ALBA-2026:39332 Copyright 2026 AlmaLinux OS 0 1 None

kernel bug fix and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Bug Fix(es) and Enhancement(s): * XFS data corruption using reflink [almalinux-9.8.z] (JIRA:AlmaLinux-193937) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.26.1.el9_8.s390x.rpm 9d40c6cfbf4ad38c4731f9dcd24624e491cd19944789431f539b18039176574c libperf-5.14.0-687.26.1.el9_8.s390x.rpm c555a402e934a13ff8837cad93e3d0fe38d065cd3bdbee7919f5e1876105ac2c ALSA-2022:5249 Copyright 2022 AlmaLinux OS 0 1 Important

An update for kernel-cross-headers is now available for AlmaLinux 9.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012) * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966) * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643) * SR-IOV performance > 50% degradation (BZ#2074830) * fix data corruption caused by dm-integrity (BZ#2082187) * SCTP client-side peeloff issues [almalinux-9] (BZ#2084044) * TCP connection fails in a asymmetric routing situation (BZ#2085480) * Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963) * spec: Fix separate tools build (BZ#2090852) * call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered (BZ#2092255) * Mark ThunderX NIC driver as unmaintained (BZ#2092638) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default kernel-headers-5.14.0-70.17.1.el9_0.s390x.rpm 1c8f71752eec52043fa93d04aaff6076261ca9fd2679c3d94714c0c834a464cc kernel-debug-modules-extra-5.14.0-70.17.1.el9_0.s390x.rpm 1ec4ede320d001664c8588badd6afd423a2acd329cc6e64f07af99cd7ec48090 kernel-debug-devel-matched-5.14.0-70.17.1.el9_0.s390x.rpm 21bf850a94070a9756bf1f981871a72c6b68f3d86bd38134cb022dd5120a2796 bpftool-5.14.0-70.17.1.el9_0.s390x.rpm 244ac2d837d13480740573f17f2eaaf456869d3a0840552e6e6920901734bf68 kernel-5.14.0-70.17.1.el9_0.s390x.rpm 314d778b6be5d713ae41d4f58cb4a64ad0c7cc2854670ec8e68cacd91e49b181 kernel-zfcpdump-modules-5.14.0-70.17.1.el9_0.s390x.rpm 3ca98aa034f59f852971c2702560ed1388efdbdf398a6670db7c20da7e92e9b8 kernel-modules-extra-5.14.0-70.17.1.el9_0.s390x.rpm 558dde9fc36d95194d371d5c27fc794583d3de90dce8a2cf4d2304a6f7506149 kernel-zfcpdump-modules-extra-5.14.0-70.17.1.el9_0.s390x.rpm 5d5f0c5bff8b736157a4a24572b0162cee9707477c21852b9d9df03b3879e22c kernel-devel-5.14.0-70.17.1.el9_0.s390x.rpm 6334b0646f96c354c423698f8329fab0079df4edbd6a5aa3467964d8d1567002 kernel-zfcpdump-devel-5.14.0-70.17.1.el9_0.s390x.rpm 658549321f30ace030c5c72fe90e6cbdd5bf2551a2b55daed5bff216f0c7c159 kernel-zfcpdump-core-5.14.0-70.17.1.el9_0.s390x.rpm 65d553578602c4e9fc437fa6a4e3b1c4076a0ced949f789caa74ebe4c17d3e6d kernel-abi-stablelists-5.14.0-70.17.1.el9_0.noarch.rpm 6c1459fb8b333303c7d981e116ccc0720c4f02c49ad9b933a93cdd2a4dc0f103 kernel-zfcpdump-devel-matched-5.14.0-70.17.1.el9_0.s390x.rpm 7c54210e0be71079246cd34b46627014d9522645b6bb2a4486a0d02f1fe865ae kernel-doc-5.14.0-70.17.1.el9_0.noarch.rpm 809a6a2193762c20c65675927231f196c18a5b97e6832f1fe1714467a5b785ca kernel-debug-5.14.0-70.17.1.el9_0.s390x.rpm 8aa147e5ec9235aee462c8b5bcb6e2c6454a160c2d57114be4cd021bbdecf9c7 kernel-modules-5.14.0-70.17.1.el9_0.s390x.rpm 8b954b3ab01b4bf0f424b3ed01b81a0fd64a015a0dec0a1bb5ab863d2d3de4c0 kernel-core-5.14.0-70.17.1.el9_0.s390x.rpm 93315084094f716e88d54b94209d535d4eeee881a1ce1384a37f90b1d16a1c0a kernel-debug-modules-5.14.0-70.17.1.el9_0.s390x.rpm aaf3bfd0e4346e57416fa6f724b1b8d619b8b08b08c13b14e9d2039a3f0a9b2a python3-perf-5.14.0-70.17.1.el9_0.s390x.rpm ab0fa74098a5514fb46ca338eb7bc274fddd7e10ce2361c96092ef330e126913 kernel-devel-matched-5.14.0-70.17.1.el9_0.s390x.rpm cefa7a0c97b2176f753be90c54c736e34c6f7a5c5671f8f1b5b817c08decadbd kernel-cross-headers-5.14.0-70.17.1.el9_0.s390x.rpm e51de7eefdd482ee1828547e50c2c017b4b6433291162bd6a169cb0914ca6faa perf-5.14.0-70.17.1.el9_0.s390x.rpm eec19c4e3c60b5a285cd1fee662fe86685c711c0c79be9f9d9508595a1cc5b81 kernel-debug-core-5.14.0-70.17.1.el9_0.s390x.rpm f05d2a35aa7b3e12978a03fde79baf265bce773440705f5f3eba09e71ee878a1 kernel-debug-devel-5.14.0-70.17.1.el9_0.s390x.rpm f11f05b73093541bda0044829365bae37a37b3114bacc6daa1fd58b90f74dddb kernel-tools-5.14.0-70.17.1.el9_0.s390x.rpm fd39899f2b2afa6d0ac39d08490ef8d3df92182231efb62d02e367640a6fea0e kernel-zfcpdump-5.14.0-70.17.1.el9_0.s390x.rpm fe84a39abf81c37637e91cecbec7dfe33ab9868d1cb12434f0bc2844731427f7 ALSA-2022:5252 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libarchive-devel is now available for AlmaLinux 9.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: an out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default libarchive-3.5.3-2.el9_0.s390x.rpm 9d9a21f53de7ffbe1585ec4f93c5fe2b29e32232fa87d0919796e4ff9b28b6a7 bsdtar-3.5.3-2.el9_0.s390x.rpm a91013540de7ae254a64677c1040c97435f3aa4858a049101e762cb4944777bf libarchive-devel-3.5.3-2.el9_0.s390x.rpm cf08e05da34f5fe074325ed87c077de2deb35197eb5ac2a158788053b1a07afe ALSA-2022:5257 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libinput-devel is now available for AlmaLinux 9.

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default libinput-utils-1.19.3-2.el9_0.s390x.rpm 4560a3a6f9ca2e4d69c3ce9561c995289d9a49b22750997c81015a85befbf27d libinput-devel-1.19.3-2.el9_0.s390x.rpm 6f100677750e4ecd29d96fe5b9170fb472dd8fd1ee77b08026a6755a2a631ea5 libinput-1.19.3-2.el9_0.s390x.rpm a28458e552b4ce640eb13c9d505b54de8f347cdec5b781427db7c08603425539 ALSA-2022:5695 Copyright 2022 AlmaLinux OS 0 1 Important

An update for java-11-openjdk-demo-slowdebug is now available for AlmaLinux 9.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084777) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-11] (BZ#2099915) * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-11] (BZ#2107866) * Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-11] (BZ#2107868) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default java-11-openjdk-11.0.16.0.8-1.el9_0.s390x.rpm 2100fb0b0c65db8d9d84b03d4f2c7989a9ca18c126be06a1b11a83cfa7e36488 java-11-openjdk-javadoc-zip-11.0.16.0.8-1.el9_0.s390x.rpm 2e0b0fb62c9287f3876a393afb7fae722daedf1d06535eb8fb1129512b2fb123 java-11-openjdk-static-libs-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 30d6e0be63968c22f1340152fa60d4f9e25a9bb8b63df9c11a9051ee20bfade3 java-11-openjdk-javadoc-11.0.16.0.8-1.el9_0.s390x.rpm 384c8917d813c69fb0c2b90f57c3f20ee2e74842ba08fa3dc086156b367cf03c java-11-openjdk-headless-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 448b9c34d7fb4bef0d11cdb013c2c7031887a1ff947979ec0aac227bd3140d5b java-11-openjdk-jmods-11.0.16.0.8-1.el9_0.s390x.rpm 5488e365ed8e636eb0d266825dbc2e4a113349d3e15052b55594005c59ecf13f java-11-openjdk-jmods-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 5c484910d3c26532111dfbf37da5572ddde1ce20de1c89dc619bbf4f5eb588b9 java-11-openjdk-demo-11.0.16.0.8-1.el9_0.s390x.rpm 624d7dd68d3358bbf16362575941d8a0c29ece83e27e8e7cdf19d4a93bdcec6c java-11-openjdk-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 823f3c1319841869e735533ae5330c54d2f700d017bdb880a4c639211b586558 java-11-openjdk-src-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 87a06c2355a91726b0a58519132e2643291885c2dd07884b467c1107c8f75155 java-11-openjdk-devel-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm 93822026212ec5999f27829e7c8aa1fe52a50b935c717b649930f1a23f83f3c7 java-11-openjdk-static-libs-11.0.16.0.8-1.el9_0.s390x.rpm ab768747d3ef855a62cd12c77420b86c5960baec93e5e2b7aa2ae9bee6f6bea6 java-11-openjdk-demo-slowdebug-11.0.16.0.8-1.el9_0.s390x.rpm cd6273eeffd83d107e86f6a6108a731b85d21021136b038a032b82c0c0812eab java-11-openjdk-headless-11.0.16.0.8-1.el9_0.s390x.rpm cdb6b8354d443f46f625f7a9fb3695272aa5539d2efe1621ac4df1c6f0af8aa9 java-11-openjdk-devel-11.0.16.0.8-1.el9_0.s390x.rpm df5c4e62cb0f9e96d5303e0a779d687b46bdbecf84317c83af3a2537da02bc2a java-11-openjdk-src-11.0.16.0.8-1.el9_0.s390x.rpm f0808c76eb4d6cc7f231b0354cd8a4c16deefd627aaea81a57a4d5dd207fa146 ALSA-2022:5736 Copyright 2022 AlmaLinux OS 0 1 Important

java-17-openjdk security, bug fix, and enhancement update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8). (BZ#2084779) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) * OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previous AlmaLinux builds of OpenJDK 17 altered the arguments passed to sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an additional form of the method, retaining the original arguments, so that applications which depend on this internal method continue to function with AlmaLinux builds of OpenJDK. (BZ#2099919) * With previous AlmaLinux builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2105395) * With the release of AlmaLinux, a change was made so that disabling OpenJDK FIPS mode required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.AlmaLinux.fips=false options, with the intention that FIPS mode could be controlled independently of system security properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is required to disable FIPS mode, as in AlmaLinux. (BZ#2107941) * Previous AlmaLinux builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a lack of module access permissions. This has now been corrected. (BZ#2107943) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default java-17-openjdk-static-libs-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm 24db0f88c67f9550e87167dfda19daf9ca29474b397247762f9a47e7d5b011b8 java-17-openjdk-headless-17.0.4.0.8-2.el9_0.s390x.rpm 2b93f408a31923006f19c413154b7eec765ee7b53628c113ad5364b9a1b0ce16 java-17-openjdk-static-libs-17.0.4.0.8-2.el9_0.s390x.rpm 34fe937d82ab93004edf7be54669f70a19ec72240689bfe288323298b1d07436 java-17-openjdk-src-17.0.4.0.8-2.el9_0.s390x.rpm 387aea975f89f436cd1b2a9ee32b7d614381027f7badc81a0a61c0ffb4d95119 java-17-openjdk-demo-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm 3f7846224b077c69826909ae8f82ecec039ca52da03c91ce04cca1d745dfd8a8 java-17-openjdk-jmods-17.0.4.0.8-2.el9_0.s390x.rpm 62ddfe081f89a21c2668bdd1ffad3fdee7c6117df6eab86f412b32f1d274540a java-17-openjdk-devel-17.0.4.0.8-2.el9_0.s390x.rpm 6771617bef156727698c7aab9cc6abb1a483e90634629d0bf2685a356c588749 java-17-openjdk-17.0.4.0.8-2.el9_0.s390x.rpm 722c850f0f06a8b092de99623e3d24892372182ff1056586645524796b6fd809 java-17-openjdk-headless-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm 7ce758d7226ecc78bfb76bfe73ca6f2abc1a796c15b27764224bedd3db45c54e java-17-openjdk-jmods-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm 95f144cf0823b9fd736bc02a3c6e6940bcd8b978bac3a9dfdd386f9176efa9b2 java-17-openjdk-javadoc-zip-17.0.4.0.8-2.el9_0.s390x.rpm 9e20e557167a421e5b322eb2fd2e383122f757b0c57921e207b41737d2859471 java-17-openjdk-demo-17.0.4.0.8-2.el9_0.s390x.rpm b193b74ef98fc43242a4acfc7f1448286ea6e029bed92591b0cffc389c1102c1 java-17-openjdk-devel-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm de6a8848752ec754063a4913f108c5c704445767d7717fbe4859714fb9c74bfa java-17-openjdk-javadoc-17.0.4.0.8-2.el9_0.s390x.rpm e7ce0ff503f361e9749c61e9c4f180764366a579a068e10e7b2b427b1aacd148 java-17-openjdk-src-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm f3ff12b9089a06177e25f59635deecae412dd7d21c1d6aec51bcb28d522e40ce java-17-openjdk-slowdebug-17.0.4.0.8-2.el9_0.s390x.rpm f6b3c11d4d12c836ec3ff792d549394f66add574e64d7e612a66560978f73fb6 ALSA-2022:5948 Copyright 2022 AlmaLinux OS 0 1 Moderate

