bd5269e6c614459866d5c084e58ba4cb ALSA-2026:28973 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.3.alma.1.aarch64.rpm 22bf16a0601e4e63e841c7e43e546695a0ddd72f7a09c599ce2ca906278d13e1 ALSA-2026:3034 Copyright 2026 AlmaLinux OS 0 1 Important

munge security update

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): * MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default munge-devel-0.5.13-14.el9_7.aarch64.rpm 81890fa22cd838d4f887ec4687eeb1ddcda3987965f01f431ed4ea7267493bdf ALSA-2026:3066 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: page_pool: Fix use-after-free in page_pool_recycle_in_ring (CVE-2025-38129) * kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.35.1.el9_7.aarch64.rpm 55fcc6ce578d0eb3401393d278a61cd00e49eae26bf85c34ff4e12a64cb9e835 kernel-cross-headers-5.14.0-611.35.1.el9_7.aarch64.rpm 8278a9c3db0b0520e77093bd4bd4c1971f66d7a50f074a1d6e6173fc12b60378 libperf-5.14.0-611.35.1.el9_7.aarch64.rpm fc8f6d6d4fdc825d7bacf18fff25128501daa8737f95d8925f51cf4166228c9f ALSA-2026:3067 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855) * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.2.aarch64.rpm 3bf238690acb222b048742f76772a3024d7ed2751732bbad0567460e6479b0be libwinpr-devel-2.11.7-1.el9_7.2.aarch64.rpm 44519880dc17c3369c8aca5d6575ae29ef2041549d4d3b342b4bd3011aa8421a ALSA-2026:30848 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:AlmaLinux-169057) * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [almalinux-9.8.z] (JIRA:AlmaLinux-172993) * nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [almalinux-9.8.z] (JIRA:AlmaLinux-178273) * sched/fair: Skip sched_balance_running cmpxchg when balance is not due [almalinux-9.8.z] (JIRA:AlmaLinux-182776) * [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [almalinux-9.8.z] (JIRA:AlmaLinux-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.19.1.el9_8.aarch64.rpm 8bfb990997eb5185b3bdbb03db1f9f7702103d3fcb7ec33319ea9e173bbfa4ca kernel-cross-headers-5.14.0-687.19.1.el9_8.aarch64.rpm dd4426f6e5d47dc898b4cb6ef34d21c280399b118ea0ad346c3bc8249e6f3ba7 libperf-5.14.0-687.19.1.el9_8.aarch64.rpm e5ebad81e96b35184c3e95c5f6033fadc84348a565a34e5569dc65e5182ab43b ALSA-2026:3095 Copyright 2026 AlmaLinux OS 0 1 Important

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default protobuf-devel-3.14.0-17.el9_7.aarch64.rpm 0e6b419549810570c4148fba25b366e127fa621ef88106692468d712c3d2398a protobuf-lite-devel-3.14.0-17.el9_7.aarch64.rpm 94f5e02564089f632ef26fbe6cb0d361411712dd625e07bffb28bf8197fb02cf protobuf-compiler-3.14.0-17.el9_7.aarch64.rpm a4c3985dddfd582565b337ee3cb88a47ea56bfdc2872bc77e64f8e55032605cf ALSA-2026:3189 Copyright 2026 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default 389-ds-base-devel-2.7.0-10.el9_7.aarch64.rpm 4297f062da29b42567a84e6abbbef47fa980764b676c000ff8bb6281b89ddc90 ALSA-2026:33226 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * glibc: counter overflow in __wcsmbs_clone_conv if setlocale is called (JIRA:AlmaLinux-145156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default glibc-static-2.34-272.el9_8.aarch64.rpm 366dc10268905fa4a7dc19d6009e9bbfb049c7e7d7845d49ec5e07846f46c82e glibc-nss-devel-2.34-272.el9_8.aarch64.rpm 4fb4a586bde6b1cd7630773263148a57b3aafa66ba4340251e522501bbc14086 nss_hesiod-2.34-272.el9_8.aarch64.rpm 58b13c5b477a972e1c592da72e2dbeb0bdf5b185ea39f6fb95aaf55edd48408e glibc-benchtests-2.34-272.el9_8.aarch64.rpm a607e53fb6c52e33b251825548b9713ac96dda0049888131be26ee3569fcb26d nss_db-2.34-272.el9_8.aarch64.rpm bd1e7236c15ffaef2f6f06c8f0488e45f9dbaa04feb8ceb19ae066362c007171 ALSA-2026:33285 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9.8 Bug] qla2xxx flash image validation failure [almalinux-9.8.z] (JIRA:AlmaLinux-181886) * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-9.8.z] (JIRA:AlmaLinux-182540) * tegra-se fixes and updates [almalinux-9.8.z] (JIRA:AlmaLinux-182760) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.20.1.el9_8.aarch64.rpm 67a639a651a6c2f2f3e22455b7ac44e356745a4a8299c0e266ae844ea178b935 kernel-tools-libs-devel-5.14.0-687.20.1.el9_8.aarch64.rpm 8ca059ae67dc40e94baa2e1a5e0c1b26bd5b10bd0d904cfdb71ebe1f1ee6afa3 libperf-5.14.0-687.20.1.el9_8.aarch64.rpm f59962e78386fba4abd7895f6e21c91d3b6c966bb7e250a89fee750309deb069 ALSA-2026:33501 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.2.aarch64.rpm a3bd342bd20e4804eec4b1e9f7d51361061db3e247dd3660e5d022d9d633e976 ALSA-2026:33512 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default ruby-doc-3.0.7-167.el9_8.noarch.rpm b8f118e66d4cfca0e379d47fc279003251a1a7a6c5748e8cd32d51a663c369af ALSA-2026:34156 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default rrdtool-doc-1.7.2-22.el9_8.aarch64.rpm 063ccbf7d71216c657f4b28ed5726049d4f56e57a9f04d2dae4614b3eb8087bb python3-rrdtool-1.7.2-22.el9_8.aarch64.rpm 10ea24df3887cc1499d54725b92d1111f81d5902d1e57c4990e91d662b805cdc rrdtool-ruby-1.7.2-22.el9_8.aarch64.rpm 2c4980beac8b203517c17cf579bb97935117a5459ac32cdfc89b7aa5b46d0b39 rrdtool-lua-1.7.2-22.el9_8.aarch64.rpm 4f51a4f0b77f691f559c5596fb3d68c9a4bafd32ad2bed2d981ee740db5166c3 rrdtool-tcl-1.7.2-22.el9_8.aarch64.rpm 5fc7a7a443be6ec18ab3b8a2e2340a33b320e3416bf7df37bee305978ea9e0ae rrdtool-devel-1.7.2-22.el9_8.aarch64.rpm ec92429c249ccbdc5905764f622cbcf2b1a2af5a1dad014ccd2c29ef76771ee9 ALSA-2026:3488 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.36.1.el9_7.aarch64.rpm 06db9566810299449d27d7bb76952c929da7ccf4dc472199989e4983629ede85 kernel-tools-libs-devel-5.14.0-611.36.1.el9_7.aarch64.rpm 95a3e741c2f442c7c9772cc0840b50d90354ad98647a6cc1588b15a6fd45d060 kernel-cross-headers-5.14.0-611.36.1.el9_7.aarch64.rpm b500d710670e1d20be5474d7c1d4337e3daf769395c94ddd358e2951dfc3330f ALSA-2026:36018 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [almalinux-9.8.z] (JIRA:AlmaLinux-160966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.22.1.el9_8.aarch64.rpm 3c3f4ee738d5bdb92b3d1cd8ded3bd97cec104762a9974b651f624e37cfd009c kernel-cross-headers-5.14.0-687.22.1.el9_8.aarch64.rpm d05000a82ff9b4d0f3e4e33a33279248a2a32c6a7d635ca1421f4b89e9e801a0 libperf-5.14.0-687.22.1.el9_8.aarch64.rpm fd8120737e9ba43ff60f87a12c5d524f44cc0035f13369b03ceee7b82eaf7782 ALSA-2026:36187 Copyright 2026 AlmaLinux OS 0 1 Important

perl-HTTP-Daemon security update

The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests. Security Fix(es): * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default perl-HTTP-Daemon-6.12-6.el9_8.1.noarch.rpm 7ccd0b8da3d5b0145c065678e99330c75c2530fc2eb51d3841c2d6293f6eb0e9 ALSA-2026:36195 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-8.el9_8.aarch64.rpm 880297aa8ecddb96edd604066e4c7c1ec5bc74ae8af8e4c034b97e6255844bac ALSA-2026:36210 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default freeipmi-devel-1.6.18-1.el9_8.aarch64.rpm e3b75a35430888708ff0b38fd548d626e81715d07707d4666df06532d15276de ALSA-2026:36331 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-9.8.z] (JIRA:AlmaLinux-190800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.4.alma.1.aarch64.rpm e2d38a3fb2dbb959d4bf9800c9408419316462464f68b5e864bd4bcd06ff9d88 ALSA-2026:36645 Copyright 2026 AlmaLinux OS 0 1 Important

kernel update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) Bug Fix(es) and Enhancement(s): * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite [almalinux-9.8.z] (JIRA:AlmaLinux-182344) * [AlmaLinux 9] Bonding reports unknown speed/duplex for tg3 interface [almalinux-9.8.z] (JIRA:AlmaLinux-182768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.23.1.el9_8.aarch64.rpm 4c5949fc21db8783c1eb5ae889917fbc0f0850e936501c76932503dfe7890733 kernel-cross-headers-5.14.0-687.23.1.el9_8.aarch64.rpm 78299a52db997d8334e8ca4f2655d8be1ea242f1cc70d59b0f34a857e81f389d kernel-tools-libs-devel-5.14.0-687.23.1.el9_8.aarch64.rpm dec3c240935248d1e7c1cc6eaf4fa30af8aee03fc67709c66b746735d2422c4d ALSA-2026:36777 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.2.aarch64.rpm 612d17398514ef6953d5075b477cf7261a8ea7255d516011bb94795b29fa7e96 ALSA-2026:36834 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.aarch64.rpm ec03a93b8fe6d828b15e7a3c4c4651aabd1dbd459a84e7396781423c751d24b8 ALSA-2026:36957 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.24.1.el9_8.aarch64.rpm 0ed6c2085629e6b46ccd577da1b9de992117aead8d1399a5e330000d2aa434b3 kernel-cross-headers-5.14.0-687.24.1.el9_8.aarch64.rpm a4fd10704ba8bde669f68c3d613bfed5dc6d9bf9975606d417733f613d07ad19 libperf-5.14.0-687.24.1.el9_8.aarch64.rpm cc287bfbf801cac7b697de62151a5ed8416856d2f2abd921b1404b2f21449de1 ALSA-2026:37207 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.4.aarch64.rpm 05431a7d3796b989124d768156062ab5e7acab1649c57629ff871b78cc2e0275 libwinpr-devel-2.11.7-7.el9_8.4.aarch64.rpm 1c46a490f2fdd0bf296fe9cc4545e0bed61398300df872c0f5c3ecfbd3833323 ALSA-2026:3730 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default postgresql-upgrade-devel-13.23-2.el9_7.aarch64.rpm 2934f9d6d0a29de3eaa483ac9a5113ea0bd125c949f6759bd0a1689715e9e1d4 postgresql-private-devel-13.23-2.el9_7.aarch64.rpm 47b0550a10a78655f9b836bd34e5d4da55653c7a10328390878cda8b33fc2114 postgresql-test-rpm-macros-13.23-2.el9_7.noarch.rpm 9bc6f1d37d6520e5f2e03b04c3ae18345783ee6bd8725a4785f7fcfd8df0d299 postgresql-test-13.23-2.el9_7.aarch64.rpm aac9e14cea3697cdc6e53465c762729da19aecc875497061aff48df3f594963e postgresql-static-13.23-2.el9_7.aarch64.rpm ab8f0148918c86afa45b713d33111c1f850eb7f685aa3a44ce2177c7894895bd postgresql-docs-13.23-2.el9_7.aarch64.rpm ae38596a468439fddd4ff09d0efd6422797e7e2c7dc5d736207164a134390eda postgresql-server-devel-13.23-2.el9_7.aarch64.rpm d1b5875706320436f94c2b683a2683ae826cc5608947130f75bc764d30b450ed ALSA-2026:38486 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.3.noarch.rpm 48499a138a6f93c1ab1264a01a39bb13c0536e0479c9928d112ae873477ec932 xorg-x11-server-devel-1.20.11-34.el9_8.3.aarch64.rpm 7d62bd940b44a8fc3ec71518d4973ec7c532ccfc8efbbb3377b0f182328d725d ALSA-2026:38490 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3.aarch64.rpm 28b79f350322e9f247c953dbeced400b908cff01dd6923112b74bf63e69368ca ALSA-2026:38491 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) Bug Fix(es) and Enhancement(s): * Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.25.1.el9_8.aarch64.rpm 6f87bb5e96ad924d8b77e4e05813411c5b38db368a737a2855676284d95b351f libperf-5.14.0-687.25.1.el9_8.aarch64.rpm 7eca34bdb75d871ddf0b230f51f786ca3bdcf3bd0fdfbc71adffd700b6056b3d kernel-tools-libs-devel-5.14.0-687.25.1.el9_8.aarch64.rpm db6269630e9f415f88f321760c1697af6ad5a320f4bdeb26d53d7bd60533689a ALSA-2026:38498 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.3.aarch64.rpm 5500d902c416a7ff07fd1d4dc3943667c3642e3f3a08d25aef8bc3ecaa52861d ALSA-2026:39309 Copyright 2026 AlmaLinux OS 0 1 Low