galera, mariadb, and mysql-selinux security, bug fix, and enhancement update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default mariadb-backup-10.5.16-2.el9_0.s390x.rpm 2b79935a79b9b38dacbb156955865e3c015186a6a1363d467278078f65d8b073 mariadb-server-utils-10.5.16-2.el9_0.s390x.rpm 46eeb4cf8bdfd728a093181b7f0b22e9b18aad5f873b91b38e6ab620525e3ed4 mariadb-oqgraph-engine-10.5.16-2.el9_0.s390x.rpm 4998e4b26b0370c2b7b888e954e0d26fa62e667d96eae0069205f278a1ae4551 mariadb-server-10.5.16-2.el9_0.s390x.rpm 65adc8d50f18a4bffd1f335ec7138feb7b6a6e60cd7653265fd65f6d52b5e698 mariadb-10.5.16-2.el9_0.s390x.rpm 732dab00be1c7d2e6210d5fc0c8c550200c36a01fe46a1711415b7ec02e4814a mariadb-pam-10.5.16-2.el9_0.s390x.rpm 975261dfe362348bff47e4058e7610a0d257083310b33ae579a88c299163ebc4 mariadb-common-10.5.16-2.el9_0.s390x.rpm b04fd9035206c6e2ae9b2dcf76f0ee1da63604f23a45c67c04a5ce13b45897ff mariadb-test-10.5.16-2.el9_0.s390x.rpm b2dcbba4ed23cf529d96b736292034086c6914479b6a39e6d91039427219975a mariadb-gssapi-server-10.5.16-2.el9_0.s390x.rpm b6aa9f15ceab06fc61a8e8abe4c990da3659a20f42c17909222aef3324ceb8bb mariadb-devel-10.5.16-2.el9_0.s390x.rpm bd2f1ed7cfb768fe1ec4ede49366f7d3f90fac87363d3dd97ee7ce64ed42d38c mariadb-embedded-10.5.16-2.el9_0.s390x.rpm f2e6037e84dbd95103119d290e7972b72c4052717964e9d18590eb8688a62396 mariadb-embedded-devel-10.5.16-2.el9_0.s390x.rpm fa1e775a824f64274a62358ac5e0df3fd48a356ef74cab87073ee864ead2522a mariadb-errmsg-10.5.16-2.el9_0.s390x.rpm fa3e41f38a47a6f4660060e152b669f8b29552903d0ab0a0c1af820b9b0066ca mariadb-server-galera-10.5.16-2.el9_0.s390x.rpm fefd371740d55e6748ad87e7a5dc218a8825baae9316e4069a6e279df3053103 ALSA-2022:6003 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * information leak in scsi_ioctl() (CVE-2022-0494) * use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Power9 - LPAR fails to boot in shared processing mode and call traces are seen [Hash] (BZ#2092248) * Hard lockups are observed while running stress-ng and LPAR hangs (BZ#2092253) * FIPS module identification via name and version (BZ#2093384) * gfs2: File corruption with large writes when memory is tight (BZ#2097306) * i/o on initiator stuck when network is disrupted (4.18.0-372.9.1.el8.x86_64) (BZ#2098251) * AlmaLinux 9.1 doesn't support 3rd SATA (BZ#2099740) * Guest call trace when reboot after postcopy migration with high stress workload (BZ#2100903) * Oops or general protection fault with RIP decode_attr_security_label at decode_getfattr_attrs (BZ#2101854) * Oops as BUG: unable to handle page fault as free of uninitialized nfs4_label on nfs referral lookup (BZ#2101858) * lpar crash with Oops: Kernel access of bad area, sig: 11 [#1] when changing mtu of a bond interface (P10/ ibmvnic/ Haleakala) (BZ#2103085) * OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2109974) Enhancement(s): * iommu/vt-d: Make DMAR_UNITS_SUPPORTED a config setting (BZ#2105326) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default kernel-core-5.14.0-70.22.1.el9_0.s390x.rpm 0644481c45fb6b0969b5597e1b07ab567a10b60d9416941abb275682fe21462b bpftool-5.14.0-70.22.1.el9_0.s390x.rpm 156982325685f1eecbd0586c2a75a76b568875cd1f1d2e8ecc3df0cdc9c371e5 kernel-doc-5.14.0-70.22.1.el9_0.noarch.rpm 232d05e4af484d9fb62fcffcdb7b23f898a654e8107f29507eaa1d61344427aa kernel-debug-core-5.14.0-70.22.1.el9_0.s390x.rpm 24d188c95afb3f367976170f99f22b96a5373e6e808da9e27aaf4ec37ba642b9 kernel-headers-5.14.0-70.22.1.el9_0.s390x.rpm 258f0be2224fa3f2295c4c07c2494e53114bd6dd0a6e95847d6cea89c77fd8d8 kernel-zfcpdump-modules-extra-5.14.0-70.22.1.el9_0.s390x.rpm 26df0e894bfe2bddbbf1c79fdbc08b7c626adb1f7ca32a8a2c2e46be04dfd53c kernel-debug-modules-5.14.0-70.22.1.el9_0.s390x.rpm 2a1469c0c44b7290cd72246a98c87332841058be3fb29dae8cbdc4375bfb27f5 perf-5.14.0-70.22.1.el9_0.s390x.rpm 3c5b628aa62ecf6e50abe12ba5076b3d2922ec60d43bc2ace91a57b76033fd5c kernel-zfcpdump-devel-matched-5.14.0-70.22.1.el9_0.s390x.rpm 41c5293fe8405da40a0e509c6e778d27374b3c743e1a5e07d7d57e5ef31e034f kernel-modules-5.14.0-70.22.1.el9_0.s390x.rpm 4226cc3e39177830aac6b00cd92c65b2da64e64c9ab2ea086fcd110aa7d67a73 kernel-cross-headers-5.14.0-70.22.1.el9_0.s390x.rpm 4a945f9f27e425cd30e4f513d94161b86252ccb9ce8d737cd77faafeef9dd289 kernel-tools-5.14.0-70.22.1.el9_0.s390x.rpm 5dfb3530c7f5f0abc4a2f1d4ae60f37ee22bf3cdab97e58f06657c3d9adfe176 kernel-zfcpdump-core-5.14.0-70.22.1.el9_0.s390x.rpm 713c3f2f80f07f73f086ef1d4b7cba5e041d684d93663ec8c37e6a1f7b121e45 kernel-zfcpdump-devel-5.14.0-70.22.1.el9_0.s390x.rpm 77a4d8749a4cc28f425cf8a2c74fb5b75c5744afb56ecc0739e9bb2e8c4fd4bb kernel-5.14.0-70.22.1.el9_0.s390x.rpm 83bab7059170940d38429006e1294a608d064489eeedf4d786f0f9c30fa3f57c kernel-devel-matched-5.14.0-70.22.1.el9_0.s390x.rpm 89873b6dd6b279acb752ef1c24f54b7c1749032f2ccf14ae08467a4f91aa4046 kernel-debug-devel-5.14.0-70.22.1.el9_0.s390x.rpm 9a3d61a0cc86655206e4df2bc373e8aab4b4f6b53e478d4f653e5c4495356a3e kernel-debug-modules-extra-5.14.0-70.22.1.el9_0.s390x.rpm 9ec86f69e12e4625e1fa0525b5668f9e7e4534561521cccdc5fc1686198ec1d2 kernel-abi-stablelists-5.14.0-70.22.1.el9_0.noarch.rpm a7507bb31645b36cd5120e3dee6c9f7928ea50fa4707527e8af610752ebdea2e kernel-debug-5.14.0-70.22.1.el9_0.s390x.rpm ab2767e4b22e4d31ec41d37ac33c5bdde0a779b2a85909cc352c1b189533619b python3-perf-5.14.0-70.22.1.el9_0.s390x.rpm cc4bd21bec173e015820b8a211bb005ef5def3b6559b63243761204f536dca66 kernel-debug-devel-matched-5.14.0-70.22.1.el9_0.s390x.rpm ce291f2dd2ed2a92acd5401273330e0ca02b5ee228617329e20db3e25d8c1776 kernel-zfcpdump-modules-5.14.0-70.22.1.el9_0.s390x.rpm ceae4af4aedc55ebd2f29b9aa774b5488b19a650bfb95c216e8a09216fbce136 kernel-zfcpdump-5.14.0-70.22.1.el9_0.s390x.rpm dba4d7ecb3300f6c675fed35c43013b84820865a93201413783dc558e78850bd kernel-devel-5.14.0-70.22.1.el9_0.s390x.rpm fc0e3030e061696ef149861997da4b337cbd741a3863139b1cbb96ad6cf52edb kernel-modules-extra-5.14.0-70.22.1.el9_0.s390x.rpm ffffa93f2ee3672af348482d6849fc0a57469603ea3b1447326f00df1e50fdb7 ALSA-2022:6043 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.108 and .NET Runtime 6.0.8. Security Fix(es): * dotnet: External Entity Injection during XML signature verification (CVE-2022-34716) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default dotnet-templates-6.0-6.0.108-1.el9_0.s390x.rpm 321f0ca55f249ee7eb74eb5cd0fe991c6f3572e421eeea33fa293b119c38617a dotnet-hostfxr-6.0-6.0.8-1.el9_0.s390x.rpm 3ddbd4f95120658648ef691e54a75d682925daa5482c499f4be45ced0bcd4bc5 aspnetcore-runtime-6.0-6.0.8-1.el9_0.s390x.rpm 5a22120709fd668f7855a33834a980b330020e831e32f182d4d3fb6b47edd41c dotnet-apphost-pack-6.0-6.0.8-1.el9_0.s390x.rpm 652e1d0307b8bdd541ed78fea9c33c6d31827cfe81f84974a6e2a3f9a53a9354 dotnet-runtime-6.0-6.0.8-1.el9_0.s390x.rpm 9e90661c3da2338e62f07d71cbf9e187be9e0bccb5072212fc29074a8bfe81aa dotnet-targeting-pack-6.0-6.0.8-1.el9_0.s390x.rpm a7ee85d67d78b29da9ccaf30af208af3821558a4924869fe4535ede265e0047b dotnet-sdk-6.0-source-built-artifacts-6.0.108-1.el9_0.s390x.rpm aa3fd3db6e6e482093b1aef9ae9a4e1571fafc4af58d44f36524eac202e524b9 aspnetcore-targeting-pack-6.0-6.0.8-1.el9_0.s390x.rpm b8c5125f7b2697d75647a903cd7f3b79af7af5a77769bae874c5a8b28e310c08 dotnet-sdk-6.0-6.0.108-1.el9_0.s390x.rpm bcea0bf0024dfc1219d27cc66d7a3a96a49b72eeac42cfe3079898cbca19cc70 dotnet-host-6.0.8-1.el9_0.s390x.rpm c6573742163d39e9df9c6e7c1cbb39682172b59cc469850e80da74effba77e54 netstandard-targeting-pack-2.1-6.0.108-1.el9_0.s390x.rpm e3f12fa5e07917de2917cf3e1033738dd854b055c072356d7535ccbc631c1ea2 ALSA-2022:6521 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.109 and Runtime 6.0.9. Security Fix(es): * dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion. (CVE-2022-38013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el9_0.s390x.rpm 6747957b87fcb492e6732bce37c0f8d1e7c675fdcae5e6be74db814a5f83a533 ALSA-2022:6585 Copyright 2022 AlmaLinux OS 0 1 Moderate

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428) Security Fix(es): * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default ruby-doc-3.0.4-160.el9_0.noarch.rpm c5aa94f05bb1afcbd2618a66cc942c7ed10a4ef69aae59317f0d3d7ee3173120 ALSA-2022:6590 Copyright 2022 AlmaLinux OS 0 1 Moderate

mysql security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.30). (BZ#2122589) Security Fix(es): * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21412, CVE-2022-21414, CVE-2022-21435, CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459, CVE-2022-21462, CVE-2022-21478, CVE-2022-21479) * mysql: Server: DML unspecified vulnerability (CPU Apr 2022) (CVE-2022-21413) * mysql: Server: Replication unspecified vulnerability (CPU Apr 2022) (CVE-2022-21415) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21423) * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21425, CVE-2022-21444) * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427) * mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21454) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022) (CVE-2022-21455) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21457) * mysql: Server: Logging unspecified vulnerability (CPU Apr 2022) (CVE-2022-21460) * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21509, CVE-2022-21525, CVE-2022-21526, CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553, CVE-2022-21556, CVE-2022-21569) * mysql: Server: Options unspecified vulnerability (CPU Jul 2022) (CVE-2022-21515) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21517, CVE-2022-21537, CVE-2022-21539) * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21522, CVE-2022-21534) * mysql: Server: Federated unspecified vulnerability (CPU Jul 2022) (CVE-2022-21547) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022) (CVE-2022-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Default logrotate set to wrong log file (BZ#2122592) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default mysql-libs-8.0.30-3.el9_0.s390x.rpm 0c26f1f99da382fabc1d400f3ce513d217b66b97c7d9f27db09d686f1304acb4 mysql-test-8.0.30-3.el9_0.s390x.rpm 41574e6779cd1efae7dd2b5f4d0e69872c39693a9d416850640ec25c7fd0cdac mysql-devel-8.0.30-3.el9_0.s390x.rpm f004412da5c9424942ff688cc1e621cfd13d2d0ac5bb70309ddaf3499a3f1f0c ALSA-2022:6610 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918) * kernel: vulnerability of buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * RDMA/mlx5: Fix number of allocated XLT entries (BZ#2092270) * mlx5, Setup hanged when run test-route-nexthop-object.sh (BZ#2092535) * many call traces from unchecked MSR access error: WRMSR to 0x199 in amazon i4.32xlarge instance (BZ#2099417) * X86/platform/UV: Kernel Support Fixes for UV5 platform (BZ#2107732) * block layer: fixes for md sync slow and softlockup at blk_mq_sched_dispatch_requests [9.0.0.z] (BZ#2111395) * Fixes for NVMe/TCP dereferences an invalid, non-canonical pointer, kernel panic (BZ#2117755) * Adding missing nvme fix to AlmaLinux-9.1 (BZ#2117756) * nvme/tcp mistakenly uses blk_mq_tag_to_rq(nvme_tcp_tagset(queue) (BZ#2118698) * Important ice bug fixes (BZ#2119290) * Power 9/ppc64le Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2121719) Enhancement(s): * lscpu does not show all of the support AMX flags (amx_int8, amx_bf16) (BZ#2108203) * ice: Driver Update (BZ#2108204) * iavf: Driver Update (BZ#2119477) * i40e: Driver Update (BZ#2119479) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default kernel-cross-headers-5.14.0-70.26.1.el9_0.s390x.rpm b14d5d1cd67560760a2545f7d7ca86f37d6de4663436c70d3be20b2699c55d51 ALSA-2022:6763 Copyright 2022 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080) * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177) * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default bind-devel-9.16.23-1.el9_0.1.s390x.rpm 0f855846bdcc1b144a2d5ad60b1ca4f8c6c90212992f7db93bd7df2af72dae7c ALSA-2022:6913 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.110 and .NET Runtime 6.0.10. Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.110-1.el9_0.s390x.rpm fcc56c8f7f80344ec336aa4b2cadc9eb5f345361c041c484a34d25c1f5334df2 ALSA-2022:6999 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [almalinux-9] (BZ#2132934) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default java-17-openjdk-headless-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm 1fd449f132d4128cc91329c5ae4798d3c05d35b0c363fde2ad2963dca9950533 java-17-openjdk-static-libs-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm 3652f1ed7663cede673bc01a0f66c0c175afea4d972689f746aaec3d5ade7811 java-17-openjdk-jmods-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm 6427f9b3d3c8653cfe5a8b4aa947b6a15eb356e63758cf374575ae5214046578 java-17-openjdk-devel-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm 730b8443b243d792a81cf127a1162830ce71ea9d41e7babfdb9c5a7606b8231a java-17-openjdk-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm ac9319ba68d53a8d7f5b4bd8de8bcc7b490e4f41cd24975f10bd9d29bcaabbe3 java-17-openjdk-src-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm aea3a320bd4e5e3e531de24323455c9910d391d07664d478f58b393f61fd2a3b java-17-openjdk-demo-slowdebug-17.0.5.0.8-2.el9_0.s390x.rpm f6db8dc9858b277c821f01c9db9120b2bc79a01f6ffb981bd601213a9acea918 ALSA-2022:7013 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [almalinux-9] (BZ#2131865) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default java-11-openjdk-demo-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 0136ecfb270ba7ff119bc24a023c8d5de8849a2ce6e202f4e624e849afa31d44 java-11-openjdk-headless-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 197d8c9aab3b0b968517cc8b6d5dfdcc1c1be64f15921d664d7c46f119a5fdc0 java-11-openjdk-static-libs-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 60bc1ca12eedd209b34364eba099a0c378c6b488550a5383b65295a12e85f23d java-11-openjdk-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 7acbefce93a965b4229ea291288e45c841e658d1a2afb8eee6c2ffb3c9c84ffc java-11-openjdk-devel-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 7e71bb30ee42194a4585cbc99dfc99034ed5e95264a9e34e25e08963515ba507 java-11-openjdk-src-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm 82a5cb9b1cae682fabb6202dda1e7a15a829df38554bc5f7dd73d40d02419703 java-11-openjdk-jmods-slowdebug-11.0.17.0.8-2.el9_0.s390x.rpm b7c3e77ba30672475111eec35682610cd28c07f2dee5a8d1341434fed52b092e ALSA-2022:7090 Copyright 2022 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execution (CVE-2022-3515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default libksba-devel-1.5.1-5.el9_0.s390x.rpm 5d31961559861193512120df2f84f442d611fc9737c39d3b1e6f4cd6cd607834 ALSA-2022:7185 Copyright 2022 AlmaLinux OS 0 1 Important

device-mapper-multipath security update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket (CVE-2022-41974) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default device-mapper-multipath-devel-0.8.7-7.el9_0.1.s390x.rpm f1aba5f84b4769b06d73b53e067f32bf1be858018b1851e314a1b5a7ab27c690 ALSA-2022:7314 Copyright 2022 AlmaLinux OS 0 1 Moderate

zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default zlib-static-1.2.11-32.el9_0.s390x.rpm 786a1206d349e64db5f7969555f525f8e3e85b9577ca209b4694238b39b84f7c ALSA-2022:7318 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585) * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653) * execve exit tracepoint not called (BZ#2106661) * Matrox black screen on VGA output on some systems. (BZ#2112017) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129) * watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857) * Update cifs to 5.16 (BZ#2127858) * Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859) * vfio zero page mappings fail after 2M instances (BZ#2128791) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970) Enhancement(s): * Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default kernel-cross-headers-5.14.0-70.30.1.el9_0.s390x.rpm 687f0a2c0a817340cd36e8d0a7e80fb436a98df17cc4866d1b3d30518382cbfb ALSA-2022:7323 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default python3-debug-3.9.10-3.el9_0.s390x.rpm 8a59201e190dcaa68bf6972a1a0607069ad86665f30580d8177d3394d88eeffc python3-idle-3.9.10-3.el9_0.s390x.rpm abddb05e7ab608ba2f4567fd72c82f7f0dbf5af798759fcbff730bafb5a6d4a3 python3-test-3.9.10-3.el9_0.s390x.rpm c3ad51def2e40138cb5dc5c176f736c745c712af42581056c13702ba1f11c8fc ALSA-2022:7329 Copyright 2022 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling (CVE-2022-33099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_default lua-devel-5.4.2-4.el9_0.3.s390x.rpm c345598381aa00205494f3165374390ff6c05e08bc676c5b985ab14f6772ebf5 ALSA-2022:7958 Copyright 2022 AlmaLinux OS 0 1 Low

libguestfs security, bug fix, and enhancement update

The libguestfs packages contain a library used for accessing and modifying virtual machine disk images. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libguestfs-gobject-devel-1.48.4-2.el9.alma.s390x.rpm 0821940086c4dae63c49d58613172cd34cdb7e3eb98afbde3f259343337e6aee libguestfs-gobject-1.48.4-2.el9.alma.s390x.rpm 549937e5e2ba3316c1335cff071e617b42a26ecdf39fb5bf9c713c4de0ae19ca libguestfs-devel-1.48.4-2.el9.alma.s390x.rpm 5dbd3e3bc557ea7f3aa74ebf16da7d51dfbd987f939c735f383114d84d5bf0c6 ruby-libguestfs-1.48.4-2.el9.alma.s390x.rpm 642b1242c10a0c101616c890f5e46fd3f99c183eddabdfdb6490a2a5c9a32ccc lua-guestfs-1.48.4-2.el9.alma.s390x.rpm 68a25a7316cb6c86e10ff0a07e73ddbc7074ee1200ffdf6dac56bc653544e98e libguestfs-man-pages-uk-1.48.4-2.el9.alma.noarch.rpm af4f710b4de913c305b93516d4b72c70a6d6bea6926c1d220a9b862364554647 libguestfs-man-pages-ja-1.48.4-2.el9.alma.noarch.rpm c70d6eb341fe0eca9d22773d7e0310f3848bfed5973fc92f46cd0df16dcb3cdf ocaml-libguestfs-1.48.4-2.el9.alma.s390x.rpm c8787793a72b326f42586517b618f053993620851c09e788a2c01e4be7f7599e ocaml-libguestfs-devel-1.48.4-2.el9.alma.s390x.rpm da0778232e1b7256e283e08459b12554af3da2d5f505ea9cce9beff9769dc1ae php-libguestfs-1.48.4-2.el9.alma.s390x.rpm f977c1d75f100fe1a011d59ee031530414a795b26fd5f3703d0696939839c92b ALSA-2022:7970 Copyright 2022 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default protobuf-lite-devel-3.14.0-13.el9.s390x.rpm a79c87753f5a6e7a8e2a7c258c4ef13b52f6b54e0962fbd77a79b8497808afa0 protobuf-devel-3.14.0-13.el9.s390x.rpm f217c79fceb6b792255b8eabff9b40eed97d9c829d8c8d0e2e7e568e5f8f1db3 protobuf-compiler-3.14.0-13.el9.s390x.rpm f242f56c97f46b3a2e4022c55e24eed0cebcdd72275eeea709aa2242c1094070 ALSA-2022:7979 Copyright 2022 AlmaLinux OS 0 1 Low

speex security update

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fix(es): * speex: divide by zero in read_samples() via crafted WAV file (CVE-2020-23903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default speex-devel-1.2.0-11.el9.s390x.rpm 8a45f3349104bac1fff7ca2af48db8546dbf09e6a8c4d8ebc3aa38b132f0b2d4 ALSA-2022:8003 Copyright 2022 AlmaLinux OS 0 1 Low

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313) Security Fix(es): * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libvirt-docs-8.5.0-7.el9_1.s390x.rpm 5f6a32c749e265e16d82ed567cf157be9c29ec6f642c0a7c43a16953585e57f8 libvirt-lock-sanlock-8.5.0-7.el9_1.s390x.rpm 6f3858863f1f978519f03ef0155bc9711f84b46afbd07e454db5e91efc470f03 libvirt-devel-8.5.0-7.el9_1.s390x.rpm d07d7034ed1aeef769c83d4ad2a681d7442a624c9a4c859462f5494711683e35 ALSA-2022:8022 Copyright 2022 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework. Security Fix(es): * qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default qt5-devel-5.15.3-1.el9.noarch.rpm 9ebc6c52b9d1433612ea6bf67d160c769264f1496832e938e054352bab4405f7 ALSA-2022:8062 Copyright 2022 AlmaLinux OS 0 1 Moderate

unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2087120) Security Fix(es): * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30698) * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default unbound-devel-1.16.2-2.el9.s390x.rpm 44bef07e3eb38e96c8704542c2089e759ad2ee1e3043c615c285747500697b0e ALSA-2022:8068 Copyright 2022 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220) * bind: DoS from specifically crafted TCP packets (CVE-2022-0396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default bind-doc-9.16.23-5.el9_1.noarch.rpm 7f2b5ebe8235b3d3a50a33d977b33607b5f6be05132c0d35d411e1b8c0c17f3e bind-devel-9.16.23-5.el9_1.s390x.rpm a0a6d2dd428c67f5e0385686958244c0e06d29097caf083cd643aedfa79c05d5 ALSA-2022:8078 Copyright 2022 AlmaLinux OS 0 1 Moderate

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default flac-devel-1.3.3-10.el9.s390x.rpm 33209ac8b3094fbbd946d69552b8b270d74a2ee6835b2fd14ca48fd9aef51014 flac-1.3.3-10.el9.s390x.rpm 9310d160cd8561d36c052e030c3ab3e814d35702d19c16a6f316a12445bed569 ALSA-2022:8139 Copyright 2022 AlmaLinux OS 0 1 Low

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default wavpack-devel-5.4.0-5.el9.s390x.rpm b6e70fb97afa6c00006053707a8c2039baa1c09796be68821ef02567e7e14b28 ALSA-2022:8151 Copyright 2022 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: A logic error in the Hints::Hints function can cause denial of service (CVE-2022-27337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default poppler-devel-21.01.0-13.el9.s390x.rpm 5009d963b982b3c7eeb2d88a687757726a63106faf3ee1737597ef9d477bd167 poppler-cpp-devel-21.01.0-13.el9.s390x.rpm 536c21c8fedb2f4e9e15a568dd174e539e3f997b5b956422f1f46894112d7b35 poppler-qt5-devel-21.01.0-13.el9.s390x.rpm 85fea71b94f007d0c7f5e240cf25a16a1e489139b0dbbcb0ab262445b2343676 poppler-glib-devel-21.01.0-13.el9.s390x.rpm f593a2b46dbc151b9f3320f48086c39ac61ca8c2697f05ef266d7b5340c672e9 ALSA-2022:8194 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562) * libtiff: reachable assertion (CVE-2022-0865) * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924) * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355) * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844) * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891) * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908) * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909) * libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libtiff-tools-4.4.0-2.el9.s390x.rpm 0da0c47e9c61c8184b2b50d30593441ed8f22e6b5b1aea7a3a18a0aca46a7e2c ALSA-2022:8207 Copyright 2022 AlmaLinux OS 0 1 Low

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer (CVE-2022-1122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default openjpeg2-tools-2.4.0-7.el9.s390x.rpm 1ca8474cd2ebf6be846b439abeaa66b50b72346bdfaaa94f306af196679da7a8 openjpeg2-devel-2.4.0-7.el9.s390x.rpm 6a0d56d32fdeb77caf988288fc14e677f404bff0def2c33ad0adf35e2338aa44 ALSA-2022:8208 Copyright 2022 AlmaLinux OS 0 1 Moderate

dovecot security and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default dovecot-devel-2.3.16-7.el9.s390x.rpm 251346e866ce0bf76791c73676f7aca9d0a81a502e1775e127066bbe929d20d4 ALSA-2022:8221 Copyright 2022 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default xorg-x11-server-devel-1.20.11-11.el9.s390x.rpm 34fac8cb6c77d769cc34faf19ba1ab0582158eddae579514cff223e812bcef13 xorg-x11-server-source-1.20.11-11.el9.noarch.rpm 4e2b11caa9b1ede84bff1d50b6074841cd4ea148cfa780ae8267b2a485e75219 ALSA-2022:8252 Copyright 2022 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default yajl-devel-2.1.0-21.el9.s390x.rpm 4824643d9d415ef368b5a9501ade5510dd10223c8248793d2af79650a2072e25 ALSA-2022:8267 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516) * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640) * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168) * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617) * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854) * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016) * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048) * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184) * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280) * kernel info leak issue in pfkey_register (CVE-2022-1353) * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679) * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852) * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998) * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586) * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639) * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368) * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123) * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125) * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166) * possible to use the debugger to write zero into a location of choice (CVE-2022-21499) * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900) * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825) * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373) * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390) * use after free in SUNRPC subsystem (CVE-2022-28893) * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581) * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901) * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946) * nf_tables disallow binding to already bound chain (CVE-2022-39190) * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.6.1.el9_1.s390x.rpm 2b1012c20c47a93d6706b776ca85fa8825dd85ab9f20060ae197abf14be47af0 ALSA-2022:8317 Copyright 2022 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.16.4). (BZ#2077487) Security Fix(es): * samba: server memory information leak via SMB1 (CVE-2022-32742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libsmbclient-devel-4.16.4-101.el9.s390x.rpm 2c77b30b0b41f957133f21e43f1f1c8dfcf425885de9096b715618914a5b003d libwbclient-devel-4.16.4-101.el9.s390x.rpm 5564f68e346c2f546b671e982666e2c67c3c77536b2841a7955b8eb6863fd6fc samba-devel-4.16.4-101.el9.s390x.rpm 5831406e05e1ac9878eb38f0e8a53134e70eb5935b473d13d7f5a4b3625ea168 samba-test-libs-4.16.4-101.el9.s390x.rpm 9110e4dff11245f6fe6a84ce45299a8f2a0fd3bc39c278cd1a4793efbca2d3f0 samba-test-4.16.4-101.el9.s390x.rpm b6bfe8e8f604221201e7156d84ee0f5fe8195bf43772f0295c5ac234b03328bf samba-pidl-4.16.4-101.el9.noarch.rpm ce4265a141b1855237a79ba6d86e8df379190f78d7ff3073272640f269cc5889 ALSA-2022:8318 Copyright 2022 AlmaLinux OS 0 1 Moderate

libldb security, bug fix, and enhancement update

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490) Security Fix(es): * samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libldb-devel-2.5.2-1.el9.s390x.rpm 751ce6d17bbb85c3ee396d4c36ba09e83a8c2c264e3e0feab868bbae601c5969 ALSA-2022:8353 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.14). (BZ#2128249) Security Fix(es): * python: mailcap: findmatch() function does not sanitize the second argument (CVE-2015-20107) * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default python3-idle-3.9.14-1.el9.s390x.rpm 3326a93ca40d6330dac1f77eb394cc77f3f8ccd1e93d88a669c59ef4f8078a5f python3-debug-3.9.14-1.el9.s390x.rpm 9602be96a929440eeb2cc4fe5f6461779b911e4e142316bec4a45d4278b3e0f2 python3-test-3.9.14-1.el9.s390x.rpm a2251ac76a5884e4ea3e096df4ff7b2fc4ecf3b98a373e3269dc8f062f46c191 ALSA-2022:8400 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtirpc security update