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-capstone-4.0.2-13.el9_8.aarch64.rpm 592df109fa78f925c07972867e13b809588576d141a69eb762a1170d8230bc9d capstone-java-4.0.2-13.el9_8.noarch.rpm dc79dd0cf954c31a91b07d6c72a509f4dd1e0d453e13741b7bc54e876124392e capstone-devel-4.0.2-13.el9_8.aarch64.rpm f91ce0f6d1554c8a91d4f40661111ff8ee43f3302530123ca5d03c580cb6c86c ALSA-2026:39315 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libsolv-tools-0.7.24-6.el9_8.aarch64.rpm 0fa4bb7b665c7617706df93a95bfc62fedbbd7f1db7723da7aa7e9486c464bca libsolv-devel-0.7.24-6.el9_8.aarch64.rpm 6b61a7c6443647c3428dc7a659607548a758f2add3745d7811fd0cedcb2fdd0d ALSA-2026:3940 Copyright 2026 AlmaLinux OS 0 1 Moderate

nfs-utils security update

The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools, which provides better performance than the traditional Linux NFS server used by most users. These packages also contain the mount.nfs, umount.nfs, and showmount programs. Security Fix(es): * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libnfsidmap-devel-2.5.4-38.el9_7.3.aarch64.rpm e07513f627e53d1760545bf6c9540524a6fa7f4aab8851ae9ada8d25dbd8b506 ALSA-2026:39576 Copyright 2026 AlmaLinux OS 0 1 Important

cifs-utils security, bug fix, and enhancement update

The SMB/CIFS protocol is a standard file sharing protocol widely deployed on Microsoft Windows machines. The cifs-utils packages contain tools for mounting shares on Linux using the SMB/CIFS protocol. The tools in this package work in conjunction with support in the kernel to allow one to mount a SMB/CIFS share onto a client and use it as if it were a standard Linux file system. Security Fix(es): * cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (CVE-2026-12505) Bug Fix(es) and Enhancement(s): * cifs-utils: regression with kerberos mount [almalinux-9.8.z] (JIRA:AlmaLinux-192982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default cifs-utils-devel-7.6-2.el9_8.aarch64.rpm a752dd604c1a425ee27b7f08c02395a06159f4670cbad533ce34e566fbb74b2e ALSA-2026:3966 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.38.1.el9_7.aarch64.rpm 05314b62664c93dea9c55ebfad2a1364e2b98d040fc8d5a91e3055806c777a91 kernel-cross-headers-5.14.0-611.38.1.el9_7.aarch64.rpm 9b7c6d1967730f1cc47d1a9c38be691693997ccc4ed0c7c80d36552ee8c2b042 libperf-5.14.0-611.38.1.el9_7.aarch64.rpm c62e7809722c2ff4c7a71d1b59152ee3965340e64c1e9c5117f092173664ef8d ALSA-2026:39771 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.12-debug-3.12.13-3.el9_8.1.aarch64.rpm a37be0ec37a1fb47291dc0d42b88176964f207bf33eb62d26bc55d5c28cbf821 python3.12-idle-3.12.13-3.el9_8.1.aarch64.rpm d47a1dec0b9e4bb4df886f8921d0ec9790ef71582dddb4bbf80709ff74ad48b9 python3.12-test-3.12.13-3.el9_8.1.aarch64.rpm f9ae29ff3a6854e2d573e775e5eaa2895a94f9d61dd2907bf90390f5f0e6e87f ALSA-2026:39798 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) Bug Fix(es) and Enhancement(s): * python3.9 test_ssl fails ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192) [almalinux-9.8.z] (JIRA:AlmaLinux-194207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-debug-3.9.25-7.el9_8.2.aarch64.rpm 4f2dabaa1fc72624e8d3b3183b7ace850130d6da44d91e0ec6d16f8666d09dcd python3-test-3.9.25-7.el9_8.2.aarch64.rpm 893fc5063585a0ef38ac0fa86c02c51caf9c5b3cdb7a161266e261c67a86baa2 python3-idle-3.9.25-7.el9_8.2.aarch64.rpm a8b4366c67e56cec32552f66604dbce969157e18b57f9db54b009e7ed85b0961 ALSA-2026:4165 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.1.aarch64.rpm 03dadd62ba4fee0bcb27fa170fee41faf24235b459bb6b22a34064d4124a6af7 python3.12-idle-3.12.12-4.el9_7.1.aarch64.rpm 24311fbf46a8385a315834a8583765a4d46e02a599f29ee38be54e04338a39d9 python3.12-debug-3.12.12-4.el9_7.1.aarch64.rpm d83d5a8c8fbedbce1170ce0754b48785ec5ee3f44380b34c7958a6f5d2479059 ALSA-2026:4168 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-idle-3.9.25-3.el9_7.1.aarch64.rpm 2f39435e0b1221545ea3e0aed3dbbf73847ef85888cc59745904588e1d160392 python3-debug-3.9.25-3.el9_7.1.aarch64.rpm 606e09d024c8d37d2468c4c45b5453c931ca1116e2139450ba19bd5d4d1f221f python3-test-3.9.25-3.el9_7.1.aarch64.rpm cabf00f3fdd768721eec883eef2b320de9ef626f748a2b91e38dbf40973ab1b0 ALSA-2026:41894 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.aarch64.rpm 5a416437de77e57bbc5ab511c4c4f2b3ca1d56c935fee51d1d6601ddd7ee4f3e ALSA-2026:41896 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.aarch64.rpm b4193cd2e9507e1b1c3fa604ce96cb6c54a7df41b7b515682fc583cecae4bfae ALSA-2026:41898 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.aarch64.rpm 4aa4c36e33393554bce309d5da05519be1e0773d4f584a88de3680aa0c1c4aae ALSA-2026:41905 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.1.aarch64.rpm 4eac150ea9102cc32fe3a2c3a504475b483568324cd8769cd2d044f0a9eee6b7 ALSA-2026:41949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.14-freethreading-debug-3.14.5-1.el9_8.1.aarch64.rpm 0953c49593a5d6cc9510f406768dc97fd193385810a9678cf2824c888a93c33c python3.14-freethreading-3.14.5-1.el9_8.1.aarch64.rpm 0a1b15bc8d70ed35500b222ab9ad9cc6eddc55abce8345121bdbd5691272326d python3.14-test-3.14.5-1.el9_8.1.aarch64.rpm 0cdb3074379246dcec61ce2fab236ccf5be0b33f1cc4141fe14e085e8ae86aab python3.14-debug-3.14.5-1.el9_8.1.aarch64.rpm 2ec41cc6e45ecdbafb6bfc2ba9bd04f7a6ab3efa9ee72e9d80a166145ca76d76 python3.14-freethreading-tkinter-3.14.5-1.el9_8.1.aarch64.rpm 5497b57701c188fffa403dfdbe8ec40b1616f373331dda37e24e2b9bf79f0d98 python3.14-freethreading-idle-3.14.5-1.el9_8.1.aarch64.rpm 99eaab2ef3bc0d7f6bdf6fc312f3f6fd8589a9a6f6d1efb5266301cfc3fe4ca6 python3.14-freethreading-libs-3.14.5-1.el9_8.1.aarch64.rpm 9fc641adccdbe3e78e7bc8f7b1ea83211ec3cf7987df5f6e456c2697acdf4a6e python3.14-freethreading-test-3.14.5-1.el9_8.1.aarch64.rpm b1021efeb75b14718cf0cdc86a95d18c49cbb32d2b7c66b6edde6401aa87de88 python3.14-freethreading-devel-3.14.5-1.el9_8.1.aarch64.rpm cb1af6bf74783a73c27bb8eb92056a9f5abc14e52a3ee70cef06ec5fae924ed6 python3.14-idle-3.14.5-1.el9_8.1.aarch64.rpm e93a17b940ad6e44ad3d36ac751b6292681c18cbb0b6902f800fdd2a050d6df3 ALSA-2026:42089 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.2.aarch64.rpm 8daf1dee703d6b0c6d01ed452331af4757f956a735570816d3e96164c2e6c618 ALSA-2026:4216 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.11-test-3.11.13-5.1.el9_7.aarch64.rpm bd5e1abc39d752e1e092f39d8c42a2369c8a6a774cb3026569a25784041c364f python3.11-debug-3.11.13-5.1.el9_7.aarch64.rpm d2584b7b4d5b93508b1c4898a373751a720268a8525971c4ed93b9c60cba7e09 python3.11-idle-3.11.13-5.1.el9_7.aarch64.rpm dae354b6779c03ef86e188a69eb83e2a9fe56b5fa6e02f99d9e6c916134920bb ALSA-2026:42668 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.1.aarch64.rpm 43c847e0ad74e3b255dd389d5e5583f71df041fba046a4c7609ea4e1f2e9dd5a ALSA-2026:42877 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Improve Nashorn index handling (CVE-2026-47057) * JDK: Enhance Dataview Implementation (CVE-2026-47058) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212308, AlmaLinux-212309, AlmaLinux-212310, AlmaLinux-212311, AlmaLinux-212312, AlmaLinux-212313, AlmaLinux-212314, AlmaLinux-212315) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212319, AlmaLinux-212320, AlmaLinux-212321, AlmaLinux-212322, AlmaLinux-212323, AlmaLinux-212324, AlmaLinux-212325, AlmaLinux-212326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-1.8.0-openjdk-devel-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm 18183ce7ef4b99267035cef2a0531aeb900d4a8ecc66e7a7ee23460527846056 java-1.8.0-openjdk-demo-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm 45517e32802928ee4d499376c22f29e807116dace85717047ae490614f6ba368 java-1.8.0-openjdk-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm 6221154fdf1c060f3d0a10ef13a03d3af5ca4d0fae400c08449391121b10f1e6 java-1.8.0-openjdk-src-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm 6e867d00181880c0eb014c0f3fd811f2749e0762b4ee6c27c3190bda95cde811 java-1.8.0-openjdk-devel-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm 7f5041cb56bbec953784acc1248c052021785b906ee5b2a8ac959138c2bd0655 java-1.8.0-openjdk-src-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm bb6759bbf72dc38ec3f3498df54a8a81c1d94b499b7f031d885fe23be955f08d java-1.8.0-openjdk-headless-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm bc3139290842801f265c0df97cac12caeeff48d48fa0a33e2e2cb3fbd32fffa3 java-1.8.0-openjdk-demo-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm ce549db3718c9316a32dc53904a7abc55baa39f1b69ab96581e34595069afe1f java-1.8.0-openjdk-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm f312750d0f6fa12c07b505482b5e94c6f9b2c0d9255f139fe860a1b3512efc08 java-1.8.0-openjdk-headless-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.aarch64.rpm f3a06653ec7fe3370c5f07dc50308d8eef54df96fa6c9a93bf18d7a8c7c31d27 ALSA-2026:42887 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477, AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-17-openjdk-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 2bcd7b7c7b89f7e62b046d93c0eb9814a889207053d1196e9cbf2b5f3eda9c51 java-17-openjdk-src-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 2e5e27f25944580aa7b64615b99302d40780c5bb1714353bc654f9e49f0d74ec java-17-openjdk-devel-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 3b3b6d42c594ef94580a0b4f625d552b22c3ede73128a82b95926a3eca8c0fc1 java-17-openjdk-jmods-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 3c70344d64abf0f113145a5231731a5e6ce93689efcc94952eb749c41ef5eadb java-17-openjdk-headless-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 40d369f32cec677ffdb52d361451001c9b077b42ae40b3750e3bc09251497a87 java-17-openjdk-jmods-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 69d3a0df79bd64c3b82a053272ef66ae7a5e28afe3aae0522020895f807169ff java-17-openjdk-demo-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 745f7b99bebafb57dfbc368134c2deb46a0e6c4dbdcf4b25e7e1215ead6ff96f java-17-openjdk-static-libs-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 7877303359d4ec8aba60ad34a4d5d5d5abcddbd128872f70349fbe3fa3c99e02 java-17-openjdk-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm 9f0f4eb3f7a318c5f170e0c8ab67e63efa6f366ab993bdf9372d27117af9fe30 java-17-openjdk-src-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm a6db9671f4713852c38e8b9240b75c306f15a8ded7accd7fd9f0b9e431d7139a java-17-openjdk-headless-slowdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm b52a9127441f10265162579589134f54cba25cf840e6b0bf9847958c47be0754 java-17-openjdk-devel-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm bd359676addae3485a45c54e3acc88cead462529e75adb89cd5f0be46817407d java-17-openjdk-demo-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm d5dfbf5adbefc716823b361365a1a5dcaa5496f32d41bf200eed7dab1d22396c java-17-openjdk-static-libs-fastdebug-17.0.20.0.8-1.2.el9.alma.1.aarch64.rpm f081a394bba662330a920a176df72a2383ce594c98b7d3c7903b1f758665fd54 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-21-openjdk-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 13d9d1e930333aa66031abdf399fdc93a13087a7dbab385e7cc8dadd8995ee81 java-21-openjdk-src-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 24f258b2ff3e75b5ce7268b6f87ff2fd485bfd4928615a82811ddf1d6e290d03 java-21-openjdk-devel-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 350bd2f3e2f7569675ff72670e9e4fd3b3a10506aabb8780d54cc4c53c27868a java-21-openjdk-headless-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 40ee824d7f34cf920659f6c359e6c842e7ebee6b6cd9ba47933097a15a34ee24 java-21-openjdk-static-libs-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 523d4b6c51f5812cfc3840361acb3dc5688ce2d273eb5598df62865662fa5c7c java-21-openjdk-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 546f6fdbee72462129eee9dfe5f7c01536f5762123a58d03b6a308099b24179d java-21-openjdk-demo-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 735974fbfd205a3bff9d47d6cf31c8467b8b67a61a8c57fbbd372ef3fbbd4a8a java-21-openjdk-demo-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 81debabaed9c70a8e67cbe4e45046a77a0a857d4021615c088d08cc08c7c9c66 java-21-openjdk-static-libs-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm 9c22798e04d9288ed65c5992879ab27d758b8439a086f6a6888ac6d257d5cf0c java-21-openjdk-src-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm a3f1cc83fae2c087ea0c19d57073be218548f38ebe971a3aa90fcaea609ea59c java-21-openjdk-devel-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm ae96c90c78659d67057cfb4d4a0459fdea0ffc57b979b355d4e500f3758115d2 java-21-openjdk-jmods-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm b03c73e5838cbb755bb1f07c07c14c54a1035e34db03576acc1380a8aa6518d4 java-21-openjdk-headless-fastdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm ef831eead4ccabef5f27612309cd47c82dfd57973f36e4d20342a30a58ca19f8 java-21-openjdk-jmods-slowdebug-21.0.12.0.8-1.2.el9.alma.2.aarch64.rpm ff7546409aae19511a31aeeb77af1663fab970e84e33e3e59f2f5d0f61361861 ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-25-openjdk-static-libs-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 14aae0b97db7068f9092c40a430b137359568ac98390c7430efc18e853f60b7f java-25-openjdk-headless-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 311d3f0ae217bee04320d3375dc546f72f8abd3ad6d4c8e20bd28d098a725bf1 java-25-openjdk-src-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 32a4ef6d6ba51a9a06b735818d14eca407f6d43150d1dbaaf88a40a50c636738 java-25-openjdk-jmods-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 3ca4ca51c224397783a28030e92df43c0b7cf8177ceeb0e009e927d44a3cb84d java-25-openjdk-src-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 435ce2bc48621d302cdb9a66e881905154278803a09a1f69a9c16fdf9567cb07 java-25-openjdk-static-libs-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 528ed458fdc70d2498d0d2e274dd591d6596f92e62cfa673eb38ed731919912d java-25-openjdk-demo-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 5fe342da16b5b08bc9fc92a9930f1be20fce974ba0dcad5602af24105f6996ed java-25-openjdk-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 8c85c4d3d9b18366890a2ccee21c3950dff00d073572e322e2bd926c77a0ed0f java-25-openjdk-headless-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 9717878ce5f859779fadb7a44f72018cfb9128b5e22a0a4404a0570fb1dbc72e java-25-openjdk-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm 9906e61bc28ce7f14aaa8cff63d4fbd3aecd6a0dfb5ade026cc9d1581ac6b155 java-25-openjdk-crypto-adapter-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm a7d0afcdee5abbf955a17de0d7e74683586f11c7d6e23445977df1fba424a523 java-25-openjdk-devel-fastdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm b8c438fcf6f8390f3bd7a68c93abde1e3c682f3cfdb09d98da9191103ad0a347 java-25-openjdk-demo-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm cd42254c715bccc846c8a9f60a68868b52b02c186d9f4d2daef31f830f355d30 java-25-openjdk-crypto-adapter-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm d215430551b0b17f83ce963c8e80e353e38c37c7634c7d82aea02beb06e77e1d java-25-openjdk-jmods-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm df1a411d7f2c2942877abb40ec40dec7fef59a921f644520a7af7b08a5ccda81 java-25-openjdk-devel-slowdebug-25.0.4.0.7-1.1.el9.alma.1.aarch64.rpm f288a43dfe1b2028c511f4ff0c870f2dea9dc6f03c83ea9f2a7e68c85ca6421f ALSA-2026:42952 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nss_hesiod-2.34-274.el9_8.aarch64.rpm 0fb4ce1913652c7bd6b6896bb761e383b942497a639f395c19421be94a35a78e nss_db-2.34-274.el9_8.aarch64.rpm 390255fad0d7da4e1eaa95c096abdf75e50c775b3f2157ce1f5399210af8c079 glibc-static-2.34-274.el9_8.aarch64.rpm 83088b64de902990044bc943398a2772f101740c89bc21ff643f658b85b0475e glibc-nss-devel-2.34-274.el9_8.aarch64.rpm db687a79f1ae1bde36a6498162f70e136f67c9ad7217fafb1f382fe382edf814 glibc-benchtests-2.34-274.el9_8.aarch64.rpm e59070ad808f44fbb348fd97ff7b5c272ae8d61b3db345b62fe56f3f70083631 ALSA-2026:43307 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-9.8.z] (JIRA:AlmaLinux-183980) * [AlmaLinux-9.8.z]: mlx5: include bug fixes (JIRA:AlmaLinux-188121) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-9.8.z] (JIRA:AlmaLinux-212061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.aarch64.rpm a65c9c11a7a2a412d39ea9835469bc4472453164780f3548c5da2fe02e2a0fda libperf-5.14.0-687.29.1.el9_8.aarch64.rpm d0d49e568debe5a655ff75535dd75e1932f733b608bf4070ae5de5b069346afd kernel-cross-headers-5.14.0-687.29.1.el9_8.aarch64.rpm f87e718c4dd28e5d20248190f9f380eff5c7abaeece845fd56a2c889d43fb2a3 ALSA-2026:4445 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default dotnet-sdk-10.0-source-built-artifacts-10.0.104-1.el9_7.aarch64.rpm 515f193fa489da8cf9a2719293f477337769f6f82f7a78f71c6f60cfa1771447 ALSA-2026:4447 Copyright 2026 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libvpx-devel-1.9.0-10.el9_7.aarch64.rpm 9e67d142795dd765eee6ec910f083d38d870f7c30cf19cb831ea22bf518f33ed ALSA-2026:4454 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es): * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.125-1.el9_7.aarch64.rpm 67542040f7413b8a60ef5b14e3faca648b95b9df04f60ccc39c7454712262792 ALSA-2026:4456 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default dotnet-sdk-9.0-source-built-artifacts-9.0.115-1.el9_7.aarch64.rpm 1d2fe78703951ad86420b8184efd13b3e716a097a6197bcdb68558346586d006 ALSA-2026:45192 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) Bug Fix(es) and Enhancement(s): * scsi device removal may hang from race with error recovery [almalinux-9.8.z] (JIRA:AlmaLinux-187412) * [AlmaLinux9] kvm fixes for 2026-07-21 [almalinux-9.8.z] (JIRA:AlmaLinux-213468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.30.1.el9_8.aarch64.rpm 11f78f80028db58526d7dfb4d9c75efaece072e02cee619b2ae4b16b8597c854 kernel-tools-libs-devel-5.14.0-687.30.1.el9_8.aarch64.rpm 463e18e24ec688c11441c9dc74727b2f0e61fd4f9317ee1a635450047477176f libperf-5.14.0-687.30.1.el9_8.aarch64.rpm 5d9e6ea9cc64d8c9bb139103b1add8efa1fb8717fc29eba5d06eba477aa224ca ALSA-2026:47040 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797) * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) Bug Fix(es) and Enhancement(s): * general protection fault during exportfs / nfsd4_revoke_states [almalinux-9.8.z] (JIRA:AlmaLinux-188257) * Enable Pretimeout Watchdog Panic Functionality on x86 [almalinux-9.8.z] (JIRA:AlmaLinux-193729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.31.1.el9_8.aarch64.rpm 6e449c1f963f2165176646df1e65b8ac31bc6c67c2e6bca7d803fb6442b8088a libperf-5.14.0-687.31.1.el9_8.aarch64.rpm 956a4a04b9f45e775f505de7957a263f3885da25c7692685f3b8c438fd030553 kernel-tools-libs-devel-5.14.0-687.31.1.el9_8.aarch64.rpm b5530be1a9fb4829748364abd484136e7c85493be529be77c48ba9cf97a74cb6 ALSA-2026:47084 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.1.aarch64.rpm cd65f0311d66af05d36bc6ddc76f078c9affafb0a0ad0c0f9188bc4be8d38fd8 ALSA-2026:47178 Copyright 2026 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default yelp-devel-40.3-3.el9_8.1.aarch64.rpm 1f5c02c68fedbc2147f493639ba8e01fe1b45d3604072a4162a3784f5badfb70 ALSA-2026:47179 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.aarch64.rpm cf7db9af80a55d1d8bab0535c1533e98fd41f241c3b566282c15b57068b2b8fc ALSA-2026:4759 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.41.1.el9_7.aarch64.rpm 079e88ef0f5c38fe30f37c1aafd721ad2dffeaee0eef3f879f3f0837e8f88539 kernel-tools-libs-devel-5.14.0-611.41.1.el9_7.aarch64.rpm 1dd9e112f64bbd7b5d1881d7bf2854c8d0cd4da015f975370bf3d0ffca72f034 kernel-cross-headers-5.14.0-611.41.1.el9_7.aarch64.rpm cf1d95923880c56fa70a76ccd53c7fe7a18b7b9796bbdfa10341993fda2ace2b ALSA-2026:4828 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default mysql-devel-8.0.45-1.el9_7.aarch64.rpm 5062a7b17a0b0a6ec06148c1fae26cf3a8ae924bddf757312c278ebcdf6bb6e9 mysql-test-8.0.45-1.el9_7.aarch64.rpm d8bcaed066621e8b173b9fc113c870b37c8d607420d7f725d54b6fbc3d083311 ALSA-2026:4898 Copyright 2026 AlmaLinux OS 0 1 Important