The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Security Fix(es): * libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libtirpc-devel-1.3.3-0.el9.s390x.rpm 8a704d707d71135b784d3d34394bf3d74914ecb097ec49e7fbeb7631525ba93d ALSA-2022:8415 Copyright 2022 AlmaLinux OS 0 1 Low

mingw-gcc security and bug fix update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * gcc: uncontrolled recursion in libiberty/rust-demangle.c (CVE-2021-46195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default mingw64-gcc-c++-12.0.1-11.2.el9.s390x.rpm 1a31dbd10c739c628696768522758a033b90459a1715f635f40b29011180b1d3 mingw32-libgcc-12.0.1-11.2.el9.s390x.rpm 1d814822384fd3480c40870f2522d45a334560fc4c7b159cac096b21efff935d mingw32-gcc-c++-12.0.1-11.2.el9.s390x.rpm 726c0d0f3f5ec19215e388be5e5e6bb906e726fe71983bb5745be043a06885bd mingw32-gcc-12.0.1-11.2.el9.s390x.rpm 8028e63f99cef272469e64536f2144ad4eb017cdce5b97930f31774c8f4f840c mingw64-libgcc-12.0.1-11.2.el9.s390x.rpm a78139b04d1534bbb1d480a7e5313b21c5705328dc15d507337d5a5c4348344b mingw64-gcc-12.0.1-11.2.el9.s390x.rpm c9222b3d64f4bc485820d5eb0cd66dfe155b58fdde9ebbd9d48e27818eb5f38a mingw32-cpp-12.0.1-11.2.el9.s390x.rpm d1864f4d6fb4fe34c8f4f7dbb65fc7dbfae95cd0c3455751c5a345e740ac7dad mingw64-cpp-12.0.1-11.2.el9.s390x.rpm f005c57c69786375e9a124dbe6ff038e0c93574694b9315165b93c8d47dd0d38 ALSA-2022:8434 Copyright 2022 AlmaLinux OS 0 1 Moderate

dotnet7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134641) Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default dotnet-sdk-7.0-source-built-artifacts-7.0.100-0.5.rc2.el9_1.s390x.rpm 00b413df750effead8238028e61050f5fbc8034b92d4b548ca2b42887b0e511a ALSA-2022:8493 Copyright 2022 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default python3-test-3.9.14-1.el9_1.1.s390x.rpm 64dbafaf8f128eee5cb62bee05ed2bfbd662baff703ff0cc0276a90973289b82 python3-idle-3.9.14-1.el9_1.1.s390x.rpm be09101675aea97c77076380ecfaee93f8424b9d63c157ab18b9150cb024e63d python3-debug-3.9.14-1.el9_1.1.s390x.rpm d4841607a75bdb97f15ff9d9e7603aa8e1fd6896c6bdec6474fd95aa6213dbcc ALSA-2022:8643 Copyright 2022 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: Request Forgery Vulnerability (CVE-2022-45060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default varnish-devel-6.6.2-2.el9_1.1.s390x.rpm 085c10efb72c94d794df0afd2eae9375e042b6d50a154e9a1bdfee603517fb33 ALSA-2023:0077 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.113 and .NET Runtime 6.0.13. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.113). (BZ#2154459) Security Fix(es): * dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process (CVE-2023-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default dotnet-sdk-6.0-source-built-artifacts-6.0.113-1.el9_1.s390x.rpm b17f55a9a53b6e8b23e2a74ea58cab8f53307ec0061d3e6028c8f5762540a45d ALSA-2023:0194 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS database. This update allows more control over database use using two new properties - fips.nssdb.path and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-line arguments to the Java virtual machine (RHBZ#2147476) * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [almalinux-9] (BZ#2153097) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default java-17-openjdk-jmods-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm 3049bea39371d987af0402df32b051b6373dc5f273b28effe5957fd6f50a43cd java-17-openjdk-src-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm 4a82b3e5228294b096b42b96e6cd3c7cc852827f646caaf01af25ee2841f9e28 java-17-openjdk-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm 69a3f9e5644b3eb063977baaf69470861f7e4d5902ffe3b43aa59e22f02fc715 java-17-openjdk-static-libs-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm 6a2b3ef250ef7e45f2f7ce41e46c294872d512875d7c0488adcb4022f3f9745c java-17-openjdk-devel-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm 862c093520d2a016bb57ecd6cabc497c9baede943a826494dcbf7dc9d89e8441 java-17-openjdk-headless-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm c2aebe314f5b12794e37fdb38765e941e67301db1ab4fb44c68c24cbc3dba79b java-17-openjdk-demo-slowdebug-17.0.6.0.10-3.el9_1.s390x.rpm f31f0274c262323a757a4923d453d9cb961ea01babad920a25eda79eaa4cd5e6 ALSA-2023:0202 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [almalinux-9] (BZ#2157798) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default java-11-openjdk-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm 187c0d95137e5e34cfaeb4e94c12b1f39c3cdb277ba9de0767d534e31924163c java-11-openjdk-static-libs-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm 1ec558e98e3b1a610941f1b96a2ef2309b230cc727bb399589fff4f3e973b7b1 java-11-openjdk-demo-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm 21a24ff6f9b7dc0cae58495d8afacb93d35c76b055422e72b0a1136b69d7bc00 java-11-openjdk-src-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm 8558e4ccaf415962aeabed30593addc76efcaf3ee6699dbb4140fb85427fbf33 java-11-openjdk-jmods-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm bdcdc4cf2f81765f4dabcd385a222be4d2f8c1cd0eda9cef8c75721c7f7d30d6 java-11-openjdk-headless-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm e8353c04693859780d9cf79848c264b8eabc79d77a2e68d0064231d65e6ad5fb java-11-openjdk-devel-slowdebug-11.0.18.0.10-2.el9_1.s390x.rpm f5489f2a0989829217297c407627324a94b963e4b01d25975dc7180b295ef416 ALSA-2023:0302 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058) * libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519) * libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953) * libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520) * libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libtiff-tools-4.4.0-5.el9_1.s390x.rpm d3026e526a0afcf1c5291c20a4de6b1b176913b8a7cccfa0a205a1c9a3ad02d9 ALSA-2023:0334 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964) * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139) * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945) * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077) * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel 9.2: Important iavf bug fixes (BZ#2127884) * vfio zero page mappings fail after 2M instances (BZ#2128514) * nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359) * ice: Driver Update to 5.19 (BZ#2132070) * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588) * drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619) * updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914) * DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213) * No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153) * Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168) * ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976) * fatal error: error in backend: Branch target out of insn range (BZ#2144902) * AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217) * Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910) * Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605) * DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.12.1.el9_1.s390x.rpm e80267adf52714b64a398ff3c3aed44fd33662b8347f78286f42149657ea141f ALSA-2023:0340 Copyright 2023 AlmaLinux OS 0 1 Moderate

bash security update

The bash packages provide Bash (Bourne-again shell), which is the default shell for AlmaLinux. Security Fix(es): * bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default bash-devel-5.1.8-6.el9_1.s390x.rpm 926dc567387ac21ac99bf47976c9194fa8f90e467b47a4f1a99b16fae892ecaa ALSA-2023:0626 Copyright 2023 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow to code executiona (CVE-2022-47629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default libksba-devel-1.5.1-6.el9_1.s390x.rpm 6b8e06cc23075389b1f63c52251a9b275138d7a3c6f4cf550c2f50af0c8c1050 ALSA-2023:0951 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564) * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379) * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179) * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux 9.0: LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133083) * AlmaLinux 9.1 Extending NMI watchdog's timer during LPM (BZ#2140085) * AMDSERVER 9.1: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151274) * qla2xxx NVMe-FC: WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70 qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2152178) * Regression: Kernel panic on Lenovo T480 with AH40 USB-C docking station (BZ#2153277) * Scheduler Update (almalinux9.2) (BZ#2153792) * AlmaLinux9.1, Nx_Gzip: nr_total_credits is not decremented when processing units are reduced by dlpar in shared mode. (FW1030 / DLPAR) (BZ#2154305) * MSFT, MANA, NET Patch AlmaLinux-9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155145) * Azure vPCI AlmaLinux-9 add the support of multi-MSI (BZ#2155459) * Azure AlmaLinux-9: VM Deployment Failures Patch Request (BZ#2155930) * The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158815) * AlmaLinux-9.2: Update NVMe driver to sync with upstream v6.0 (BZ#2161344) * CEE cephfs: AlmaLinux9 cephfs client crashing with RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] (BZ#2161418) * block layer: update with upstream v6.0 (BZ#2162535) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.18.1.el9_1.s390x.rpm d9f6532c4ca7b586720947763789cf17f6de2731524ea6b6d7d93f4f163e00bf ALSA-2023:0953 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default python3-idle-3.9.14-1.el9_1.2.s390x.rpm 3626f537bea5f08a04ea7453d82d2433f8c75f9a25fe95234fee5d5fc7b9330f python3-debug-3.9.14-1.el9_1.2.s390x.rpm 98af390e5523e68f2288e8b22884c7237cd53769cf39bcf7c991aeb4fd29ad50 python3-test-3.9.14-1.el9_1.2.s390x.rpm c81c96acd37fa86d66468ddd20703bc2624bd9f36b8eab83aa4acee2825a27e2 ALSA-2023:0957 Copyright 2023 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: use after free allows Sandbox Escape (CVE-2021-44964) * lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default lua-devel-5.4.4-2.el9_1.s390x.rpm c6aac2924d189ae1683780d573383cb1c82d81569194447c7959f861693b60e0 ALSA-2023:1068 Copyright 2023 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap buffer overflow in get_word_rgb_row() in rdppm.c (CVE-2021-46822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default turbojpeg-devel-2.0.90-6.el9_1.s390x.rpm 21c9c3f85b81aac2c211f45cd9ca2817778e686b5338e470a5a5c6eb559c3619 turbojpeg-2.0.90-6.el9_1.s390x.rpm a86ac5f48d3db0b8b6b0dc16b75535577c44dcda706e515d720df6eb13dc2ed3 ALSA-2023:1470 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux9.0 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127880) * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on the system. (BZ#2143766) * AlmaLinux9.0 - boot: Add secure boot trailer (BZ#2151528) * kernel-rt-debug: WARNING: possible circular locking dependency detected (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160614) * Support cpuset.sched_load_balance by changing default CPUset directory structure (BZ#2161105) * AlmaLinux9.0 - s390/kexec: fix ipl report address for kdump (BZ#2166903) * libgpiod doesn't seem to work with Interphase gpiochip (BZ#2166956) * Azure AlmaLinux9 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170227) Enhancement(s): * IBM 9.2 FEAT: Upgrade the QETH driver to latest from upstream, e.g. kernel 6.0 (BZ#2166304) * Intel 9.2 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168382) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.22.2.el9_1.s390x.rpm f3f472cfb0b5e0c66bfa9d12175d2a34bd96f11e31271e5cea2434f4a5cb4142 ALSA-2023:1693 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625) * postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default postgresql-static-13.10-1.el9_1.s390x.rpm 01f95e19afb84dd24d624539a141bd8b174c924d072fa0486ab76df015a2c6d9 postgresql-private-devel-13.10-1.el9_1.s390x.rpm 3c6b45567533191e5d7220e15496c9514324116e159208feb5213cd441ed2a1f postgresql-server-devel-13.10-1.el9_1.s390x.rpm 8b217114dc0e8d9891d5bdf65a1daf5dd164eb5fb2251b2b6d74cb7dcc97eea1 postgresql-docs-13.10-1.el9_1.s390x.rpm beed4c299246c4406e36056e97ca5a09ca69193e7cfb068bf2927d78861f233b postgresql-test-13.10-1.el9_1.s390x.rpm caddd278e87f45c5e728dd788a0349b2a44cc6c5c8d128ff02344ce54e90f75f postgresql-upgrade-devel-13.10-1.el9_1.s390x.rpm dc9f99b0b667f582108807ce6b46294160101cea34a079c13f6e0b12aa9917b1 ALSA-2023:1703 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Update intel_idle for Eaglestream/Sapphire Rapids support (BZ#2168361) * AlmaLinux9: An application stopped on robust futex used via pthread_mutex_lock() (BZ#2168836) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.23.1.el9_1.s390x.rpm cd1f0abbb411ca881051b8dba9035ba81ac892c9d9623af9a45caf97b73d8fe6 ALSA-2023:1879 Copyright 2023 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the list of cryptographic services and algorithms available is limited to those that are FIPS compliant. It was found that this filtering was too strict and was also excluding service attributes. These attributes are now made available in FIPS mode, as they are in non-FIPS mode. (RHBZ#2186804) * Previously, the XML signature provider was unable to operate in FIPS mode. Following recent enhancements to FIPS mode support, the XML signature provider can now be supported. It is now enabled in FIPS mode. (RHBZ#2186811) * The PKCS#11 provider used by FIPS mode can be supported by different PKCS#11 tokens. It was found that some PKCS#11 tokens may not be initialised fully before use, leading to an exception being thrown by the provider. With this release, this exception is now expected and handled by the FIPS support code. (RHBZ#2186807) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default java-17-openjdk-jmods-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm 056c6651f9ce8fc6160af6d250d3c0102ba8aeb9cf3be3b0fc03f0ddc2c6ce30 java-17-openjdk-devel-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm 265cf3110a37ed644630313a7017d380d8ddd327e50e9960dfb8d4eb7c370cf6 java-17-openjdk-demo-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm 7e2bc4177bc224dc865af4ec21c42b1becf037fde1070d8311ccbe2ac506e602 java-17-openjdk-headless-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm a19440969a5733ec79bfcd88c7c1079858e177a65b48d8ddf40c3bbb01f8d03c java-17-openjdk-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm b43a5b6950c8287103a6e26e17e587361db218493f7209de648d9534932ff276 java-17-openjdk-static-libs-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm ec6c257ca078c0128332b7502b2fa958569b25098d058411e111caeeb9ffca3a java-17-openjdk-src-slowdebug-17.0.7.0.7-1.el9_1.s390x.rpm f54b573bec4330bfad8ce1a7cd13630fa35790c9c737e84c528b8ebe2496643d ALSA-2023:1880 Copyright 2023 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default java-11-openjdk-demo-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm 7385ee7eb281d1c4c9999b8e2ef6a20aead1f59ea03b61dca2dd7d4ad1e65da9 java-11-openjdk-devel-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm c81d1599352af504010a1aa7156a2185a050b26121e5615b0da93bca48ac876a java-11-openjdk-static-libs-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm d4dd43c5c21edb5d44413174ef8fa25fa4088cd20c2639bc44b2272fc3857b6c java-11-openjdk-jmods-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm d76976631f04ef6d486789fed75b675e3510f5dc4ddecadf09f0518636ec63aa java-11-openjdk-src-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm dafd6550eebcebbac067b41dda69a1bedfa936ba570cc79b40562a3c7239bcae java-11-openjdk-headless-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm df49ebe9170b5178cd05a7cd99d96bf01feb1714b7d3abae67fb05341a411547 java-11-openjdk-slowdebug-11.0.19.0.7-1.el9_1.s390x.rpm f2832db5af04f8eee5275928f1cff2d4dffc13a8547ee26bc22a39acbf79a48d ALSA-2023:2127 Copyright 2023 AlmaLinux OS 0 1 Important