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) * capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default capstone-devel-4.0.2-11.el9_7.aarch64.rpm 03e3a11634d7f6cf80b567cb125513af16b893cff71a363d3d3babafda9c5cb8 python3-capstone-4.0.2-11.el9_7.aarch64.rpm 6e864bef862f2682e5789eeb81c43f3df0ece2f4147acbf7c9a7407cc5c2a0fe capstone-java-4.0.2-11.el9_7.noarch.rpm 9148e1b91a4f21330bcfcfec0fb3809e12ac0bc48c9f877a686b6afcc9e1e6bf ALSA-2026:49212 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () * kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.33.1.el9_8.aarch64.rpm 4fb22dc9f23cf1af9b7435c11c22844ba1e661d724eb2003cf8a6d7971cefd97 libperf-5.14.0-687.33.1.el9_8.aarch64.rpm b29581640756367c2ebc91dc62cbc9df8fa3d9d059562199e25dc81327d00a31 kernel-tools-libs-devel-5.14.0-687.33.1.el9_8.aarch64.rpm e249c34ca8301be59beff3c9f4035588b4fd34f09e8f0548369a91a7b4ccedb7 ALSA-2026:49870 Copyright 2026 AlmaLinux OS 0 1 Low

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) Bug Fix(es) and Enhancement(s): * Possible regression with FM350GL [almalinux-9.8.z] (JIRA:AlmaLinux-184273) * AlmaLinux9: Fix downstream-only regression from 532af53c [almalinux-9.8.z] (JIRA:AlmaLinux-192430) * gfs2: xfstests generic/363 failure [almalinux-9.8.z] (JIRA:AlmaLinux-214021) * AlmaLinux 9: Backport b95e0e792822 [almalinux-9.8.z] (JIRA:AlmaLinux-216471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.34.1.el9_8.aarch64.rpm 473b487ad9f007dda3334abdd6adde37e28de69b03036e13ae81f0ed5bb38a6b kernel-cross-headers-5.14.0-687.34.1.el9_8.aarch64.rpm 5571be3ffa0999548b037786bcb26d7a22c6ee8f5178caaf9cd7a42a674f4c10 kernel-tools-libs-devel-5.14.0-687.34.1.el9_8.aarch64.rpm 778b6f106b64eae6180941054146713be956d269cbc4bd194b1726eb7ef91490 ALSA-2026:50108 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default ldns-devel-1.7.1-12.el9_8.1.aarch64.rpm 1387a32f48c4746a436328bfa6d6e74b07783484cbdc0889fc949e3ad9b1de5a ldns-doc-1.7.1-12.el9_8.1.noarch.rpm 7e158362aea06b2f4ea4f6ac69774898ce998bc5ff610ff22df26aa72729f57c python3-ldns-1.7.1-12.el9_8.1.aarch64.rpm bd3923710e0c7823390e59724d05ec7f8a66259196008bb00ea317f99519bd3b perl-ldns-1.7.1-12.el9_8.1.aarch64.rpm ce3c14073ea62a153343bfe4f5bb875262b7342435006fe72cf3f3f5ea46c8dd ldns-utils-1.7.1-12.el9_8.1.aarch64.rpm cf23acf29f62b9cdba135fb85dc543c414121f3a4d89c184f55466d1aa3ab322 ALSA-2026:50141 Copyright 2026 AlmaLinux OS 0 1 Important

sg3_utils security, bug fix, and enhancement update

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets. Security Fix(es): * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): * sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default sg3_utils-devel-1.47-10.el9_8.1.aarch64.rpm 28661faf6cd697921b475eb35ea74d9a24daa0c06cc1ccbf45c71b325873dc6c ALSA-2026:51035 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-9.8.z] (JIRA:AlmaLinux-186331) * [AlmaLinux 9.4] Kernel memory reclaim bug [almalinux-9.8.z] (JIRA:AlmaLinux-211058) * Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [almalinux-9.8.z] (JIRA:AlmaLinux-215575) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.36.1.el9_8.aarch64.rpm 6498da78f6b6ef4d593793c8d198a1745eb25180d67d0eb365a2a8d98b470c56 kernel-cross-headers-5.14.0-687.36.1.el9_8.aarch64.rpm 66645987d2e1ef1988ec52a07b7da3aca510270c3bf0308797dadd6256f56865 kernel-tools-libs-devel-5.14.0-687.36.1.el9_8.aarch64.rpm 702d52343544d74f664a68456a3c82944ea8102fba73392b41851de9371aa261 ALSA-2026:52395 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation (CVE-2026-6479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default postgresql-docs-13.23-5.el9_8.aarch64.rpm 02fc29c112e81d4708d26f13b5dc1c745fc2762ea9ee03574fce152a40dc3126 postgresql-upgrade-devel-13.23-5.el9_8.aarch64.rpm 4588d0805ecc01eea78a7062142192fc754019816d9a2dd618ae3048eb333fa2 postgresql-server-devel-13.23-5.el9_8.aarch64.rpm 813eeb4f0006b9c703eaa3e68d7a5277b3ee6c6955023c6caf2a66a9f74412c4 postgresql-test-13.23-5.el9_8.aarch64.rpm 83156b870e5ecfdbfe18a758bb8c662e394c32f867a8286927853363f6cf53d2 postgresql-private-devel-13.23-5.el9_8.aarch64.rpm 8e614f7d8d00917e0bde67e597234d4e668946c7963193ec8fb72cf2cba5e434 postgresql-static-13.23-5.el9_8.aarch64.rpm 8ea3a7c4745e45b7c60b85bb299eefd7ef4ea49a9a23e273c3de5c5284fffd0d postgresql-test-rpm-macros-13.23-5.el9_8.noarch.rpm d732c71a16cd11972ca9f56da5ba1df03a091f44c271942eb352f1e41e040b86 ALSA-2026:53329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-9.8.z] (JIRA:AlmaLinux-213036) * AlmaLinux9.4 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-9.8.z] (JIRA:AlmaLinux-215578) * AlmaLinux9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-9.8.z] (JIRA:AlmaLinux-215580) * cifs: periodic IO errors when rename races with lease break (JIRA:AlmaLinux-192999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.38.1.el9_8.aarch64.rpm 40d5713dba6929c9da2d7c958ff1af4d5171d410cac7fcaccd0c25f1e6429fda libperf-5.14.0-687.38.1.el9_8.aarch64.rpm 6176e07a61ea57ef50b503b51110e5ea27340be93bbaef5544281f36ccd7c806 kernel-tools-libs-devel-5.14.0-687.38.1.el9_8.aarch64.rpm f3a276103f130fbf862df5802b41ecadcbd01e826b01a923e64c535e76136720 ALSA-2026:54268 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-test-3.9.25-7.el9_8.3.aarch64.rpm a9e209d5d065d5cd263e2830d265c2157f4c0e74f8cb3d76bc52cbe7d298a6f6 python3-debug-3.9.25-7.el9_8.3.aarch64.rpm cbae824e5d30512843ba3c5850ba390abe7e6195a84482c9407bb2f54adf21fb python3-idle-3.9.25-7.el9_8.3.aarch64.rpm f87c9b07ac3b77f9899f0b00b5b438b2c67125b11756c87215cb41260f002907 ALSA-2026:54443 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-9.8.z] (JIRA:AlmaLinux-214434) * Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [almalinux-9.8.z] (JIRA:AlmaLinux-220787) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.39.1.el9_8.aarch64.rpm 3599f01100921227a09cc54c340730a6612533a3d2112a63caf995e5b6a20e35 libperf-5.14.0-687.39.1.el9_8.aarch64.rpm 718a8c4b9cfa792bd3a5eb403e73a930417df4dc4c0b9659e945072ec38fe6e8 kernel-tools-libs-devel-5.14.0-687.39.1.el9_8.aarch64.rpm c76cff76c6f9fa4036019706e79b2b97bf4f1a50e440c7b38a384642e506adc6 ALSA-2026:54487 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.5.aarch64.rpm 348eb1fbdd0ed4979385e866f65f81c4436e43e07cf73f07014d4fec154d89e1 freerdp-devel-2.11.7-7.el9_8.5.aarch64.rpm f9dca8626e83eab5299488317be003449409198843b089544eb9df421fe8d65e ALSA-2026:54510 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.8.aarch64.rpm 477ae98a6cb238ba5ed302be591710dd2b067d6a26ead3fb6adb30065408be0c bind-doc-9.16.23-40.el9_8.8.noarch.rpm 707e97caec593d461f991261508fa9381c00491912300c14df52d4d4823da370 ALSA-2026:54574 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-9.8.z] (JIRA:AlmaLinux-235471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.130-1.el9_8.aarch64.rpm e3e4762ab86f9c9bae128328854d9fe66b6ae3ec69a93c50e83f9ea02aafeced ALSA-2026:54662 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libnghttp2-devel-1.43.0-6.el9_8.2.aarch64.rpm 396f2af39fd61bd603035d76fe3f245f4dde01dcdc11b9e3d216942fbf63bd1c nghttp2-1.43.0-6.el9_8.2.aarch64.rpm edaa91fbc07e2137a7fe6ef8553355c1385fc768769118349bda41110bc3bbf7 ALSA-2026:55423 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-9.el9_8.aarch64.rpm 0f85f95ffb008002d64deff9f3df76e435788b3d2a6dce9462e3ef0b88f1b7bc ALSA-2026:55440 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.9.aarch64.rpm dc3f203f883156a3bbcd8939b5e8ea795649eb73b862a0bdd748df6e032143c3 ALSA-2026:55442 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.8.noarch.rpm 25810d7d4702c335e76c9bab862566f0691f40c2f421619204196cd55e0e2ec6 bind9.18-devel-9.18.29-14.el9_8.8.aarch64.rpm bbb3d4e054d9b17a3ce4970e75c2d9e958c8e097a5864632660920390bf1c662 ALSA-2026:55447 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.3.aarch64.rpm 96af6079bd8e7ed6efb6347e1d362049c7e73e75ce10187578b57f70ad8d1538 ALSA-2026:55775 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-1.8.0-openjdk-headless-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 0473f34ce8403c6f304395018148b2b8c325c8f325fe11c0a575371b66334b33 java-1.8.0-openjdk-src-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 16a498965dea2f467a6a40a65ef920391152b0e7131ff284778e680937f89c80 java-1.8.0-openjdk-devel-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 1cf8bf2bda98e85bd470839d31bf5051dd9ee6442274b711f0dfa487a38eb2e8 java-1.8.0-openjdk-src-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 3a4a5439e38d791afc819a8c51390c3b190bf38ec1261a5a132b445bcfa73109 java-1.8.0-openjdk-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 3fcd6ebae2b63dea7314d29792c55bae1b18108b24440e1233fb47ff4b1a7763 java-1.8.0-openjdk-headless-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 49740ad3e2f6c136eb57322755f6171406fe11d005f4396af58298de8bd9e0bb java-1.8.0-openjdk-demo-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 64846356fe8fec34db9ec8ca1ecaeddcbeffdd29b5442383d17b46f0788c3892 java-1.8.0-openjdk-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 83d9bab4ee93ce47566752ffdbc6c0fffde11a5144c914bb6f3f1a01451e9339 java-1.8.0-openjdk-devel-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm 965beba920df5ec3bc377af0f431ebbe0d69287aa12965e35f11b7ec872a32e4 java-1.8.0-openjdk-demo-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.aarch64.rpm e9b28e397ae94071c4ab7c750ce646943d437027deb1a383f9bc5dd18e108e61 ALSA-2026:55781 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-17-openjdk-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 11060a97b1c6da6166f4c602da2a7995d408c4740645ca281c82d887392592a8 java-17-openjdk-src-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 143d8ed237cf4dc351a625cedeb5544124aa0c04b6e805e0c69fd16cad0676c5 java-17-openjdk-demo-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 2383665734972b78f066c84f15d89a491d53466a0b2348b9c04331dbd15d9a8b java-17-openjdk-devel-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 4b591a1ea75a5247972860840ce9eea90b78d9fc4e4111ad19c5a30b2c580b89 java-17-openjdk-static-libs-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 4f1761dff1b7269a9d50a881a118ea4ecc349231105ac43e893d62c3dd7291c2 java-17-openjdk-headless-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 57b040e1a36dde8ac1bc4771bd5867f325ad64bcb1c6c451f0e00e7b908a6c31 java-17-openjdk-static-libs-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 5da13aa5581ce74924f99a08327a64968681b00ce4672f1f0325643b986e96e6 java-17-openjdk-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 6fb29dfacc60c7e3337b8c6f3681a2e65ff639bf6f261ea9ff6d8b7055a17285 java-17-openjdk-jmods-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm 8300df5ddfd71986b573568492436692b2e8cd99b2145c481dd18c23c82d0237 java-17-openjdk-headless-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm cccf4eda4edf7fd3316932a45b2566d6d418b4fb4f0171ad05c1deeb6adf4dd9 java-17-openjdk-devel-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm e606651cec08ff0f0edb1c7e4ffa59ef9ec682a54b63c8105303ea046e1b4186 java-17-openjdk-src-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm f09749e1b69752069f2dbf53fa7b8e66e28443ce54e38dfbf31f8e1fc7dec432 java-17-openjdk-demo-slowdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm f16a681d41de3f39b7a56bba1ee3da1562116546b629dd7204aa9421ea6c9967 java-17-openjdk-jmods-fastdebug-17.0.20.1.1-1.2.el9.alma.1.aarch64.rpm f6d612976903202f5a306db8a8aeef96024595526f8a2bd9baea489cfc3440ec ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-21-openjdk-src-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 1507fed4528dada347adc71907122a769b621b8f6da565bdf6831134ef89fce1 java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 215ed7dc0d5c79a91196878c576cf8189b261a10357d7fdd38df6def12229299 java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 21817f1d59e670c6c0419e7cdab03eb87bf37060b1e61a977f3194109237218f java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 244980c11a9801a9280ad5954838b6af67dc5414b87d2d37dd3c4119b47cf619 java-21-openjdk-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 2613910b19b54be6bdd2cc4300b3189c8a75a1d6d7acf07355d975aa33ee677b java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 497bb2c2f3246b8b052dc2ce981a40766613a0d0349ebbddcd2c66454fc87c5d java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 51d4b53da9443564c175eabbec6037849523df5bcc75344980d6c8fa16417c17 java-21-openjdk-src-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 6675d7bb0cf5ca330d0d766ef71c85de5018f47eed622e2e3e4a47b29d7cf3f9 java-21-openjdk-static-libs-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 7e93d6be5ad98d1047fdea2f654df8bc179ed24dd085d2b28facace8ea531b90 java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 81937a615647b79ae81a61c82a434b5e6fe02f45d57bde2fed18aef6a8bc1326 java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm 951e0a17d496de6649f97fdfa65f911d8022c16b6882d0245b67682372422c55 java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm c6bf97c9fd12c9fa90c5f42e4760c5d24332206f6bab67f8463a101b488f3ff0 java-21-openjdk-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm ef5fe36439bc0e4bc0152746053dae7b1dd51d7b1d8e6352642e0e92a8602a0d java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.2.el9.alma.1.aarch64.rpm fc237dea8bcd4e83ddba3431956c7d1c34dab3e7d2e018170b9d49ff0cd84039 ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default java-25-openjdk-devel-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 061c5dc7794fd555814af7d73087cff42cb5d25cf13cf3ace8093b31e2b2c53b java-25-openjdk-src-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 06d8ddd16cd6996cbf6dd06afe54c7769d25fc1e1e3f10dde3d43159e0d7af14 java-25-openjdk-demo-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 19bb772b1f12562b0aee3429206de61da903423979e0857d83549a3d24d1586e java-25-openjdk-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 485c0c6113cff169492215e3212c6b9a2d73a50c922eefa76514152158451801 java-25-openjdk-demo-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 4c9d068ce33b6392891351557acb4291a161270735d5bf10afa4868e79a61342 java-25-openjdk-crypto-adapter-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 5bea1293892e04189c9d4c1493e7831cc7416bb93d0191fe483d1feee2a4003b java-25-openjdk-jmods-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 5f824241d7a3744ee42da756a427a6674c4def74344562682c186e253985dca5 java-25-openjdk-static-libs-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 74d0577b690965d455a4760b242147f82873bd5fbd708168e8767796eaf37cbb java-25-openjdk-src-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 8152a2e8dd79f66622e718616f725bc192e1db1f9908f54c69e2035f427f18d2 java-25-openjdk-headless-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 83ffe0cc888df2baf7ba7b2a11833b8f61542101589d22cdc1946a05f9cbf207 java-25-openjdk-static-libs-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 8678b4c172e73c5eb7c1907d082ebf30ff8a871179f50cbfa35e43e970ea10d8 java-25-openjdk-crypto-adapter-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 8c5656080e74b4ee43e5dd02c5b707c97c67c500a2e3da631d9556f0d646151c java-25-openjdk-devel-fastdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm 9dc5dab818b48d3ef783d385e5c8109eb7c6d451afadc378558bc56c49b30cef java-25-openjdk-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm a083d1db67026ad76b040b60cb8eec56b2705d765f4bafc4d65319c4456a568b java-25-openjdk-headless-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm cca6ddfd869906c32365833c946ff0a1c30a5af4d8dd1afb175e161edccb7361 java-25-openjdk-jmods-slowdebug-25.0.4.1.1-1.1.el9.alma.1.aarch64.rpm e19d0889a653a540b11aced5c7beb1a2b79a0d4de03247ab76c4afd5d3822e87 ALSA-2026:55841 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.4.aarch64.rpm 5cfd0d277efa31fc13334ae81d62671658d766286f9ab9da7b47e613e2580c1c ALSA-2026:55856 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-9.8.z] (JIRA:AlmaLinux-235476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.120-1.el9_8.aarch64.rpm e2343749a471080049bd28ddcc2b66461045fbaef0252d92bca3d45071dfccd9 ALSA-2026:55857 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-9.8.z] (JIRA:AlmaLinux-235481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.111-1.el9_8.aarch64.rpm 9502e9685a2bfc7cfc3359ba42d6b99e31f5d87be0102a3c3c84a815c15799c0 ALSA-2026:55865 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.4.aarch64.rpm f08a0d2efbce5cd73c96221d9be6d73494a4c64e6134ebbef11084c218d1ffa7 ALSA-2026:5599 Copyright 2026 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.1.alma.1.aarch64.rpm d9060618b86b2939db4af51894db160f2b6f96f046748279ec575dcae55f00d3 ALSA-2026:5603 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default opencryptoki-devel-3.25.0-4.el9_7.2.aarch64.rpm f176574c03281a298d2ff15849b76f0f70af2f2a5ef863912ebfcd67774e68c6 ALSA-2026:57252 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:AlmaLinux-181065) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-9.8.z] (JIRA:AlmaLinux-224549) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-9.8.z] (JIRA:AlmaLinux-235811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.41.1.el9_8.aarch64.rpm b0b2013bef23404750a1d46b1690de352a97b738cadb99d3b08b44981abe3566 libperf-5.14.0-687.41.1.el9_8.aarch64.rpm bc1b3a52e4fd535d2e4d52e0821c5b03d0a810004c0d8fffba760b582a3ba84a kernel-cross-headers-5.14.0-687.41.1.el9_8.aarch64.rpm c3e16da1e769c9fe17e71a320c4df0596f907c90f2c7e7d7606e19072ff23083 ALSA-2026:58560 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default cups-filters-devel-1.28.7-27.el9_8.aarch64.rpm c902cbc948e15292966359e1ae38aa26fb48325d0eb6b4d020172977ba47d11d ALSA-2026:58572 Copyright 2026 AlmaLinux OS 0 1 Moderate

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-5.el9_8.aarch64.rpm 4f300832489fc22d225048d36d247f05219d037d47c4f2c19590901dbebcbceb ALSA-2026:58901 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.14-freethreading-test-3.14.7-2.el9_8.aarch64.rpm 030944094827169c09132f1ee607450136bc01045822e8bcca286fca6fa1fa9d python3.14-freethreading-libs-3.14.7-2.el9_8.aarch64.rpm 1f1a87e238f27f95b98a66181179ce90f7dd310d33639ec7b3bb75ab4d8538eb python3.14-freethreading-tkinter-3.14.7-2.el9_8.aarch64.rpm 3e2c396f9c9679d8ed5f2e1321f12a13e56247993230bc0d9868fbde26e3722b python3.14-test-3.14.7-2.el9_8.aarch64.rpm 4f7a3d30d7abd00cdd924398724a6a2e8f4b10c885069dcde6c203976986ec65 python3.14-freethreading-debug-3.14.7-2.el9_8.aarch64.rpm 89ffbbd6857bb02af243602fd655e48d8ad7631188bc447780265ecf81dad7fc python3.14-freethreading-devel-3.14.7-2.el9_8.aarch64.rpm aa691f0019bc56fc4e25199520bf2a343d6682936dbe799f89b3f6189bad58a9 python3.14-debug-3.14.7-2.el9_8.aarch64.rpm b99a4d0d16c22a0e41dc6beda802ffb4551612cc87050842d17fc352eeb8bcd8 python3.14-idle-3.14.7-2.el9_8.aarch64.rpm beda907ffeb72b9f71c92a067d0eef2dc680a6527988e7e471c05c5920310a88 python3.14-freethreading-3.14.7-2.el9_8.aarch64.rpm cee4124566f35aac632eb3bcea7f8c443b72efae04a79b21148f621f762893e4 python3.14-freethreading-idle-3.14.7-2.el9_8.aarch64.rpm eae00d666e5c6eda5450bfb0dbf7c0d357b9a35210cdaafa273024504683a0d8 ALSA-2026:59009 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.12-test-3.12.14-1.el9_8.aarch64.rpm 92ab6d22123dbcf75f466ed908ab25538bcb2a9851afa44db8819eb74778085a python3.12-idle-3.12.14-1.el9_8.aarch64.rpm a7ed11f95b0f4a9a9ce440de2b3939db5db521d3addd924cf428d4d262a1687c python3.12-debug-3.12.14-1.el9_8.aarch64.rpm f11907dc052d4f6cf820f82a1f10d7a8d32ae8539f3e585a96f6c255c36aff71 ALSA-2026:59362 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.5.alma.1.aarch64.rpm 61d742414408cacb243303924962df5a897e9ebde8233fe5c476f397c5df3107 ALSA-2026:59723 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-166118) * ss core dumped when there is an SCTP session [almalinux-9.8.z] (JIRA:AlmaLinux-212398) * [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [almalinux-9.8.z] (JIRA:AlmaLinux-245333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.42.1.el9_8.aarch64.rpm 0adbcb34d3af203630860d534779249ffe74b3e7c907bc5a1c7e3c7afa4ea2a1 kernel-tools-libs-devel-5.14.0-687.42.1.el9_8.aarch64.rpm 3bb08d2d3b140d7e5e142751786f203e0ff96f2aeec3832fdcac7f7dbb6b24bc kernel-cross-headers-5.14.0-687.42.1.el9_8.aarch64.rpm 41ae5965da63f0b8b25fbd0fbcbe9bbbe583a918fc9fde238d566e098f732b4d ALSA-2026:6004 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.3.aarch64.rpm a1b1a2a03d6b3c6037e953c10d3b3728e55854685c335410824da0783cbadf6d libwinpr-devel-2.11.7-1.el9_7.3.aarch64.rpm ded9af673cb75dff7a08e21f1472c93e42b88f908a3d0ff9726d6ab9dfab75eb ALSA-2026:61316 Copyright 2026 AlmaLinux OS 0 1 Important

xmlrpc-c security update

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML. Security Fix(es): * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xmlrpc-c-c++-1.51.0-17.el9_8.aarch64.rpm 040e2afce2949937563b20069688d907a8d85c4f127152308480184d43cd6cbb xmlrpc-c-devel-1.51.0-17.el9_8.aarch64.rpm 0caba91c735434faa62471c739031af469c9b97711dbd201744b3f8bd16ab1df xmlrpc-c-client++-1.51.0-17.el9_8.aarch64.rpm f3ce03a622bc9324831d0706ce19f5293cb447f0574d2a294d787c81a46e44fa ALSA-2026:61379 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.6.aarch64.rpm 18244133c84208e000a0fed20f5900e3be29206d14ccf9f842e49b42a46cb345 libwinpr-devel-2.11.7-7.el9_8.6.aarch64.rpm 7630d0bbefcc3bb13a7041eeb492c7267b05f5f48f3006d34d8baa0c1f3b2ee3 ALSA-2026:6153 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096) * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144) * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171) * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.45.1.el9_7.aarch64.rpm 144e774a7ae20262b09a5bfdf969cf9378a6156e4fcdf5e1cd4db1c930d4688d kernel-cross-headers-5.14.0-611.45.1.el9_7.aarch64.rpm 4623532e393f91eb3b2925893b8a366ea35eae1d3ad72b78f2e028682b10da4a kernel-tools-libs-devel-5.14.0-611.45.1.el9_7.aarch64.rpm 70b09eb200873d38b0920cbba6184bbac0956746d7fd7bcecea36c6d60f4a35f ALSA-2026:6285 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.2.aarch64.rpm 425ba88b22bcea9024c8e530e0e3e49ab0f0c3a93d75140e83fdf09dd3faf074 python3.12-idle-3.12.12-4.el9_7.2.aarch64.rpm 6c8029196e2bb0ac15b3a48d3b3fb6b245ac37de431bd639eae12eb3048ea75e python3.12-debug-3.12.12-4.el9_7.2.aarch64.rpm 8b471e6ae114f726346408a106d804479b5b2e1dd380256d1c0d1acdb19d07c9 ALSA-2026:6286 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3.11-idle-3.11.13-5.2.el9_7.aarch64.rpm 605ffd72642648ff9b1687e8219486c81093b67e4fd2da08088095ee9fb92925 python3.11-debug-3.11.13-5.2.el9_7.aarch64.rpm 7c4db3c775e02420b7b43cdccfc500e09f1684870766526c49471b7fa6b37f24 python3.11-test-3.11.13-5.2.el9_7.aarch64.rpm be479c3df630d6802dc9b0b9d571d8cf35d6bf9726a938dd6a3451ba757ec53d ALSA-2026:6300 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.aarch64.rpm 3beb09e71e8700fae749cbb2880d12a2bc45f19d6a3916ad38e030f5ed47a494 ALSA-2026:63129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9] TPM becomes completely unresponsive and requires a full reboot to clear [almalinux-9.8.z] (JIRA:AlmaLinux-213940) * RT scheduler livelock caused by missing backport of 94894c9c477e [almalinux-9.8.z] (JIRA:AlmaLinux-240634) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.44.1.el9_8.aarch64.rpm 03b4ac7db55cba2538fb72068046b579b513e8b2dab9af312132a2b2cd299f54 kernel-tools-libs-devel-5.14.0-687.44.1.el9_8.aarch64.rpm 06b89c2ae969ba8d2c469ffbf04118bb58f752cffc905f0a1546a3d025fd2db8 libperf-5.14.0-687.44.1.el9_8.aarch64.rpm 7059c86ccaae98a1e2812089ee2305e9c61eaf4b01dfe6acccb15d1142e13750 ALSA-2026:6340 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852) * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732) * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676) * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491) * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948) * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684) * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681) * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683) * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679) * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675) * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.5.aarch64.rpm 8ce6b71c9f6a0dbb0b0cef0e9894d8a41671aec06392fde11d02f1bb637dbc73 freerdp-devel-2.11.7-1.el9_7.5.aarch64.rpm b90eb49f3cf9c888308f3bc9c8dc1dcae1eabfe9f8dbce2951e33d852f3cb4e6 ALSA-2026:64784 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-10.el9_8.aarch64.rpm a147fafa4030a20f9389556c3deaf8038fb2f441c3c3ad1fc00475f2379c3b53 ALSA-2026:64800 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.10.aarch64.rpm f558bfb1efc7843e6b223d1e01d31aad0bae1c7fb9e918766abd9fe9c7f4be77 ALSA-2026:64808 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319) * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.45.1.el9_8.aarch64.rpm 55ccf578f1dd44179eeb07a35e441f0f08eb67d08d34262b083e14e0e3dd5326 kernel-tools-libs-devel-5.14.0-687.45.1.el9_8.aarch64.rpm 6eb7cb67376b2d4e9aa9f403df766ba928e5a28f4e1a77287957dd2437cbad08 kernel-cross-headers-5.14.0-687.45.1.el9_8.aarch64.rpm 8ea0ec177b8c77d982ac0b47ab9b3beb95a9d133b80437d59df6a7b72b1295cf ALSA-2026:6570 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.47.1.el9_7.aarch64.rpm 0e4c0a2b5f8d7042b42705f2f132a77210b7147377a2723edf177c60025d9f90 kernel-tools-libs-devel-5.14.0-611.47.1.el9_7.aarch64.rpm 703118b636c2b33db875d1fbe615291648bf8e26bb7a22b0080c501914f38f2d kernel-cross-headers-5.14.0-611.47.1.el9_7.aarch64.rpm e5ce65561ba4b431a0db930b690c717bfb8198f8c190d3830852988097785a98 ALSA-2026:65993 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.1.aarch64.rpm de7cd7517cd95b8c6d3b7f2c2efbce9c447b531f32e5d19949fb545987d79d51 ALSA-2026:66180 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) Bug Fix(es) and Enhancement(s): * KSM to deduplicate only zero pages [almalinux-9.8.z] (JIRA:AlmaLinux-249161) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.46.1.el9_8.aarch64.rpm 8463cb8670a8672e556ad87ec0e53d7eef1ebcb09c56b86808201d9066ef9a90 kernel-tools-libs-devel-5.14.0-687.46.1.el9_8.aarch64.rpm 928b8b588209c3e98fddfb706b15f44e57d9c9dc872bd64a5697b62ebc8a7f40 kernel-cross-headers-5.14.0-687.46.1.el9_8.aarch64.rpm ccdd79012b76215a04f99741d63cb9c42ce8750d05c316261346b9d8fcf5422f ALSA-2026:6628 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default fontforge-20201107-8.el9_7.aarch64.rpm de2661c3cfea18f56ad5afb07f34a1825c9c5365db2d8126f88610e895c0fa38 ALSA-2026:66347 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.7.aarch64.rpm 4ad2acceef8ac3041c671865ccbcbb4fcd68280b25cb7f3d62ee06dc692e820d freerdp-devel-2.11.7-7.el9_8.7.aarch64.rpm 674c86302e06a49c28994828910ee6ac64f0973c8adb2cd99d9eb2570fb79f66 ALSA-2026:66542 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.6.alma.1.aarch64.rpm 41e8689b6354a9d627ce75989e765bd80a953ee7407089603d026e401edd3c2f ALSA-2026:67150 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402) * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376) * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) Bug Fix(es) and Enhancement(s): * gfs2: Various xfstests fixes [almalinux-9.8.z] (JIRA:AlmaLinux-178219) * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-9.8.z] (JIRA:AlmaLinux-193025) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-9.8.z] (JIRA:AlmaLinux-193050) * Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [almalinux-9.8.z] (JIRA:AlmaLinux-224489) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.47.1.el9_8.aarch64.rpm 3f6f32b548787adac35d14fe11c9db2aa10df675ef3d621fed0bc26e94854b9f libperf-5.14.0-687.47.1.el9_8.aarch64.rpm 4d624d69c7765d5c0d0c516f3dcb18099804bb6c74725d4c5a505b51f17457ff kernel-cross-headers-5.14.0-687.47.1.el9_8.aarch64.rpm ce24ec0b7abc091798aee1308981c3ec5c6e9c950f1e29fcc254d0f46d0abd48 ALSA-2026:67470 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * gfs2: bufdata leaks [almalinux-9.8.z] (JIRA:AlmaLinux-178223) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.48.1.el9_8.aarch64.rpm b68afee8139af9cd4e0c3f090c5d0b44a4c9e4540e4279037aaca5cd910eab16 kernel-cross-headers-5.14.0-687.48.1.el9_8.aarch64.rpm db661ca37146e913f35b77669f29cbe972c170269ae05da35001faef1e085d85 libperf-5.14.0-687.48.1.el9_8.aarch64.rpm dd65d9a741c28c2ba8009fc42d8184e2ca3698a79e175de06722e4dec6ea9c9b ALSA-2026:67524 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-9.8.z] (JIRA:AlmaLinux-252247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.131-1.el9_8.aarch64.rpm 4baea27fb636079261a2de62a76555c5bcc334097b039f2f5dad65dfcd32393a ALSA-2026:67613 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-9.8.z] (JIRA:AlmaLinux-252319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.112-1.el9_8.aarch64.rpm 47543f95336b074b26e2b1148c367b826d74378a6c5562243c1496e982212dfd ALSA-2026:67614 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-9.8.z] (JIRA:AlmaLinux-252278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.121-1.el9_8.aarch64.rpm c20bf010fb9b1a851a6618de0b17e04b556a8d9694e21e356c87ec06ff9a2841 ALSA-2026:6766 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.2.aarch64.rpm 46d966a36e9ef80862d9435910d8536867d0f80e7c2d4080a19835b59a0f5c07 python3-debug-3.9.25-3.el9_7.2.aarch64.rpm 84fb20f306a78b223eb2718a0dac25513de47f64d7b621566a3bd29f4edba717 python3-idle-3.9.25-3.el9_7.2.aarch64.rpm c43f5fdcfe62c9b8948ed4c0dbab9656f95b955fad7fbf741c8c23ad131d4bcf ALSA-2026:67831 Copyright 2026 AlmaLinux OS 0 1 Important

tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fix(es): * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default tesseract-devel-4.1.1-8.el9_8.aarch64.rpm d9e88dc918ec64d4e857ef71878c7620c94e883fd5105720df8c0dcb4748fb8b ALSA-2026:67873 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.2.aarch64.rpm 9b463dca637787b87e1fb7798d2fb39bdc71472c049f2ecd5d4558b2d32bba3a ALSA-2026:68292 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.6.aarch64.rpm c1208a9eefd89760d62f88b719facfaf0e655e1faa60fd9513a59068c2a98d1e ALSA-2026:68570 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298) * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) Bug Fix(es) and Enhancement(s): * gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540) * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544) * gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986) * [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.49.1.el9_8.aarch64.rpm 0d86e5facc8d1275ef7e986a40d06e6037266daed964d6e3a85e208134a74b8a libperf-5.14.0-687.49.1.el9_8.aarch64.rpm 92cb272e87df7a137b6cd05a104c9db9d55e31011c048fd7cc756c8f0d213968 kernel-tools-libs-devel-5.14.0-687.49.1.el9_8.aarch64.rpm ba3c3cd05ac4bd93418e86810911d7f3af3d0df2b3b9ef796e0b960229ab7d04 ALSA-2026:68786 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fix(es): * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default perl-Net-DNS-Nameserver-1.29-6.el9_8.1.noarch.rpm 3dea2d596bfd0fb0be7ef382f57b66ad15cd1f6ae834a04a8214e6ea75c47492 ALSA-2026:69607 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default postgresql-test-rpm-macros-13.23-6.el9_8.noarch.rpm 044ccbdab6973b9c28f68ec9d3f12e3ae4050a40b55a0bf43371a25d1afda6c9 postgresql-private-devel-13.23-6.el9_8.aarch64.rpm 0f944570046f6e38ad564bc4d389144e9143980c8faa0d512e8c66039ebf083e postgresql-upgrade-devel-13.23-6.el9_8.aarch64.rpm 45b797ef251db3abc8a5e35f928b83eb95d2293a34b90716f47dd4a8f3e8f921 postgresql-docs-13.23-6.el9_8.aarch64.rpm 4bd48bf6ccc652a696d4d9dd7fa6abe705df47ab5ce731a134e79afdcf6214f2 postgresql-server-devel-13.23-6.el9_8.aarch64.rpm 9fabbba71cb6a403c4657028fb54b62ea29719606216926a009618baab9476cd postgresql-static-13.23-6.el9_8.aarch64.rpm b146bcb07e674e97a8d7236e1d01c2532aa975ca81c7541f6fc042e3ae1b987b postgresql-test-13.23-6.el9_8.aarch64.rpm d5971dc6b652e2f19cf670b31c1889dec8e851293747280b20ede302164196a9 ALSA-2026:69608 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.4.aarch64.rpm 1c4aa59061bf4e880375ebba108f5b33ec838638d3c93941e860e6436e0edb89 ALSA-2026:7002 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654) * NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) * NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.2.alma.1.aarch64.rpm 19c1a6ab2afd1730b8f6092f453f79177770b820aeead3e925adc9df95d8a949 ALSA-2026:70459 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-9.8.z] (JIRA:AlmaLinux-254108) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.50.1.el9_8.aarch64.rpm 670d06b85fa2807d59ca5f1728e09bd533cbf40ffa921c66f2f3854cf9ccda99 kernel-cross-headers-5.14.0-687.50.1.el9_8.aarch64.rpm 99db89ff7d4e045159f9185afca3876b1fff2d6842b30de60bb7119888b4401b libperf-5.14.0-687.50.1.el9_8.aarch64.rpm 9c0bb29149321d9f03e614e77428e92dbebc075628c26ec8ec45d51dbba2893c ALSA-2026:70564 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otptoken-import hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238519) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-9.8.z] (JIRA:AlmaLinux-238523) * ipa env: support only simple * wildcard [almalinux-9.8.z] (JIRA:AlmaLinux-238527) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-9.8.z] (JIRA:AlmaLinux-238674) * ipa-migrate: require Replication Administrator privilege [almalinux-9.8.z] (JIRA:AlmaLinux-238677) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-9.8.z] (JIRA:AlmaLinux-240767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-ipatests-4.13.4-1.el9_8.noarch.rpm 06db0bac21c10e74e426e3f9d48fdfa4abcb65e373a0087a66db13989f728e6f ALSA-2026:71487 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.8.aarch64.rpm 56d1a61b6bf125aa4c946c978761bc73ee0ef84f54616b4cb9663f3e68236532 ALSA-2026:71700 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) Bug Fix(es) and Enhancement(s): * MADVISE i/o size in AlmaLinux 9 additionally limited by read_ahead_kb - Was addressed in AlmaLinux8 via AlmaLinux-22476 [almalinux-9.8.z] (JIRA:AlmaLinux-260938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.52.1.el9_8.aarch64.rpm 5fe2d5c11632989bb48ca95016149405aefcb72d7ac7db7d87f4626328ee1b2d kernel-tools-libs-devel-5.14.0-687.52.1.el9_8.aarch64.rpm fd35850cb56f68e1ee6060c3416d449bd25b54e0e64d258df8f6035e01e0143a libperf-5.14.0-687.52.1.el9_8.aarch64.rpm fdfb1844a619473d23c26decedad3baa6746c0315035382f6c417f7eda863eca ALSA-2026:72286 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) Bug Fix(es) and Enhancement(s): * ruby %check fails in Konflux: Rinda multicast tests need network device [almalinux-9.8.z] (JIRA:AlmaLinux-255606) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default ruby-doc-3.0.7-168.el9_8.noarch.rpm 562cb5d5786d01eedf9f00b70da58fe188ff6ae20423a3bb01536606f5fbb0f4 ALSA-2026:72623 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875) * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-9.8.z] (JIRA:AlmaLinux-188656) * crypto: xxhash64 should not be fips approved [almalinux-9.8.z] (JIRA:AlmaLinux-256437) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.53.1.el9_8.aarch64.rpm 1a7b907e32397e11b82fa305a97a5b53b1a68f5912f4efc69c563dbf7cce140c libperf-5.14.0-687.53.1.el9_8.aarch64.rpm cf484eaacfb8388b4a6370f2f3219e00cac3cbc010316be1531870f022d547f4 kernel-tools-libs-devel-5.14.0-687.53.1.el9_8.aarch64.rpm d4e6b477a4b8c306fed6f12214b7cf3ae5608b71cbfc49b898d0572ab43b8546 ALSA-2026:74424 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z] (JIRA:AlmaLinux-224986) * Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libvirt-daemon-plugin-sanlock-11.10.0-12.7.el9_8.alma.1.aarch64.rpm 5dc7380d3e78ba9b6412babd0573ecadff1acb7049714d270a2cedc4063b6910 libvirt-devel-11.10.0-12.7.el9_8.alma.1.aarch64.rpm 61f880abf3af856693f0fbe85ffe3498c9da509adf65cf8271df375cfe078aa7 libvirt-docs-11.10.0-12.7.el9_8.alma.1.aarch64.rpm bb917d9b1b0b52d78874e926baeb1a9600c1dcd9c2aabf9c3a1201b8a196a304 ALSA-2026:74438 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) Bug Fix(es) and Enhancement(s): * Backport of protocol attribute to IP addresses (IFA_PROTO) [almalinux-9.8.z] (JIRA:AlmaLinux-169936) * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [almalinux-9.8.z] (JIRA:AlmaLinux-269060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libperf-5.14.0-687.54.1.el9_8.aarch64.rpm 69cfd180d37354a0bc1c9193f2605d1a38082f6db0b3dae11eeddfaea53d2683 kernel-cross-headers-5.14.0-687.54.1.el9_8.aarch64.rpm f55651161215a65baf9049beab10d8f2b92048fa6d743c15e77c698490144cd6 kernel-tools-libs-devel-5.14.0-687.54.1.el9_8.aarch64.rpm f58bd87d3dff31b21ef38350377ed28b5e30f440774cc87be542fa858e60a5ef ALSA-2026:74441 Copyright 2026 AlmaLinux OS 0 1 Important