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_1_default samba-devel-4.16.4-103.el9_1.s390x.rpm 038ab219d271e2880107106ad113ef861585129e4adca7932d86c7e02d7d0af3 samba-test-4.16.4-103.el9_1.s390x.rpm 3c2e1e50c9719607405875ceaa0cd543640c2d7b9b656709de9905eced0414f6 libwbclient-devel-4.16.4-103.el9_1.s390x.rpm 5147a1decb69ecf839db9848d5f0c23f48d6e0e916d42416ed5569295124309c samba-test-libs-4.16.4-103.el9_1.s390x.rpm 643e75954935d471bae50f15774843c772c36c102e6272bb9b06cd1b08fdb8b2 libsmbclient-devel-4.16.4-103.el9_1.s390x.rpm aed31e38ebc97d8cf7fd361dc3d06a6e37069047b2eabea4ec57b9846e244f81 samba-pidl-4.16.4-103.el9_1.noarch.rpm c48c0aef3685e93ad6b4c179b446ee741ca10c2e8490e8c61364eac2f8b8440b ALSA-2023:2166 Copyright 2023 AlmaLinux OS 0 1 Moderate

freeradius security and bug fix update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: Information leakage in EAP-PWD (CVE-2022-41859) * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860) * freeradius: Crash on invalid abinary data (CVE-2022-41861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default freeradius-unixODBC-3.0.21-37.el9.s390x.rpm 1f1d2062c536d82b348677b7b5ac82bdafa957a01b8a7c7b1182aba3bfe46e41 freeradius-mysql-3.0.21-37.el9.s390x.rpm 5cdbc8c289e0bd2c6066e17de36a454e81faedf73bf3ac425760e651cb3a547e freeradius-sqlite-3.0.21-37.el9.s390x.rpm 64aa856c521b0826a1bf73ce959fcfac829112d0ba24fcd280206cdbb549507f freeradius-rest-3.0.21-37.el9.s390x.rpm 65e6cd3091d103cebff1760db370f80528273dd5fb153f0839dadf158a578b1f freeradius-postgresql-3.0.21-37.el9.s390x.rpm 94675998ef0bc86d7d822a930f81d30eff30eb86873db7eff8f8feff3fe3d7a1 freeradius-perl-3.0.21-37.el9.s390x.rpm c4ff652119d13a67202366724e957762450ef2cd27ab57af72cdd649556701ce ALSA-2023:2248 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550) * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283) * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340) * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341) * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342) * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343) * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344) * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494) * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default xorg-x11-server-devel-1.20.11-17.el9.s390x.rpm 26e0275b06a236967edde0adbdfe9e025f38ee0d007217964d4a58dec2aa50a9 xorg-x11-server-source-1.20.11-17.el9.noarch.rpm 3b231953962ef28c2c50afd8c6fc428361b8e1316ccbe683f1cfb5c063cd4d87 ALSA-2023:2259 Copyright 2023 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: integer overflow in JBIG2 decoder using malformed files (CVE-2022-38784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default poppler-qt5-devel-21.01.0-14.el9.s390x.rpm 06684dae2b6c5b8eecbdca9106216eebe2bc88d9b42f045892ab9d9862862b34 poppler-glib-devel-21.01.0-14.el9.s390x.rpm 5ca9f3faacd85e8f7dc179836269e1d319ce413f1ab964bf85b1a80ef892ae47 poppler-devel-21.01.0-14.el9.s390x.rpm 8d7310a4ee7d923f653274bdf08a21f08dca7e7688203fd013a6d8575a382bf7 poppler-cpp-devel-21.01.0-14.el9.s390x.rpm b96fd7fa83ef584859396b3a2fe51dbf0e1cb2154ceda91096c4013cd36bf0ed ALSA-2023:2261 Copyright 2023 AlmaLinux OS 0 1 Moderate

bind security and bug fix update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795) * bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default bind-doc-9.16.23-11.el9.noarch.rpm 89aa2e6a4d42f3636b882c4f0a7b97379335821cf7298757b760024b54a49ca6 bind-devel-9.16.23-11.el9.s390x.rpm 9b58a974be4b60e80e131f1ff97f157296b70fb1db1ff47f7b49d01620d457ae ALSA-2023:2326 Copyright 2023 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282) * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283) * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316) * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317) * freerdp: division by zero in urbdrc channel (CVE-2022-39318) * freerdp: missing length validation in urbdrc channel (CVE-2022-39319) * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320) * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347) * freerdp: missing input length validation in `drive` channel (CVE-2022-41877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libwinpr-devel-2.4.1-5.el9.s390x.rpm a578ca2010f17d7d9bb89ff4560135ce72d6abe41bd34a4fb9c4a2ce19e01eff freerdp-devel-2.4.1-5.el9.s390x.rpm b66b31233d8907e370a4c52f15d48eb8f9afff2b7ad1e47cba5a05b45d67a8bd ALSA-2023:2340 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE-2022-3597) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c (CVE-2022-3598) * libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c (CVE-2022-3599) * libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c (CVE-2022-3626) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627) * libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970) * libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c (CVE-2022-4645) * libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value (CVE-2023-30774) * libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (CVE-2023-30775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libtiff-tools-4.4.0-7.el9.s390x.rpm fac38976e09b7e688131f7c718c2caf7437b33d044f0d60cc601f36ff88f0660 ALSA-2023:2370 Copyright 2023 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default unbound-devel-1.16.2-3.el9.s390x.rpm 7a7abb4d9452569d7e9ef4f7c2240f0f321faa6d69902a06cc4f9cc120ecb4e2 ALSA-2023:2373 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security and bug fix update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: f5ethtrailer Infinite loop in legacy style dissector (CVE-2022-3190) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default wireshark-devel-3.4.10-4.el9.s390x.rpm 34f1fd77915ca733a8124c6993b8f0e541e5ab29720bb7bcb9ce09ae32cc4877 ALSA-2023:2458 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896) * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461) * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341) * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655) * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462) * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789) * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882) * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196) * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663) * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028) * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435) * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522) * memory leak in ipv6_renew_options() (CVE-2022-3524) * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566) * data races around sk->sk_prot (CVE-2022-3567) * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619) * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623) * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625) * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628) * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640) * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707) * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128) * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129) * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141) * lockdown bypass using IMA (CVE-2022-21505) * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388) * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743) * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188) * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189) * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674) * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703) * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720) * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721) * Denial of service in beacon protection for P2P-device (CVE-2022-42722) * memory corruption in usbmon driver (CVE-2022-43750) * NULL pointer dereference in traffic control subsystem (CVE-2022-47929) * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394) * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590) * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195) * denial of service in tipc_conn_close (CVE-2023-1382) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default kernel-cross-headers-5.14.0-284.11.1.el9_2.s390x.rpm d0e39c9d1da970a5e59819202390f5f21664c2a90e6ffd95b7972923b02a496f ALSA-2023:2459 Copyright 2023 AlmaLinux OS 0 1 Moderate

device-mapper-multipath security and bug fix update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default device-mapper-multipath-devel-0.8.7-20.el9.s390x.rpm 540c9f790a4f798fbe4bc5ab181bd865dc6b640eda1e15198070650082adf0b5 ALSA-2023:2487 Copyright 2023 AlmaLinux OS 0 1 Moderate

fwupd security and bug fix update

The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34301) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34302) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default fwupd-devel-1.8.10-2.el9.alma.s390x.rpm b0c4ccd3e245fd0347c471e5985f0dfef8dac01d96eb2dc7525d8c13973a6353 ALSA-2023:2519 Copyright 2023 AlmaLinux OS 0 1 Low

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2131993) Security Fix(es): * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default samba-pidl-4.17.5-102.el9.noarch.rpm 39aaadaf78a1fa8a0747154fca75e17ac1ed358cd6d47644f2ec50e7303a1e81 samba-test-libs-4.17.5-102.el9.s390x.rpm 51823c7507e80d627fcb69922500bc0429fa4d7d37081a9a3c4a4c52d96dfc75 libwbclient-devel-4.17.5-102.el9.s390x.rpm 789718445b69c5210cc7b0cea99a94b7224eb3b7ca4c8a554cd2c57d62a04b05 libsmbclient-devel-4.17.5-102.el9.s390x.rpm 871c51a58d9a3e0f6d74659947824614a4ccb50434feda3a910db1b5f07f4865 samba-test-4.17.5-102.el9.s390x.rpm ce53f74ad5e506c9614166429010899071c4ba60f03dac0dec63d2a6f9065f80 samba-devel-4.17.5-102.el9.s390x.rpm fdefdf3f891c5fd3c26ab4940625e8d9e21e61821defac9dea7744176501ee30 ALSA-2023:2532 Copyright 2023 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libarchive-devel-3.5.3-4.el9.s390x.rpm 8ed49b31b4112e8c44f34864475692c034cf2b0700bd8ceb28ed3d4cff86dc9b ALSA-2023:2582 Copyright 2023 AlmaLinux OS 0 1 Low

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overread (CVE-2022-28805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default lua-devel-5.4.4-3.el9.s390x.rpm b13f7a016cd877354520ff10fab7be44c8d29788c922e0681f7a71528d0f3f60 ALSA-2023:2589 Copyright 2023 AlmaLinux OS 0 1 Moderate

autotrace security update

AutoTrace is a program for converting bitmaps to vector graphics. Security Fix(es): * autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default autotrace-0.31.1-65.el9.s390x.rpm 83e9c7fb1b8d97d7e9b544f1f575dbeda53e87aa97358a3b9e5d690ab4b3f218 ALSA-2023:2592 Copyright 2023 AlmaLinux OS 0 1 Moderate

golang-github-cpuguy83-md2man security, bug fix, and enhancement update

go-md2man converts markdown into roff (man pages). Security Fix(es): * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default golang-github-cpuguy83-md2man-2.0.2-4.el9.s390x.rpm e3f8dd33b933a9c8c0d459cdeac265ddb0ccf275e95cf32feb64596d27b171af ALSA-2023:2621 Copyright 2023 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177731, BZ#2177732) Security Fix(es): * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611) * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632) * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410) * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883) * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917) * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default mysql-devel-8.0.32-1.el9_2.s390x.rpm d38bc4c5311567218e3d39d900ce59a2c534884b4c92ec2309af4702336ad4d9 mysql-libs-8.0.32-1.el9_2.s390x.rpm f3904adf6d2f7933f1acd2b2a585088ecef7872d57af8b45279c9232f188b539 mysql-test-8.0.32-1.el9_2.s390x.rpm f5fdf2255c33263e4972957b0a036ec232c9a418cc28be5373781b5dd89cab4d ALSA-2023:3423 Copyright 2023 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-filters: remote code execution in cups-filters, beh CUPS backend (CVE-2023-24805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default cups-filters-devel-1.28.7-11.el9_2.1.s390x.rpm 727071afd6de0baa35af3faf351e2cf20ae64d690dc6ee9abf9e83afbd6b1e94 ALSA-2023:3581 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.118 and .NET Runtime 6.0.18. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.118). (BZ#2212379) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.118-1.el9_2.s390x.rpm 7fb912449996b3baef8166f99bd3e8f472320113836137ecc51ec3172b3ec1f6 ALSA-2023:3585 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3.11-test-3.11.2-2.el9_2.1.s390x.rpm 825d35978d31dc1014a2fcc73cc65c1945b09e65ae72a197ad6a6ef1e4dfce3a python3.11-idle-3.11.2-2.el9_2.1.s390x.rpm a5fae12ae11258b324497dbc3ac6a8dd982db45696818e23f47d03548a58510c python3.11-debug-3.11.2-2.el9_2.1.s390x.rpm e42491accb8a15691976e29c4006c98985e294d98273bfb75394f380d2d0b6ed ALSA-2023:3592 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211877) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.107-1.el9_2.s390x.rpm df384ffd38e8cb99e868150c9b00da53283ee79da14b4ec1adc53f3113f9c51c ALSA-2023:3595 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3-test-3.9.16-1.el9_2.1.s390x.rpm 1692e66956dc12dad8f4e89bfffd5700baf91c54042d03bfa7528395dae96289 python3-idle-3.9.16-1.el9_2.1.s390x.rpm 76c27375a06ef1b0081f5f5e005f24548ca1bb770282df66a3f32e3743d239e9 python3-debug-3.9.16-1.el9_2.1.s390x.rpm e759549aaa354be0a6530ec78e0db985703ec46570959dbcdc3db65027c3c799 ALSA-2023:3661 Copyright 2023 AlmaLinux OS 0 1 Important

texlive security update

The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems. Security Fix(es): * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default texlive-gnu-freefont-20200406-26.el9_2.noarch.rpm 16c75f425a783945efc0d78b91bf1ea50b85ae1c0a2699dfa7710075d8c68c96 texlive-lib-devel-20200406-26.el9_2.s390x.rpm ac3a586070671e6fdf3676a37becd0cd5e99391abfb6a29f0882ec29a43c1972 ALSA-2023:3711 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) * libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795) * libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796) * libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0797) * libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798) * libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libtiff-tools-4.4.0-8.el9_2.s390x.rpm 3e67fa4aac3d27cd0a0081f6e4238da26ea15a5b2e055bef8e23cf0951b4ac43 ALSA-2023:3714 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454) * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default postgresql-static-13.11-1.el9_2.s390x.rpm 1799dbb8defadccecbb064124b5017c2d902267782302ac11b2513e930fbb41f postgresql-server-devel-13.11-1.el9_2.s390x.rpm 213a24ea15d3b9c3015325ff991110e1b0f45fc3566f6ce2a59eb197827827f9 postgresql-private-devel-13.11-1.el9_2.s390x.rpm 9b033d60713607e8b3c81d0060283cb8921c2a6dbf3dafb63606aac3b6fb3673 postgresql-docs-13.11-1.el9_2.s390x.rpm c43e96cdad177c0a6495b64b465b24ee823660e83430e401cdc952c95b14bcb4 postgresql-test-13.11-1.el9_2.s390x.rpm cceebd4b0ece68afb1248a1f00c8a3e0cdbbeb18e0e26ff92bd64a1a6c3b8cf0 postgresql-upgrade-devel-13.11-1.el9_2.s390x.rpm e028dfe2480679877b89b30c522b14079a028ee47a60954bb9006c5f76b139e2 ALSA-2023:3715 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libvirt-docs-9.0.0-10.2.el9_2.s390x.rpm 1824cb0ddd8ea978275d0959246c9d05a9ee9f680d80eb5a7a54ae8a2e636fd7 libvirt-client-qemu-9.0.0-10.2.el9_2.s390x.rpm 6739b4705113934dded99177eb28a04b2032b814169e31bdcbbbd588b83f7957 libvirt-devel-9.0.0-10.2.el9_2.s390x.rpm 7b689a9e6dbbaea10dea9a5a8ae55bb8f95d0e0247519ffd5c6bc1bd51d47a0e libvirt-lock-sanlock-9.0.0-10.2.el9_2.s390x.rpm d524aed87acb72a81fbb487949c567eef81ddd4f9c25102846d4de5562212c4a ALSA-2023:4057 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet7.0 (SDK 7.0.109, Runtime 7.0.9). (BZ#2219634) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el9_2.s390x.rpm 4d5cbaed505bad402b1c78c114c2e0b1e47509218ec9a84a74ab8be6b69aa333 ALSA-2023:4060 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet6.0 (SDK 6.0.120, Runtime 6.0.20). (BZ#2219640) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.120-1.el9_2.s390x.rpm ef5db91b5a03b6637a411fd165f6a718cd7ac361ca1d8e9d4de9c7923204369c ALSA-2023:4099 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default bind-doc-9.16.23-11.el9_2.1.noarch.rpm 3626cfa861e4506dc542b852affac40020461c645de4b287336e8be7112c589f bind-devel-9.16.23-11.el9_2.1.s390x.rpm f94ae2459018cde3be577bc23293a940c802c782a159b26bef1e404e27870a4d ALSA-2023:4158 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [almalinux-9] (BZ#2223100) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default java-11-openjdk-jmods-slowdebug-11.0.20.0.8-2.el9.s390x.rpm 086ce2c65853f8992175fa557147c33e6837e12a1a966b2bd6330895845863e9 java-11-openjdk-static-libs-slowdebug-11.0.20.0.8-2.el9.s390x.rpm 3f4da64d37062c5047d430210fc27ce8e285c6b1822211ddf98221709bce9606 java-11-openjdk-src-slowdebug-11.0.20.0.8-2.el9.s390x.rpm 737de8ddfc0ff38dd5c6a80a18fae37dd8f8b9e4f3119572667c65f5c206fafe java-11-openjdk-headless-slowdebug-11.0.20.0.8-2.el9.s390x.rpm 79f54e20ed5bdaff84997812af258c6174b2e7c60fec5af6bbb76753b27fef07 java-11-openjdk-slowdebug-11.0.20.0.8-2.el9.s390x.rpm 7baec4c8d07cc7a517e24d989c4904549240bbf85c5d2854adc2a6a570c926ce java-11-openjdk-demo-slowdebug-11.0.20.0.8-2.el9.s390x.rpm d9904df7006d315bd4d73318da9dc0d8ec95a2de8648a88b08b9bb8d77705a9f java-11-openjdk-devel-slowdebug-11.0.20.0.8-2.el9.s390x.rpm dd0bf251c6e39ca70cf62fb0b86c0bf67963e98ff20d0d7c7e883f4b63c926c2 ALSA-2023:4177 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653) * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-9] (BZ#2222852) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default java-17-openjdk-slowdebug-17.0.8.0.7-2.el9.s390x.rpm 438d6786dbb40f45049c109d562d8ef5cdc90dca4de18897d89737b577c16f41 java-17-openjdk-jmods-slowdebug-17.0.8.0.7-2.el9.s390x.rpm 66534cd9741a2b251d79b98a8e961627fc7898d1607d3a243572a587d890686c java-17-openjdk-src-slowdebug-17.0.8.0.7-2.el9.s390x.rpm 876cd161ac73a15789e40b66bc146b4067355bd18f3218a0aa35be4abb6f8093 java-17-openjdk-demo-slowdebug-17.0.8.0.7-2.el9.s390x.rpm 9a8e152bcd0493ee8a2aa3d22e663c16862686268ef9166d66525cd4ed20c5aa java-17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.el9.s390x.rpm a6dd314dc46459854310b1c0724aa6fcdff1a462484fa19002ceaf3e8e9c191e java-17-openjdk-devel-slowdebug-17.0.8.0.7-2.el9.s390x.rpm a8443e467143dd7a86e36d49dae41ffb6e996d119461841717201287be26f6e6 java-17-openjdk-headless-slowdebug-17.0.8.0.7-2.el9.s390x.rpm de9f936071f39ea7862299f9def890584b5ce46a45a8098709bb744c0cfa0381 ALSA-2023:4325 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security and bug fix update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: SMB2 packet signing is not enforced when "server signing = required" is set (CVE-2023-3347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The trust relationship between this workstation and the primary domain failed (BZ#2223600) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libsmbclient-devel-4.17.5-103.el9_2.alma.s390x.rpm 0b6f5b722015b202a055ad8e45fc34def6391cf5ea11800c6f3e02c7422aaed8 python3-samba-test-4.17.5-103.el9_2.alma.s390x.rpm 0d22a1048752358f7245302e17d41912b55d4539dfd048904f4839cd4cf5aa64 python3-samba-devel-4.17.5-103.el9_2.alma.s390x.rpm 15194bc200f5122ceaa849725bc6779071845f0336f8fd6fc661b9495415514b samba-devel-4.17.5-103.el9_2.alma.s390x.rpm 46022ce801915b381b9311aa1f32b7e800e4337d621f79e338a114bcb8fa6907 libnetapi-devel-4.17.5-103.el9_2.alma.s390x.rpm 5776c2ffd32ede969d07d5dc06ed7a34524ed5d633836448985d0817e58d1306 samba-test-4.17.5-103.el9_2.alma.s390x.rpm 73c671b70584b8e9079dcf7c1227b3aa580d5c42a292bc14bea6c89d972c8548 libwbclient-devel-4.17.5-103.el9_2.alma.s390x.rpm 7e5a4eb95f00b66f3fef138df8cb12d508ade18cf47d04af186b7541d61adc45 samba-pidl-4.17.5-103.el9_2.alma.noarch.rpm a5359420cdecee730be12c0b6671254d313b1999e65343f668df6c6fbf625afc samba-test-libs-4.17.5-103.el9_2.alma.s390x.rpm f691104bcbd7af39c3f2ac03e7d4eda523bb9300b250e3f5836a865c00eca545 ALSA-2023:4377 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090) * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788) * kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869) * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458) * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default kernel-cross-headers-5.14.0-284.25.1.el9_2.s390x.rpm 4756c57c1d0e6daaeecda63fce172bc3f875a72917ad27f0f4b79c7a2b9280d6 ALSA-2023:4642 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.110 and .NET Runtime 7.0.10. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.110-1.el9_2.s390x.rpm 2b6dc57610a2b2369da8905be49ba4efa42b3e354e0bc56d1b1163c01de937e2 ALSA-2023:4644 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.121 and .NET Runtime 6.0.21. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.121-1.el9_2.s390x.rpm 874a87a04ec3c3cb84d64295e2fa48b80008f0b10bc188a058269ec9178b4b1e ALSA-2023:5048 Copyright 2023 AlmaLinux OS 0 1 Important

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default flac-1.3.3-10.el9_2.1.s390x.rpm 77b7b7fc4ec7f32a551eaa76354794069c4556a50e9484c25f305f2866cbae68 flac-devel-1.3.3-10.el9_2.1.s390x.rpm c52d8e39a1347474098d8d80a557046fa78a8840fbd63585db6010c289c5780b ALSA-2023:5143 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.122 and .NET Runtime 6.0.22. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.122-1.el9_2.s390x.rpm 93e6cddb67ea6b11077afb69bf927852f311f984579298bfbce3a5003ff708aa ALSA-2023:5146 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.111 and .NET Runtime 7.0.11. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.111-1.el9_2.s390x.rpm 51254adeaf1629198d14570c5ddeeb248a7d2758b3f4a61e613f1834d1f10844 ALSA-2023:5214 Copyright 2023 AlmaLinux OS 0 1 Important

libwebp security update

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libwebp-tools-1.2.0-7.el9_2.s390x.rpm f25921176c5b4e071c0e1b4d2c0454ffa99df4735834fed41af3cca993496f76 ALSA-2023:5453 Copyright 2023 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911) * glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) * glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806) * glibc: potential use-after-free in gaih_inet() (CVE-2023-4813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default glibc-static-2.34-60.el9_2.7.s390x.rpm 0785324c3e944f0a3975ad90e85d10d7c5be20bf21e03e5d2e0714426212315b glibc-benchtests-2.34-60.el9_2.7.s390x.rpm 13515916d89c5f840f09a4a9652b02ad074a966a9c7b6b7409dc0a5bf750c6ec nss_hesiod-2.34-60.el9_2.7.s390x.rpm 3ec2fc6061bb0ca2f7c2e6df8bdd244acc08686039c78f4003a3bddc5b9708e2 glibc-nss-devel-2.34-60.el9_2.7.s390x.rpm e156ca106fddb147dc15435b684a89b3161800b08e16e86e536f182063cbe465 nss_db-2.34-60.el9_2.7.s390x.rpm fd14a2946c8db088e9c10f0ecb874e4a4889a9a08355aadd9d27c65187b04165 ALSA-2023:5456 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3.11-idle-3.11.2-2.el9_2.2.s390x.rpm 4c295cffcb7e5aa9707067a58a491caa100c27d0013a637516dd87445be4a12b python3.11-debug-3.11.2-2.el9_2.2.s390x.rpm 9f5beec108447c7e4ac0b6bc98f68e85c4fbf2140d6a99bc159379c82f323622 python3.11-test-3.11.2-2.el9_2.2.s390x.rpm a655b6fcdac7c3bb9f38be3d6e18a13af447255b08f6d16fda5defd3eb1cd82c ALSA-2023:5459 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices (CVE-2023-36664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libgs-devel-9.54.0-10.el9_2.s390x.rpm ab153ca99b56b26207f18ed30c542cf849ca1af9a0e531fa88f5faa24b504628 ALSA-2023:5462 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3-test-3.9.16-1.el9_2.2.s390x.rpm 45df3cc7460c315693faf6318c6ae6033344c6e7c61ec6df575d65d936f20c39 python3-debug-3.9.16-1.el9_2.2.s390x.rpm bc8282e25360b642458df1fe1c7243e40d7a9448bcf07194abfc36b55aa2dd5a python3-idle-3.9.16-1.el9_2.2.s390x.rpm c3d35687cd8b00e0592a71f38d5920b1736a9cf818363e21ea124057bb73cdc3 ALSA-2023:5539 Copyright 2023 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libvpx-devel-1.9.0-7.el9_2.alma.1.s390x.rpm 6e7ecf0eb9613ff4b282387ae15b790e678976cd4784a2187ec3e377acffbeb2 ALSA-2023:5684 Copyright 2023 AlmaLinux OS 0 1 Important

galera and mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22). Security Fix(es): * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157) * mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081) * mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082) * mariadb: segmentation fault via the component sub_select (CVE-2022-32084) * mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089) * mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091) * mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791) * mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default mariadb-embedded-devel-10.5.22-1.el9_2.alma.1.s390x.rpm b2e6e1a8b74543a6b9b8178b9d2005cd78b8e9da34666e0a031cec9e576d2e2b mariadb-test-10.5.22-1.el9_2.alma.1.s390x.rpm bde3f5efc7249d935ae9f09f2252cb29395ce49f3ff209d5fe9852dd80b78b68 mariadb-devel-10.5.22-1.el9_2.alma.1.s390x.rpm f08967359780af85c3b4b3c975d6fd22dcb811593466ee84424d343cd11de038 ALSA-2023:5689 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default bind-doc-9.16.23-11.el9_2.2.noarch.rpm 66efa77c46000b37186909a04710d2643178d4f0246f35f8d0a8c8eddd9829b0 bind-devel-9.16.23-11.el9_2.2.s390x.rpm cba32d5f0d4abbd9d6d6a36ef2d2c071f61ed159e0126563b87e24aa08a9f424 ALSA-2023:5708 Copyright 2023 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.123 and Runtime 6.0.23. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.123-1.el9_2.s390x.rpm 168a14bb2143ee7ebe94f255ee3da5f78f50ca692a65cc3b8a59c49d3c3fa51f ALSA-2023:5711 Copyright 2023 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.s390x.rpm 7981ddf9f3d033e613f40bace2138c75fca81596dc565f3be57953a9219cf298 ALSA-2023:5744 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 11.0.20 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 11.0.20.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237175) * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 11.0.20 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 11.0.20.1, increases it to 16 MB. * The serviceability agent would print an exception when encountering null addresses while producing thread dumps. These null values are now handled appropriately. (JDK-8243210) * The /usr/bin/jfr alternative is now owned by the java-11-openjdk package (AlmaLinux-13532) * The jcmd tool is now provided by the java-11-openjdk-headless package, rather than java-11-openjdk-devel, to make it more accessible (AlmaLinux-13536) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default java-11-openjdk-jmods-slowdebug-11.0.21.0.9-2.el9.s390x.rpm 136223fd8426301dde974af156e43faf972877efe529cd127c686cbb333beab0 java-11-openjdk-slowdebug-11.0.21.0.9-2.el9.s390x.rpm 57284ea61c6b08c7ac96f30b157d0cd2648553341cf77e2fd3b0d332910121b6 java-11-openjdk-headless-slowdebug-11.0.21.0.9-2.el9.s390x.rpm 829f1bf641bed9342782994be4d2ce72f13d6db091450d0749aefda982a0a504 java-11-openjdk-static-libs-slowdebug-11.0.21.0.9-2.el9.s390x.rpm a821d7bb8d669cff3b0a1b6e02cc5b95a8b22b7550b50f77381a8de6bfedbfd8 java-11-openjdk-src-slowdebug-11.0.21.0.9-2.el9.s390x.rpm b2aa719a8bc29f195327d0f5ce5cc0e96538277627cdc30a2be956cef04c600c java-11-openjdk-devel-slowdebug-11.0.21.0.9-2.el9.s390x.rpm f01c8e023cb771cb7f8129ed8a0fe0e4824bf2207d0ce5d788a62aaa2a2e42f0 java-11-openjdk-demo-slowdebug-11.0.21.0.9-2.el9.s390x.rpm f502ac809dcb98fadc44b9bd766d6771e0db5d3150487d514c41ee278c1cc98e ALSA-2023:5749 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 7.0 to SDK 7.0.112 and Runtime 7.0.12. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.112-1.el9_2.s390x.rpm 4413f7f822e1cdbe70e83a25f84958562335e5581760b5deef33bb158771492c ALSA-2023:5753 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 17.0.8 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 17.0.9, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237185) * The /usr/bin/jfr alternative is now owned by the java-17-openjdk package (AlmaLinux-13648) * The jcmd tool is now provided by the java-17-openjdk-headless package, rather than java-17-openjdk-devel, to make it more accessible (AlmaLinux-13651) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default java-17-openjdk-slowdebug-17.0.9.0.9-2.el9.s390x.rpm 675087dec40a7af0b7db105ac2be64c993b1f65c1b73f728e53298481026592d java-17-openjdk-jmods-slowdebug-17.0.9.0.9-2.el9.s390x.rpm a4dc47d05ad988897b9fba2671180bd4466ef07fa58695400e6e50d933ad5c7a java-17-openjdk-static-libs-slowdebug-17.0.9.0.9-2.el9.s390x.rpm bdecb354e16b1d34810faf149e08a53c9a33eaa16f64000f41caae723fe1cdee java-17-openjdk-demo-slowdebug-17.0.9.0.9-2.el9.s390x.rpm cdd85d96295d9da97ab42d2853ddb345b982e7176aa6d18947edec58ae0bb41f java-17-openjdk-headless-slowdebug-17.0.9.0.9-2.el9.s390x.rpm d626f14c33cce7ede7c491174148a68a3f124cf3f1847c4379778b567fd9ceed java-17-openjdk-devel-slowdebug-17.0.9.0.9-2.el9.s390x.rpm dc53a40aacfcd1559eb8657ab24df8fb6c81246a144d9aaf8bca36c20e28d185 java-17-openjdk-src-slowdebug-17.0.9.0.9-2.el9.s390x.rpm e18733e4d178c61c176d94f39f9ece881da0da15bc8bea646cd480ea8c5564da ALSA-2023:5838 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default nghttp2-1.43.0-5.el9_2.1.s390x.rpm 4a349dcd81731ed6e9f85960a1cfd3378e785c45e41683be7d06acdfc052bb8e libnghttp2-devel-1.43.0-5.el9_2.1.s390x.rpm fbd4ef9bfbb683f06954802afa1c07c4239e816089f2bafcb4bc4f7f9a7f11b3 ALSA-2023:5924 Copyright 2023 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default varnish-devel-6.6.2-3.el9_2.1.s390x.rpm 4422d532b1e1accf0804fd6b6572bc5685b1484b9b7d1de8f8c388a5cd161724 ALSA-2023:6242 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.124 and .NET Runtime 6.0.24. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.124-1.el9_2.s390x.rpm 9937fccc1e79155b87e55b1c4ad1245ea7b2fc0c640595441b2fc51fca7e955e ALSA-2023:6246 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.113 and .NET Runtime 7.0.13. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.113-1.el9_2.s390x.rpm 0f9511f32262778c1f80122819b8d2d587bcd632d751cfcc90d49b3b69f5357f ALSA-2023:6265 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libgs-devel-9.54.0-11.el9_2.s390x.rpm c4c70522ebcc0293a397f280b4db779c9134d07cb6fb1752f40c301bd4313a95 ALSA-2023:6330 Copyright 2023 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default edk2-aarch64-20230524-3.el9.noarch.rpm 7f420a2e6902aa83721973936da687385ce3f9a318f79cec650eaf58da03c9ed edk2-tools-doc-20230524-3.el9.noarch.rpm bc4917712bdd37c686a2e9927839c2ca2f3285b9325d99e9fe4bb9eb8a68f06b edk2-ovmf-20230524-3.el9.noarch.rpm cf00362ca3ecc9d6ce43ec1f21168c8524b96b2675854692c3afd7bf709e0918 ALSA-2023:6340 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default xorg-x11-server-devel-1.20.11-19.el9.s390x.rpm 6eef1d6395c1959bac66e93712ba68340c6eb78d030c94c70e62a23e1f5d0640 xorg-x11-server-source-1.20.11-19.el9.noarch.rpm ed9468d65a98be100088d86f19083f24832179b05fca80ab20b7058d4b20ea55 ALSA-2023:6369 Copyright 2023 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