libpcap security update

The libpcap packages provide a portable framework for low-level network monitoring. The libpcap library provides network statistics collection, security monitoring, and network debugging. Security Fix(es): * libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access (CVE-2026-0799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libpcap-devel-1.10.0-4.el9_8.1.aarch64.rpm c238847a4e94ca963e30f2bbd6234d4db444319b99a79a9707db8144e07accd3 ALSA-2026:74457 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libgs-devel-9.54.0-19.el9_8.1.aarch64.rpm 17edf882fa3f31d3dc5552ed945e6f7022f06e3a0721487438b2a3cacc3674c2 ALSA-2026:75578 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.10.noarch.rpm 2a584dd14b6d4796d03568e01402b558f4448f3a260c0fbe0f2da4f13e48ce62 bind9.18-devel-9.18.29-14.el9_8.10.aarch64.rpm 550fe2c83855c59500a1f4339307e776be5d06f952271d8ba638983abdf26f18 ALSA-2026:75673 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default mariadb-connector-c-doc-3.2.6-2.el9_8.noarch.rpm 671566d6bd00c1f50a91d7ed5d66397998ffbca21276a0e5a09e5b890c0c0190 mariadb-connector-c-test-3.2.6-2.el9_8.aarch64.rpm 7f5e51de0f11de5d1229e8362222508fa4eb7c3c99b6c4c3e9ffbba7f290f4b9 ALSA-2026:75767 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.10.aarch64.rpm 67e8155dab6883fa661afef6e6daf2144f901bef9d8168555d0086f629d3c061 bind-doc-9.16.23-40.el9_8.10.noarch.rpm f8068bdfd6137ff02e78373df63feaebce8470dee4eb13f7308fcf3766182e8c ALSA-2026:7668 Copyright 2026 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default nghttp2-1.43.0-6.el9_7.1.aarch64.rpm 1f3d757b9a05831b7a98639fb5409a8c8992043c9642ee28efa7a9bead12ca93 libnghttp2-devel-1.43.0-6.el9_7.1.aarch64.rpm fe9a83fc18aa5c52326e300abb0424a793fc5b180eb318ff3cca550bdd9822f3 ALSA-2026:76733 Copyright 2026 AlmaLinux OS 0 1 Important

rust-rpm-sequoia security update

An implementation of the RPM PGP interface using Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default rpm-sequoia-devel-1.10.2.1-1.el9_8.aarch64.rpm 12b8aacf1c613d21b6f5b1715b4ccc30b46b316dcec57205fccdbbaaa1921455 ALSA-2026:76755 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.8.aarch64.rpm cb66de8c75dae34d8640b1daedac3eaa9766f0c976c60f77d29c89adcdba3bd0 freerdp-devel-2.11.7-7.el9_8.8.aarch64.rpm d7639ca3b9adfebfe3f4dd9c3c2b01b87aaa552c036a4e08eb1482ce4b20abbb ALSA-2026:77017 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.12-test-3.12.15-1.el9_8.aarch64.rpm 892404dc19304a65ae272410ce00b54968dcd929c803e8be500593908237c6fa python3.12-idle-3.12.15-1.el9_8.aarch64.rpm ca8b7d517724e1e0f287153301b9eafd04413c0018cd0ef485002b1f5cb92d1f python3.12-debug-3.12.15-1.el9_8.aarch64.rpm e0dcaf8361c693b2e080bb650ee155e94c034c8d782aff782fb1812a4db73dc4 ALSA-2026:77021 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3.14-freethreading-tkinter-3.14.8-1.el9_8.aarch64.rpm 0edc7353ebf53639ac99c7935b4d4adb45c8cefa986b59fa389f31b745f1ed09 python3.14-idle-3.14.8-1.el9_8.aarch64.rpm 4d08d7fe5222f4555eec09c84a1f893b83174275d58452519b4fc5ccb9f881ef python3.14-freethreading-debug-3.14.8-1.el9_8.aarch64.rpm 66d16ac33a833212da562647cce885dd76f66f4813882873750c32d18f4cc599 python3.14-freethreading-devel-3.14.8-1.el9_8.aarch64.rpm 8bf7cda64f93ffd457b05099029c5c38c1147fe17ff251c2906b4ec12bb5d656 python3.14-freethreading-test-3.14.8-1.el9_8.aarch64.rpm 9b237c5caff767a845fda19b67280bff5d027568bc19a8d36855f9b692379e1e python3.14-freethreading-libs-3.14.8-1.el9_8.aarch64.rpm a8c76c8b89b7ee7ba30c88fbeb71f24b34854aded59391828e3b745470873f10 python3.14-freethreading-idle-3.14.8-1.el9_8.aarch64.rpm bcef697c73f500114f0948642cde4cfcd96f6d9ecff684d2395d33e6aaeee826 python3.14-debug-3.14.8-1.el9_8.aarch64.rpm c03482bbacf12e9fb9b274abb8c280182f96457f258f9654b057cb0c6b4302fb python3.14-freethreading-3.14.8-1.el9_8.aarch64.rpm d3ff496a9334b645ef05260ae798b370504aee57d7358bb4df2af4871114e5a4 python3.14-test-3.14.8-1.el9_8.aarch64.rpm fcfe5ff6b3177088070323f7d51c819c8e991709e9a87d0c83ecd05e870a5a6f ALSA-2026:77689 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) Bug Fix(es) and Enhancement(s): * "iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors" broke rx-vlan-offload on almalinux-9.7 [almalinux-9.8.z] (JIRA:AlmaLinux-169480) * [GNR-D] missing interfaces tspll_cfg (JIRA:AlmaLinux-183201) * AlmaLinux9.8z KVM guest panicked in vmmouse driver (JIRA:AlmaLinux-186577) * Add Epson RX8111 support to AlmaLinux9.9 [almalinux-9.8.z] (JIRA:AlmaLinux-212014) * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [almalinux-9.8.z] (JIRA:AlmaLinux-256279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.56.1.el9_8.aarch64.rpm 57e54753f2da3625344342a622999a34e8652ffb38fe7429f2ccea2eabb42042 kernel-tools-libs-devel-5.14.0-687.56.1.el9_8.aarch64.rpm b38c60291d9f4b087cc25798221947006c99d56b49cb39fea7200e112d5d47d8 libperf-5.14.0-687.56.1.el9_8.aarch64.rpm f8ad410988c1fe095b59b1aa1fb9b517145d97b094198f462993f92f5a0e9a51 ALSA-2026:7915 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default bind9.18-devel-9.18.29-5.el9_7.4.aarch64.rpm 8d41a904e646060869759d7831748ac3bdef2884d1d140b38e20fdc599696918 bind9.18-doc-9.18.29-5.el9_7.4.noarch.rpm 9e325df1d0aa41c0f14eb50dcf97f2fe6e998789cba551763a254703171afd2c ALSA-2026:79281 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt; UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) Bug Fix(es) and Enhancement(s): * glibc: Stop shipping glibc32-debuginfo package (in debug channels) [almalinux-9] (JIRA:AlmaLinux-219516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default nss_db-2.34-283.el9_8.aarch64.rpm 3a2308f9dec73e9575e17fea11312e6f0e9ecf9bc5e0f7bf9cc5b2991434f2da glibc-benchtests-2.34-283.el9_8.aarch64.rpm a6ee334376909948d17b800f038bb7f1cbd3cdc79017ce51457f7b2b3b818b3b nss_hesiod-2.34-283.el9_8.aarch64.rpm cb5b7b205cffc3f98a715f6190d46b4491258b75bef7565e7663813d1e4524c4 glibc-nss-devel-2.34-283.el9_8.aarch64.rpm e54cb9663146589678103bd7ef79988b433d1efcc8a5e81a629ec09c07567cde glibc-static-2.34-283.el9_8.aarch64.rpm f0c6f6a8b0baaccb15fc852b4e2c506d0e25137e9324d473de99ce846abaeff2 ALSA-2026:80497 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.4.aarch64.rpm b7ef43a6e3b71be0f96e15ab11e33e77f864cba8434e93a6a3dca22696b55d49 ALSA-2026:8075 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default bind-devel-9.16.23-34.el9_7.2.aarch64.rpm 487004ce4233f4dc7889702b3df64e9b6960fd459a750e296a287bc2108572c1 bind-doc-9.16.23-34.el9_7.2.noarch.rpm 6230f544cc78b94f7f849f02776a9ee03d0d629a65ae19a135fca406798a0a1d ALSA-2026:80825 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.8.aarch64.rpm 6eed6e662625bc1e1c55b263e09926127153fde4dadff0cbd1f18d390e663f13 ALSA-2026:81532 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default pcre2-tools-10.40-7.el9_8.aarch64.rpm 050c855576e02874b17ee2bd1121a5f76be0230c12aa9fe3ca6a10453fbe7d73 ALSA-2026:82015 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.4.noarch.rpm ad0c1b502f04032297357cb36967d764515c70d09ede769ca1d12ab3e5bcff25 xorg-x11-server-devel-1.20.11-34.el9_8.4.aarch64.rpm b47331e75bd2684da5d2d751fb75de3c22e932d771b0c320995e089bba1ec9e6 ALSA-2026:82094 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default librabbitmq-devel-0.11.0-7.el9_8.1.aarch64.rpm 1a15b8ff29d9ff6a8bba467b4a672328a03474fa6e90e6723cd1529522c56192 ALSA-2026:83156 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.58.1.el9_8.aarch64.rpm 3656053422b43d98dce5f80b8fd4677fe8aa5828babd89bd6a2da1934ec37f84 kernel-cross-headers-5.14.0-687.58.1.el9_8.aarch64.rpm e2d2b2d5b9c2f7d8ceb0b5f7ad0528e1329558ecfba696e59e14574d0c72d7cc libperf-5.14.0-687.58.1.el9_8.aarch64.rpm fb7be645c4b07185b8708f8cf40b15254acb4402ee58b1ade5e9ab635a1355a8 ALSA-2026:83546 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default wireshark-devel-3.4.10-9.el9_8.5.aarch64.rpm 323706792041996d563ee26b2af0f9c4b5e67743bd87ebc6d6dd93dbecce65d8 ALSA-2026:83553 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default libgs-devel-9.54.0-19.el9_8.3.aarch64.rpm 0b8884c0c190485ca11b8181a06fa0cddca148e6b3e7d8def571fb6233525059 ALSA-2026:8457 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984) * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.6.aarch64.rpm 98ec6480af2a7d58b4aaa65462d2e23fd8449f87644340d86058c2aa1ea8d375 libwinpr-devel-2.11.7-1.el9_7.6.aarch64.rpm fe1b4682d5a53652411264b476df3717a23e3cf0d8af77a2d2f245673cdc57f3 ALSA-2026:84574 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.5.aarch64.rpm 24e687711eeb24b7986c195f9ca3a68af53ee1f894800a8e3af6c1924d74314b xorg-x11-server-source-1.20.11-34.el9_8.5.noarch.rpm 2773c8f10cf5cdb9a9e0fab413643f95230344eabc2607e96c6fba7b65410a67 ALSA-2026:8469 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_7.aarch64.rpm 9c5aa2ed4805d166a479d5d3f583a18a395327b3ef707fcaf7c1de5f806e295f ALSA-2026:85193 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.4.aarch64.rpm 4e80593583632b3b9602649860ece0d1eb2b4770f443e658466d1f22ab893b12 ALSA-2026:86033 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.59.1.el9_8.aarch64.rpm 134603382cd82780ffacf0e9ebdb34300b43bf5254c6533545a527cd10e7a450 libperf-5.14.0-687.59.1.el9_8.aarch64.rpm 35f7b18acf308b7725ed9f6fdac8c36a5a3cdff9d6dd9b198da9ce79d6176996 kernel-tools-libs-devel-5.14.0-687.59.1.el9_8.aarch64.rpm c5f9b21ebbefa963385fbffaf7d98026c504cb88302b22d1be6902b2e31aaa2f ALSA-2026:86169 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-9.8.z] (JIRA:AlmaLinux-277793) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8.aarch64.rpm 407b166116804c6b0bdc258211ddddffcad849f0d1deee056f357b0b596bed75 ALSA-2026:86171 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-9.8.z] (JIRA:AlmaLinux-277800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.aarch64.rpm 4168f0076e72607709024c7c03fad0be749846af0f3f08046c0c0d849a4a87c0 ALSA-2026:86193 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-9.8.z] (JIRA:AlmaLinux-277808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.aarch64.rpm 465696e88c3bfc4565d826818233710d5f05c0c23bc85cf1162b605e465cf1d4 ALSA-2026:86983 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.5.aarch64.rpm 0f842b9b6ca2e811866e0e8d0b223edcad16fc4dc376ca57303e31e8f9d843a7 ALSA-2026:87082 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.2.aarch64.rpm 5e7bcce2a90abdecbca0fbc26153e5f3d1e7fe9ea9812affc58a8d82abe8c477 ALSA-2026:87805 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) * kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) Bug Fix(es) and Enhancement(s): * RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.60.1.el9_8.aarch64.rpm 206dc9eeb44dcd3b2a3b5dee0819c6934ed338805665d489a8609dff760806be kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.aarch64.rpm 358515c002ef4d65809a79ce665d8a145e572f70ed0b7264d68adeb1e5b7b099 libperf-5.14.0-687.60.1.el9_8.aarch64.rpm dce49fbf9a2cb73d37692d7a9c11473d67553574090df87216dbea4cbfe7ab15 ALSA-2026:8859 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default giflib-devel-5.2.1-9.el9_7.1.aarch64.rpm 7c0d39c2acd6897fadc6ae0e84c969bc3313f0850dd2ac7df37bf18da3809a32 ALSA-2026:8888 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.1.aarch64.rpm a74b509d9398a2b5872073b9f35b7176bda2c57ab557a97a0ba6281dab1ebf61 ALSA-2026:8921 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.49.1.el9_7.aarch64.rpm 7f5857a64c0cd3946dd6a65ad27a82082440f87b65001fe2a426f0e76c4fed78 libperf-5.14.0-611.49.1.el9_7.aarch64.rpm a70addec32cc86ca168afc962cff7d2266671f8d55f453a042d137fa1abae54f kernel-tools-libs-devel-5.14.0-611.49.1.el9_7.aarch64.rpm ad827caaf010c5acd311f545801eb7015ba5e09f72cd9e70f6c9329795807b41 ALSA-2026:89742 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default python3-idle-3.9.25-7.el9_8.6.aarch64.rpm 28ae4637dcccac7f524179149ea967dfd4be758e6f13a3fde14275d9521c2107 python3-debug-3.9.25-7.el9_8.6.aarch64.rpm 982b98ff8403baf9793012502b903b3b33f399eed0401d9295159c00c4691bbe python3-test-3.9.25-7.el9_8.6.aarch64.rpm fdd7ee263caad33d4e9f682994e87f419908338cecc767c3f21273cd68be666c ALSA-2026:89745 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.12.noarch.rpm 3e440850130266e96cf9744617c8fb9a9598d4aa754fa8c74fd8cad49bb9d04a bind-devel-9.16.23-40.el9_8.12.aarch64.rpm e8edb24865be4f6efb8064beb08e081c078cd2b61160020b8f5caa7a2cc0bff0 ALSA-2026:89746 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default bind9.18-devel-9.18.29-14.el9_8.11.aarch64.rpm 8050b73f5a369e4d7119c05a5056327a28ae89e031701ace732e05090576e305 bind9.18-doc-9.18.29-14.el9_8.11.noarch.rpm