Qt is a software toolkit for developing applications. Security Fix(es): * qt: buffer over-read via a crafted reply from a DNS server (CVE-2023-33285) * qt: allows remote attacker to bypass security restrictions caused by flaw in certificate validation (CVE-2023-34410) * qtbase: buffer overflow in QXmlStreamReader (CVE-2023-37369) * qtbase: infinite loops in QXmlStreamReader (CVE-2023-38197) * qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default qt5-devel-5.15.9-1.el9.noarch.rpm 14df93938a3e6baf085f3edb3deec26a56cf6eff403e27dbc124e5a0fdca69d5 qt5-qtbase-static-5.15.9-7.el9.s390x.rpm 5e6569a8f0a4010f41681e082126fe4fdce14eca4323827a67c654ea861a655c ALSA-2023:6409 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785) Security Fix(es): * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libvirt-daemon-plugin-sanlock-9.5.0-7.el9_3.alma.1.s390x.rpm 0b67615059dedf5f0db78b2f10a4980024fb73bd8ed61a7705e92d5b527f4048 libvirt-client-qemu-9.5.0-7.el9_3.alma.1.s390x.rpm 73e6d3ebb410507585094a6709383aa0845aae1a55c8d480ef90364595ce8b5e libvirt-docs-9.5.0-7.el9_3.alma.1.s390x.rpm 8f7b06b2dbdb85fd784f217c292e0496e499838039f47d5f8a98d09c2da78165 libvirt-devel-9.5.0-7.el9_3.alma.1.s390x.rpm e4f41a53662eef118f4e33b78c4634763fdf986bc3da71967593636c037da549 ALSA-2023:6431 Copyright 2023 AlmaLinux OS 0 1 Moderate

libfastjson security update

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fix(es): * json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libfastjson-devel-0.99.9-5.el9.s390x.rpm a54b41774461638b18ea49dac35425f86bcf96c222d180aa60057880520a80ab ALSA-2023:6469 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: RTPS dissector crash (CVE-2023-0666) * wireshark: IEEE C37.118 Synchrophasor dissector crash (CVE-2023-0668) * wireshark: Candump log file parser crash (CVE-2023-2855) * wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856) * wireshark: NetScaler file parser crash (CVE-2023-2858) * wireshark: XRA dissector infinite loop (CVE-2023-2952) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default wireshark-devel-3.4.10-6.el9.s390x.rpm 7ef53c336d672a17d0fef285b3798f642e8f2bc61cefbec57646b9f59db4818b ALSA-2023:6482 Copyright 2023 AlmaLinux OS 0 1 Moderate

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c/librabbitmq: Insecure credentials submission (CVE-2023-35789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default librabbitmq-devel-0.11.0-7.el9.s390x.rpm d70cbea7c8c9b13f6e96a901d92552a02e47ebc8970045bf5022b1cac99c3d93 ALSA-2023:6494 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.11 (3.11.5). (BZ#2210785) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) * python: file path truncation at \0 characters (CVE-2023-41105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3.11-idle-3.11.5-1.el9_3.s390x.rpm 588c6da823c55a09ae788d9d9612313c7897b22c04cb070c5e106df08a9afa69 python3.11-test-3.11.5-1.el9_3.s390x.rpm 6a4146b3925c20e9a4039f089c91289864bb96fdabd7a19819f51a39e0c30aa0 python3.11-debug-3.11.5-1.el9_3.s390x.rpm afa053b8fa2daf6784c3d5f5ac0039594358900836ca989767ff5ad76cbec80c ALSA-2023:6518 Copyright 2023 AlmaLinux OS 0 1 Moderate

flatpak security, bug fix, and enhancement update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. The following packages have been upgraded to a later upstream version: flatpak (1.12.8). (BZ#2221792) Security Fix(es): * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100) * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default flatpak-devel-1.12.8-1.el9.s390x.rpm ff52968dceedd6794644ad2abb6a7a3ce5ecdd06927dc76f45abc28e095bc69c ALSA-2023:6544 Copyright 2023 AlmaLinux OS 0 1 Moderate

ghostscript security and bug fix update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879) * ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS (CVE-2023-38559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default libgs-devel-9.54.0-13.el9.s390x.rpm 45e81f91dd078121ba29a9a8825e66ec4249c4255a00093eacd2d3a158c4a93d ALSA-2023:6551 Copyright 2023 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default yajl-devel-2.1.0-22.el9.s390x.rpm e0b12e5ddba644cf95d81e850a699fef96901014e57397afce2080c458e61fdb ALSA-2023:6566 Copyright 2023 AlmaLinux OS 0 1 Moderate

libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application. Security Fix(es): * libmicrohttpd: remote DoS (CVE-2023-27371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libmicrohttpd-doc-0.9.72-5.el9.noarch.rpm 67390759e2ec13f61ba7f59dbe3cfaa36ab3d99119dee2bb683a6e76818003ec libmicrohttpd-devel-0.9.72-5.el9.s390x.rpm e82eb3bf13124ffe38c03fcdc7fb83d61a85092e7bb24038083505b81dc0cbd5 ALSA-2023:6575 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731) * libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316) * libtiff: memory leak in tiffcrop.c (CVE-2023-3576) * libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c (CVE-2023-26965) * libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libtiff-tools-4.4.0-10.el9.s390x.rpm aad426332f56b4bbe03da114aaf43eae2bcceff2fc50a4f5066156e980da1734 ALSA-2023:6621 Copyright 2023 AlmaLinux OS 0 1 Moderate

protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers. Security Fix(es): * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default protobuf-c-compiler-1.3.3-13.el9.s390x.rpm 3eccabaa309eb648ae92d4fc0c5cf8c5fba8ef0c397aa7f4551a585e018de960 protobuf-c-devel-1.3.3-13.el9.s390x.rpm 57c1e56c7741e30b8e6bdc25b9351907681677022cc7cb7a5cc704f5dfa86e97 ALSA-2023:6631 Copyright 2023 AlmaLinux OS 0 1 Low

glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499) * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611) * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default glib2-static-2.68.4-11.el9.s390x.rpm ac92a0002e15da3d754c8bf4ab3adab228fcdbc3f97b049d335d7376c24509e5 ALSA-2023:6632 Copyright 2023 AlmaLinux OS 0 1 Low

shadow-utils security and bug fix update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default shadow-utils-subid-devel-4.9-8.el9.s390x.rpm 02000ade5890b4c7032f154f663f4a4e519ffa5b155f4525308fb0581e2ffb78 ALSA-2023:6659 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.18). (BZ#2210783) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3-debug-3.9.18-1.el9_3.s390x.rpm 2a1f9405c5586fd5846ccaa7e839cc0864a8a4dc5168c412c5094014e8d6d110 python3-test-3.9.18-1.el9_3.s390x.rpm bc1b391c3a0fb8cbedef825c7c978856388f8fb2ea841a7c88a0ed68ca95bb2e python3-idle-3.9.18-1.el9_3.s390x.rpm f989e81084d7aba83be2af1ee5c4f06cb5da1f3d4693b3c102ab4d4679bab3de ALSA-2023:6667 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415) Security Fix(es): * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127) * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966) * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967) * samba: spotlight server-side share path disclosure (CVE-2023-34968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default samba-test-libs-4.18.6-100.el9.s390x.rpm 15566e90ed87842dea327b6978e7ef724bb7c8213800801a19806690a1107d3a libsmbclient-devel-4.18.6-100.el9.s390x.rpm 319f867395d406b7d2b082fef3b2c2d33583a37f94a745598957b4e85f6445b1 samba-devel-4.18.6-100.el9.s390x.rpm 41e0494a2329fb08fe497bde152fd2d935a43214a5d2211a49cbff67e9350856 samba-pidl-4.18.6-100.el9.noarch.rpm 612991a14c95fa2121a221b922b765cc7bec8b2556c61d9b4fec0ed42bae7173 libwbclient-devel-4.18.6-100.el9.s390x.rpm 6af8b90d07cf1c8c86ba4e7b46f580852b23c4169c05424b23cd0a29d1840f60 python3-samba-devel-4.18.6-100.el9.s390x.rpm 9c8abda548920cf715e090e43f1d3865c2041435b6f007ae91861fab2a54416f python3-samba-test-4.18.6-100.el9.s390x.rpm bfabbea0a41d178f56fa08659e17458a3e37ec837911a4a4b8d48b689190d58f samba-test-4.18.6-100.el9.s390x.rpm c0f5ddf91453c32c02cb08e5ff78744c39a67973c9f86b0871d0165706b9873b libnetapi-devel-4.18.6-100.el9.s390x.rpm e858ef490d7ac979e46835656268597a4d36e774446620b23e7db748022d67b6 ALSA-2023:6685 Copyright 2023 AlmaLinux OS 0 1 Low

tpm2-tss security and enhancement update

The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices Security Fix(es): * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default tpm2-tss-devel-3.2.2-2.el9.s390x.rpm 542b6cdddcf42d38bf78989ddf982eaf9bfe44375494a3c67df1e5d891c5c575 ALSA-2023:6705 Copyright 2023 AlmaLinux OS 0 1 Low

procps-ng security and bug fix update

The procps-ng packages contain a set of system utilities that provide system information, including ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx. Security Fix(es): * procps: ps buffer overflow (CVE-2023-4016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default procps-ng-devel-3.3.17-13.el9.s390x.rpm 1ad07de17e23b32d83157d5d332a7ed12ef27b609894b10d24a929a7e1563067 ALSA-2023:6707 Copyright 2023 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468) * avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502) * avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default avahi-compat-libdns_sd-devel-0.8-15.el9.s390x.rpm 061986fb4d58a81a42217de80a874227233fc6cbf0b9cda61dd46b66104f2b86 avahi-devel-0.8-15.el9.s390x.rpm 161b566b9c98ccc4e617082a7ce21e6e65d78194ddafd325b27db46a2f9d6d74 avahi-compat-libdns_sd-0.8-15.el9.s390x.rpm 6483c686c5296b39bbbea1c8d71ecf87256254e98f5163d22e9af81144804f67 avahi-compat-howl-devel-0.8-15.el9.s390x.rpm bf69e85ad33457cb1fc9aa471ee079ec3def58528f896bb26e8b161928e7cdb2 avahi-compat-howl-0.8-15.el9.s390x.rpm ed3f7d75d4192abf3a8b7421e614685764c6518716f74009723983109e6cb259 avahi-glib-devel-0.8-15.el9.s390x.rpm f0b18601d41a7a6717888e63eae6fd0805e3ca864aa75174795e5bcb76dadfae ALSA-2023:6712 Copyright 2023 AlmaLinux OS 0 1 Moderate