bd56e931b4a46d62a43b94895cf0e92c0b6d6c79a308a996f478e30cce79e25f ALSA-2026:89753 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security, bug fix, and enhancement update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default freeipmi-devel-1.6.20-1.el9_8.aarch64.rpm a9d03075c8e1df25b6afb8ee1a0653f069c53d75b3236a48ba9cc647aab2dec2 ALSA-2026:89850 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.6.aarch64.rpm ec7a755a64248f0fc7236cecce89c745fa99f2c95b9c1789b0345a68b73ca040 ALSA-2026:90365 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:AlmaLinux-257205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.61.1.el9_8.aarch64.rpm 0bff504492139f448190780a464740b79795b7aa526874b4b8a319b29f578b31 libperf-5.14.0-687.61.1.el9_8.aarch64.rpm 58228ef3fe80e43737b8b36c1b8101de036b91fa211096ff2f21bc158b110cf0 kernel-cross-headers-5.14.0-687.61.1.el9_8.aarch64.rpm 7ca8529997fdab60a4345ec8b537eca63768c3eb4dcec0657e70e9e7e105c007 ALSA-2026:9683 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance key generation (CVE-2026-34268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-1.8.0-openjdk-headless-fastdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 2d3812fc22a632083a9158277f3e78c8b2046f9561a63ff146e24b9f3d22df93 java-1.8.0-openjdk-src-fastdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 4d91fe0c396bfd8c1696b49720bb621e3d3a128398e0b618f42637bcf842d432 java-1.8.0-openjdk-headless-slowdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 5fe764f65a684c6b8477c0feddc4452d3a0e823c61b0df0eb3784450e0f36dfe java-1.8.0-openjdk-src-slowdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 7ccce4afdacfd6cbb06000916eaf7b304f9ec696a841e294e10681be042283d6 java-1.8.0-openjdk-slowdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 841e23c18b4aed6d4957c326016d01e8162717ab080d131a0d3b220de869c67f java-1.8.0-openjdk-demo-fastdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm 9f786ab4e8bb0fe8329ef86b70615aae96d028de269ab539aa23fdb0e4a39354 java-1.8.0-openjdk-devel-fastdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm bf92d2dc4f5c86c4a0552b552c9b4880893c085338b57dc03ef7259168424c5c java-1.8.0-openjdk-devel-slowdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm caecd2bdca975d2519cc6954a4650f240989ff54f22902bead682f15be5bac33 java-1.8.0-openjdk-fastdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm d0de3aef4a5ec0bfa9b93a87c272e4fae5e70dba977d4ff1ee0e730c41d128c1 java-1.8.0-openjdk-demo-slowdebug-1.8.0.492.b09-2.el9.alma.1.aarch64.rpm e60f2454465d3f55e4f90dc88744cf70475603412bd0fe8a36cb0b7cbf6fa006 ALSA-2026:9686 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-17-openjdk-static-libs-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 120c1569960caf8935380395fb4d7064017bcb2a61aceeaf6f725b6fe20d8a16 java-17-openjdk-static-libs-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 1bc41f7b1c7a787239a8fa7d81f9a90995da1c3434531ffd6b561443553ddef4 java-17-openjdk-devel-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 20bc106b8cf77c5a262ed92f9820d71db834f03f3eb1bc299b500e418c010da4 java-17-openjdk-headless-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 2454622d8a9b107b49d6ce0cb3e65dcf61062d32e153d59657eb3918553a7021 java-17-openjdk-jmods-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 26a25cd5e361765b7f3c3c8b08d8ba580dfcf5d19bd446c6b364718e40d51b93 java-17-openjdk-devel-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 29181a06eb23e61cc65f2d43781ebbb404a1e9c286152514076f01e330d58267 java-17-openjdk-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 2d4cd9301689704b0e8b48d2e4ea65cfee6f5236540e9602bc94a4ce7b01394b java-17-openjdk-src-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 4203eb9bd0f4aee92f2ef9d74d1bbf4e5e300ef824b5b9bde4dd0b9fa2e8ad8a java-17-openjdk-demo-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 7ab20ca3ac6a5554bba2e2e8b6b622d63a53eb6bf45bdfe2d6f394e336cefee9 java-17-openjdk-headless-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm 949fb77c215b0e2ce047538320e954f28b7e88f90d28ce3adaf9b56b6c8cc7e2 java-17-openjdk-demo-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm a3b8e7fcaa0a75a5a531289d5202003eb91ba45500c543f197e9fc135d0e2041 java-17-openjdk-jmods-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm b7a187c2990832e3aee5157b36e2f98dc2878cb0e7221b34c4f62ca63f1fca75 java-17-openjdk-fastdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm c41cf1c28c9b892366e2ed0b7b0a75613485178770c506ec87be6d1d3c622ac1 java-17-openjdk-src-slowdebug-17.0.19.0.10-2.el9.alma.1.aarch64.rpm fd0a3b8197ac78ed6a3d6c8e75b3e940b6de6360e138b3b89bb90794a5e1e8ff ALSA-2026:9689 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) Bug Fix(es): * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169617, AlmaLinux-169951, AlmaLinux-169952, AlmaLinux-169942, AlmaLinux-169953, AlmaLinux-169945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-21-openjdk-headless-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 05f94bf36d1833590bd2f832fe26fb30adf44dcac3d06b5cffd47d00285561cb java-21-openjdk-jmods-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 0ce6df6d4ed9d15b75da9ee45355e33ad8a7fd36faca323fe14f24442b5f2353 java-21-openjdk-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 0e310c12613a5e405fe110a41a5970fbf67b0990c08b23d5983c019ef3e8ae1c java-21-openjdk-devel-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 23bb08ce65959f3862791d88156e5c0b825ba102364a72824df4bd60eb0d6e44 java-21-openjdk-jmods-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 2e176ea84dd18dcad68ffbc0601abbc3089283fb7cf59f93fc2b0e16d584240d java-21-openjdk-devel-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 43522d8edc443b67409126155c78c6aaa78182d0c40381a1e4746ffaef12592e java-21-openjdk-demo-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 81574a32a87503f8723d94ad6557ea9ec2aafe3ea2db08bdf881bd7148153ae4 java-21-openjdk-src-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 8c5d7002249ab834f6d038fac4adffa7ca70dcd39080783bc78222c38d3e5559 java-21-openjdk-src-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 918efd89dba01a265da9447218dd836f902a6add6528081d961da61326cdcde2 java-21-openjdk-static-libs-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm 9c6bda4092425a2500ef5c9cb67737e9ac0171729e567c19a01697353ee7409c java-21-openjdk-static-libs-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm a94222b69318fd17131ebbe3daab29e4abca5052d4349495d2510dc9e6cdfdc7 java-21-openjdk-headless-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm bdc4692202f3596818169093c945cb3aa13c972f330697fd82ea78591e122dd3 java-21-openjdk-slowdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm c03ffed40d1e7f257e3bad22576912a460f371836782042e8594709524cd0e3f java-21-openjdk-demo-fastdebug-21.0.11.0.10-2.el9.alma.1.aarch64.rpm cf353258d3c9772f63e4d44d5844fc8d970e5a3ea7eec0566527c0948cea6f3c ALSA-2026:9693 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) Bug Fix(es): * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default java-25-openjdk-src-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 2ba142e071500e4396f29d07a3dbd345ad387f9c0d5e91afa5ff6b5d5ba89737 java-25-openjdk-headless-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 2fbe4cd638a79137fc6069c7406fbf58aa9fe33f05d7fa791676ddc261076c95 java-25-openjdk-static-libs-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 50b3ab4e9459db7b06463cc761df04c28d31aea63fc2a63855d18596a94329dd java-25-openjdk-headless-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 50eebc2595753c2a7e6dc078ca047222d8cef862d0ff20a18e05aa21eee1fa52 java-25-openjdk-demo-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 6abb89caf8cac1a2be557b8f55bcff20481d5d0937521773e23506bc475d0512 java-25-openjdk-devel-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 82458947756f1169c0a16c44bf222e931fd56be04afa0013a8237d36af27fa7d java-25-openjdk-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 88f60271aa0c9926b0eef2e7122fd887ce4f383da3321e39d2c21858191deedc java-25-openjdk-crypto-adapter-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 9968c1f50b601d803ba1d73b9a3624738c9b26d67e36e2a0a1f08fb95f97267f java-25-openjdk-devel-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 998978ce0a3300a6938c7924657285a85c37d0ae56e4a0bf63a24988b2f911d3 java-25-openjdk-demo-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm 9ab2f272c1a94bd9309fef43276341445371d9c6f9d04f9fea54bc87193b77dc java-25-openjdk-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm ae424cb6edc9a1eda97cc571029731af5ad2b5de9ed74a8b2b38ac41e4e3012e java-25-openjdk-jmods-slowdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm af42b7e9f64384fcd9648cb4f86a3f9a3b8efa58b3197eca591e1cb9226a9d2d java-25-openjdk-jmods-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm c17298f436424cd8a7ed4e2230b5a45b4f0be56bb784a0ebbc7a43b75c1df54b java-25-openjdk-crypto-adapter-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm d2bf8f23e0dc5bb38979d9d56c2d848480bf2bab757a9149697f472b32de67cb java-25-openjdk-static-libs-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm df9e7d4b92fb6fd71fb896fd0cfa5c28217735f7841120018c00c0f96b494bf3 java-25-openjdk-src-fastdebug-25.0.3.0.9-1.el9.alma.1.aarch64.rpm e7d6ebd5c1e5bd9a6ff69266d3569fa8c39b6b75a2d3c7e48b4771681ced8fe7 ALSA-2026:A002 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.49.2.el9_7.aarch64.rpm 1581e2aa526615dda1e5394c599387a4de7c0d896d3e2f271cd9f60295247d97 kernel-cross-headers-5.14.0-611.49.2.el9_7.aarch64.rpm c2d6eb2d4b3816a731c710126d30199ebe589100f161d40846e90c9201acd3b5 kernel-tools-libs-devel-5.14.0-611.49.2.el9_7.aarch64.rpm fa28c71262c05ef3f2a5faa117ae938e465b675cc103615c76fc2f61e913c930 ALSA-2026:A005 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.54.3.el9_7.aarch64.rpm 10b031fb7aad12908a93defd4751be8ea58df7ee826997724dda5a570310aa50 kernel-cross-headers-5.14.0-611.54.3.el9_7.aarch64.rpm 469f0bc8926216e61fffb1e16ef5489d99d73b24a0d573918358c94483cb8dbb libperf-5.14.0-611.54.3.el9_7.aarch64.rpm 920f122373d5de36c4e5f3ded99681acb7982395f889040e701b97caf1b1896a ALSA-2026:A009 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300) * kernel: ptrace: require CAP_SYS_PTRACE when task has no mm (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-aarch64-crb-rpms__9_7_default libperf-5.14.0-611.54.6.el9_7.aarch64.rpm 6c9125dabd46554df0f5d009c8662d6a5ea3785f090d525ab1ce86b21639df5e kernel-tools-libs-devel-5.14.0-611.54.6.el9_7.aarch64.rpm bbb8a4e392c17d3454ec1d600cc596398197d4e022c9d88bdfa5418331be6673 kernel-cross-headers-5.14.0-611.54.6.el9_7.aarch64.rpm d0d3ce49103ea30ce31f8a947bffe2efeb75e24b6feb9dca44701d34935b879a