python-wheel security update

Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427. Security Fix(es): * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli (CVE-2022-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3-wheel-wheel-0.36.2-8.el9.noarch.rpm 3d0309b1e2967adc653729a9f88ae803d2b08b950de795181354f1390ee081c9 python3-wheel-0.36.2-8.el9.noarch.rpm 3e81c4451b2cefe7a23125e40c7b73abefee7630a64b19b57cce91adb41850a0 ALSA-2023:6732 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default libgs-devel-9.54.0-14.el9_3.s390x.rpm 2bce2504a1040c7c34df3b23a83b936a7d9adce36280b3f4c52702b27ea746c8 ALSA-2023:6738 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-21-openjdk security and bug fix update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 21.0.0 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 21.0.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 20.0.0 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 20.0.1, increases it to 16 MB. (AlmaLinux-14954) * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-14962) * Installing the same java-21-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-21-openjdk-headless package. This prevented the use of the dynamic dump feature, because the checksum in the archive would be different on each system. This release resolves this issue by using the .jsa files generated during the initial build. (AlmaLinux-14946) * The /usr/bin/jfr alternative is now owned by the java-21-openjdk package. (AlmaLinux-14959) * The jcmd tool is now provided by the java-21-openjdk-headless package, rather than java-21-openjdk-devel, to make it more accessible. (AlmaLinux-14948) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default java-21-openjdk-src-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 1837fe04241b6026fa0ff82c203c29b4c7b9ac9f953c385f6b0739d968179766 java-21-openjdk-devel-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 18645bb12fbd375a60a10cc3b04e43a5c07747cbc3448fd711edba44c5ffa110 java-21-openjdk-demo-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 28dc8924b6ec0790c43585f649d44041e52aeb1df4c8e773c5c56e3c6b0c363f java-21-openjdk-jmods-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 3d56cda6a3732f964ff1b43e7600fa1a8dc024cf059ff20f1b48201d324d6137 java-21-openjdk-static-libs-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 7d38b5057f47144b9411fea5d567f7ab94e70b130f12087dbc9d348e083cbb77 java-21-openjdk-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm 9a84caa0b50fa055f23ba106b08d06018a1779de3f355c9a32aecc4d0b905577 java-21-openjdk-headless-slowdebug-21.0.1.0.12-2.el9.alma.1.s390x.rpm c2b6864aefab49e91cab7c3c6a9857442fef1900e09351c20d80cbdc62e90751 ALSA-2023:6744 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961) * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091) * samba: "rpcecho" development server allows denial of service via sleep() call on AD DC (CVE-2023-42669) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default python3-samba-devel-4.18.6-101.el9_3.alma.1.s390x.rpm 0ff0bde74564a762fb780d645061c78cb8f83c452df514bda6ba1b4705fb0794 samba-test-libs-4.18.6-101.el9_3.alma.1.s390x.rpm 1b3e5d5ed293890c0dc85248e0808255ad6ca2ae566b5ac789ed232dd18db293 libwbclient-devel-4.18.6-101.el9_3.alma.1.s390x.rpm 30670e4f12d4e8a51bce4da1d5c0e807de7177a622cfd10b67fea60bdef5b97a python3-samba-test-4.18.6-101.el9_3.alma.1.s390x.rpm 4036b49858977245e85c9c4b911ec6d00dd04270b7a54c884b9786899e3cf608 libsmbclient-devel-4.18.6-101.el9_3.alma.1.s390x.rpm 4932aa729d8690b79dcbbb54c00f091114e7e956f6bfe2fefcfd8a86f029d542 libnetapi-devel-4.18.6-101.el9_3.alma.1.s390x.rpm 842ca0451f978bc256bff23a3bdc3c3a9014bdcf099ff2af54f8baa237b4f6bd samba-pidl-4.18.6-101.el9_3.alma.1.noarch.rpm a354085fbc28e8f451498a06fa2c351712ff1a40a027007331bfc331b30c9272 samba-devel-4.18.6-101.el9_3.alma.1.s390x.rpm b108c9c56bc2a22149a33af97d3932bf904515d97c892cb86513bf5df55155ef samba-test-4.18.6-101.el9_3.alma.1.s390x.rpm b4f17305ac21fb04c45b0194a3f6fea87a9528e23d14e6bcda427e2e32f4b069 ALSA-2023:6746 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_2_default nghttp2-1.43.0-5.el9_3.1.s390x.rpm 3a7bdbddeb6ce6adf9e3447266cd55eee62606a8d5597b40acb22fc9d84c391c libnghttp2-devel-1.43.0-5.el9_3.1.s390x.rpm 96e5384458b3113d7cc72816d7754f86f4adf0580eec7fdae3fa6480981b5e49 ALSA-2023:7253 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.100-2.el9_3.s390x.rpm 4ef64151c0bcda0873a83fa7d826d8027db1cde033346b216b4436a9b425458b ALSA-2023:7255 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.114 and .NET Runtime 7.0.14. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.114-1.el9_3.s390x.rpm e5fa0ce232c876b6eca82dd853a4a21b80d7cbe7b748bf71ee82b9baf474109f ALSA-2023:7257 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.125 and .NET Runtime 6.0.25. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.125-1.el9_3.s390x.rpm 00fe41cfb6c362d7055cd75ad528cc169a828911410f09e6e3897394fe1b9cd3 ALSA-2023:7784 Copyright 2023 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868) * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417) * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default postgresql-server-devel-13.13-1.el9_3.s390x.rpm 07fdd1d83092c0c6938ec4db0a43ca526a637eefbd0f842147c4190ebd3a4efc postgresql-docs-13.13-1.el9_3.s390x.rpm 0f569769ab618d389278a88ce9a5d055b5f4d485663e971d342feb061305c3f0 postgresql-static-13.13-1.el9_3.s390x.rpm 6412eb5efffe2d8e76dc616410fdbeae66b36ad61365357a91998c0d101add62 postgresql-private-devel-13.13-1.el9_3.s390x.rpm 6e6b4556edb6a615794c2fa7cdd3db6df0c4a8c220568fdc5e375a694db15d60 postgresql-test-13.13-1.el9_3.s390x.rpm 92cb6d83e44db4b5bcc0d6b6aa85934b63f5484c06dd95a5d5b8b4309808f013 postgresql-upgrade-devel-13.13-1.el9_3.s390x.rpm b44d19397742db59013a0427a94e9f2820b4efd948babe8fb262d94bdae40a34 ALSA-2023:7791 Copyright 2023 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429) * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default gstreamer1-plugins-bad-free-devel-1.22.1-2.el9_3.s390x.rpm e1472557ce59794b671d66409200705c26c2d54eb8fe6ea23265f85e73e20893 ALSA-2024:0141 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: Invalid CSRF protection (CVE-2023-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default python3-ipatests-4.10.2-5.el9_3.alma.1.noarch.rpm 68d1ad015ab26a9ad0dbf8959a913b4646f9c03e6148457726c5c1540c1443b8 ALSA-2024:0151 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el9_3.s390x.rpm f3f0b5387fa2414c4f7cdc02683c992f3269559beda608f4d88b5eea950b214a ALSA-2024:0152 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.101-1.el9_3.s390x.rpm 9cb6e118aa018b2c1cdd6bd34f4d98bfe2796757b2341ebb82553592d51178bd ALSA-2024:0156 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.126-1.el9_3.s390x.rpm 904efa1dcfa501caf5edf947ac603741244c7f3115baa368eb7c51d29ffdf7c9 ALSA-2024:0249 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-21-openjdk-headless-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 102077c6fb71c94fce915e78196ff36df08fa5bc50fc3896fb07e38c8b2e3a38 java-21-openjdk-demo-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 1dce5c595b4654c4fcc51b35bc13105e9e1e6cbeafe2c3b10cbc99c9b31b9adf java-21-openjdk-jmods-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 38bfab24f06d5b39c52af331773e665657bc9feb65ad83aac90d9c8d9f8fae40 java-21-openjdk-devel-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 5cb97e82b3f1eb8edcb2c5e9fcc68ad7237b4688a178b907ea999720d63a4a4e java-21-openjdk-src-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 8600893e2a7de9283e767b21efcfd8b534c206f8b883b65e22781a99b05941a1 java-21-openjdk-static-libs-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm 91ff3d538e29c563a3012e13f8ee1290b7c217d60d7be3b667c1f7db009a93ee java-21-openjdk-slowdebug-21.0.2.0.13-1.el9.alma.1.s390x.rpm a108701b94de172eb512944bf4aadfac4c44bddc868aea21ad91d9d943ebd53a ALSA-2024:0266 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-11-openjdk-demo-slowdebug-11.0.22.0.7-2.el9.s390x.rpm 309119b04af1c15226706cb2e304eb922a41509f730aa8cb784311c3fac3d659 java-11-openjdk-src-slowdebug-11.0.22.0.7-2.el9.s390x.rpm 75dcfcd7927b7358be7c4ba35b28b9b1f087391099feb7ac4f5f67c4ae7a7c69 java-11-openjdk-jmods-slowdebug-11.0.22.0.7-2.el9.s390x.rpm 8786028d22f7a5b00823798b9ac24869577ae46d738b7ac6cc0f12b72e49a67e java-11-openjdk-headless-slowdebug-11.0.22.0.7-2.el9.s390x.rpm 99b329ad562c8b41d384bfbc51efbd1a78cd565636ce1404e9afb4622d8540b0 java-11-openjdk-static-libs-slowdebug-11.0.22.0.7-2.el9.s390x.rpm c4cb57ef3536cef1344103619480809a99da8b622902330997bc2b9db36679ef java-11-openjdk-devel-slowdebug-11.0.22.0.7-2.el9.s390x.rpm d24cca7919b3078fcc6385c0905bc1caab9cddb173eb88c0e10aea7b2d78d546 java-11-openjdk-slowdebug-11.0.22.0.7-2.el9.s390x.rpm e9541ac9fd5102506f5302c6e1eb9572b64fc294da5d4c58f879ce888ededaf2 ALSA-2024:0267 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123) (CVE-2024-20932) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-13930, AlmaLinux-13931, AlmaLinux-13934, AlmaLinux-13935) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-17-openjdk-devel-slowdebug-17.0.10.0.7-2.el9.s390x.rpm 30ad63524f1a10eb5a4579d20c9bc4eb50ba65e6df2535671c6ced69351a47b7 java-17-openjdk-src-slowdebug-17.0.10.0.7-2.el9.s390x.rpm 484b1a06c8752ab32c2936216a89f1bbf7b00dcdfb4e936434906f60a8215508 java-17-openjdk-static-libs-slowdebug-17.0.10.0.7-2.el9.s390x.rpm 7320686c183ad961a7710f1ce28ab22bafc5be01a8d00478b959b890ff2e7670 java-17-openjdk-jmods-slowdebug-17.0.10.0.7-2.el9.s390x.rpm 77acc0ba22440fbab3eb84ad996cc83863a54dd285d0307959e66994162ba4e3 java-17-openjdk-headless-slowdebug-17.0.10.0.7-2.el9.s390x.rpm b39210e7d30417553ffec565864ffac05bbaaea1de2718938d5f0e124f163ce3 java-17-openjdk-slowdebug-17.0.10.0.7-2.el9.s390x.rpm b73506cc1486c8c7960ab0708c36f3296208d334a668260977c75d7c07ce97e2 java-17-openjdk-demo-slowdebug-17.0.10.0.7-2.el9.s390x.rpm c6a75935a8a5c516bdcfb5d6fefb81cd18c17cd33a6eab56e7e59faf9aa5cb09 ALSA-2024:0466 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default python3-test-3.9.18-1.el9_3.1.s390x.rpm 455aa996df7b20c448f547d4385445e08b7cc13146353a76164e473e5447567d python3-debug-3.9.18-1.el9_3.1.s390x.rpm 56b794393df1630116b7ead5b7e32519c90575a548706ba33873b637de0a87d9 python3-idle-3.9.18-1.el9_3.1.s390x.rpm ae129f9247ff993e6e171997b1e4f01cd7c6dd793463fef792fa093688a07860 ALSA-2024:0805 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.116 and .NET Runtime 7.0.16. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.116-1.el9_3.s390x.rpm c355e45af210d06ee38407d87e63612369953d8a46fd24cdb0fd9784d53f9a02 ALSA-2024:0807 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.127-1.el9_3.s390x.rpm 17099d2392fd7683b2f8f34a01ab41b4e231450cb664a33e9b4892e02270c45d ALSA-2024:0848 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.102 and .NET Runtime 8.0.2. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.102-2.el9_3.s390x.rpm ab115025e973401cdde2633a6c8892c5a898e129df074c38da94fa4d62214cdf ALSA-2024:0951 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default postgresql-private-devel-13.14-1.el9_3.s390x.rpm 1e4710c786b97e322bd298a33fb73c12bf3d2236e03f2c86ecaa366c2c874d53 postgresql-static-13.14-1.el9_3.s390x.rpm 47233ad72c32235e2d5013e2f78f077980a7273737b654d73be30d6cc2abae89 postgresql-docs-13.14-1.el9_3.s390x.rpm 47a7f078d5284fff7ed5b1dff03db7620dfda4e75d56ae502169d46d412afc69 postgresql-upgrade-devel-13.14-1.el9_3.s390x.rpm 67be39e2d184c2a6a632e0ac27b430554d94ca04ab2ab1474b997698466e1dc8 postgresql-server-devel-13.14-1.el9_3.s390x.rpm 8540ccd4d235375702eff5f34f8c985b14537b8837d418c98f518eb38f134f82 postgresql-test-13.14-1.el9_3.s390x.rpm f36ac92b038a167fa4aeea7616896b1c7e5d3553cba86291fbdc30aa35f9c088 ALSA-2024:0977 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.1.s390x.rpm a7b8df736afa4509b06004c3d2091edfeddd2e9311fdbe8c8a028399a332b1b8 ALSA-2024:10274 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009) * kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244) * kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CVE-2024-50226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.15.1.el9_5.s390x.rpm ac9a48dd054bb01bed2790ceff2d8686e3c3c3b3c7022841daf1634d46751421 kernel-cross-headers-5.14.0-503.15.1.el9_5.s390x.rpm fcf26bc5494e9de85e485c780048a4ca514e3e311c463d0728c0be5d0cafad98 ALSA-2024:1075 Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230) * edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default edk2-ovmf-20230524-4.el9_3.2.alma.noarch.rpm 672357e5f22af5021147da1e6ea2940970361d3219b3256dc24010fdaeeb1424 edk2-tools-doc-20230524-4.el9_3.2.alma.noarch.rpm bfcb0f5d6e03f7d8b84272a53664e90bac1a421417262c4e9b2f8eefe207350d edk2-aarch64-20230524-4.el9_3.2.alma.noarch.rpm c344e31df64e7b01343cb0aed155d8145237772f7f844a227dd8eda235c3368c ALSA-2024:10791 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default postgresql-server-devel-13.18-1.el9_5.s390x.rpm 0ce6c80044679be8fa58951a296638ee82e94a406b5f14025556104298d93761 postgresql-static-13.18-1.el9_5.s390x.rpm 1a15480f15fbd090446c6f8d432d0e44048f2c5a986d06b56f7cd2b486476cd8 postgresql-private-devel-13.18-1.el9_5.s390x.rpm 4c570cdb43d27d988847ddfb3d71f52fc54ec84b27876d5591381b18b1194a3f postgresql-upgrade-devel-13.18-1.el9_5.s390x.rpm 75d71c57236ff3ba202e56afbe4392a395fb47b7fe62029eb0e7ade690215efb postgresql-docs-13.18-1.el9_5.s390x.rpm 8b99b0432f1344751ac1dd700d3885f9af33eb3a609400512cdb82c2e769692a postgresql-test-rpm-macros-13.18-1.el9_5.noarch.rpm 8e7546673e90d6d2cf20b6956f17bd1e184001032394a5fb82dfcd5ef8e622ee postgresql-test-13.18-1.el9_5.s390x.rpm ef5205daacfc5a7f100479e43649d2e6590794789e63ac754cf0b871e9fb86ec ALSA-2024:10858 Copyright 2024 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default ruby-doc-3.0.7-163.el9_5.noarch.rpm 7485aeb0e6755d661e1ec91aaf7d312c6b374400a15cfc3836f7fa8b35c81c0e ALSA-2024:10939 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: iommu: Restore lost return in iommu_report_device_fault() (CVE-2024-44994) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) * kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695) * kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CVE-2024-49949) * kernel: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CVE-2024-50251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.16.1.el9_5.s390x.rpm 29038143a513709188e00721377c2135b27f44c9815e3f2b1c89f154a17153a0 kernel-cross-headers-5.14.0-503.16.1.el9_5.s390x.rpm 74d31f246e6f767e50eb88ab86d30cb6034654433b5e46f72401c349736a85e3 ALSA-2024:10978 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3.12-debug-3.12.5-2.el9_5.2.s390x.rpm 4ee8d32f69ee9c2180e6da38d77c8d2aec39dd92b11ec883189a1a04e6b1031c python3.12-test-3.12.5-2.el9_5.2.s390x.rpm 59e7fe1a10cd908bf93adfc9662dc15a4cc22607899fe280705883f0a3b2bd93 python3.12-idle-3.12.5-2.el9_5.2.s390x.rpm d6ecb38e4db9198acb923030d4780c773c96085ec5fcc23ac29712c5daeb9132 ALSA-2024:10983 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9:3.9.21 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3-debug-3.9.21-1.el9_5.s390x.rpm 4cf8cc13e72fa634da1a2bcba2a4e028ba70f2ab200cf63f26b92eedc286e49b python3-test-3.9.21-1.el9_5.s390x.rpm 753f5aae2c0739af4c9e365571203f5c082ec54442a1d4d522044b561be79ded python3-idle-3.9.21-1.el9_5.s390x.rpm ddcae2fd820d90d94027cf9379397a000ee7ea315af4061b0cd8ad6c356759f9 ALSA-2024:11111 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3.11-test-3.11.9-7.el9_5.2.s390x.rpm 24d02abb08a6cae7cde7275a0a5a7acbc34e6ccf9eb04888715274e64b935d43 python3.11-idle-3.11.9-7.el9_5.2.s390x.rpm ea5c2419781f702246d7c7cedab2cb8f319ff1447e00068ac8490c8379b719e0 python3.11-debug-3.11.9-7.el9_5.2.s390x.rpm eaca982236ae7fd12b8c68943495dc474708cd437ba4eb72d7be1969ef7e168a ALSA-2024:11219 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2:20240524 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default edk2-tools-doc-20240524-6.el9_5.3.noarch.rpm 2b923e24eec0bc923208f279be2fa0de8f842b72a1682114e63d9f2e4b3d8654 edk2-ovmf-20240524-6.el9_5.3.noarch.rpm 78c94982627bd8d6000410fa5f470a76850f56d9d10d3b989fdf8cc767e6221e edk2-aarch64-20240524-6.el9_5.3.noarch.rpm b4113deecdfdfe37d6e0009c5471b1d36782fb5ed693b1ca0c64dfd4f940de66 ALSA-2024:11232 Copyright 2024 AlmaLinux OS 0 1 Moderate

unbound:1.16.2 security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default unbound-devel-1.16.2-8.el9_5.1.s390x.rpm e0264c64661cf51939ee52d7ebdee6c01d4cb58cd9850b72da1f47c3dff15fa9 ALSA-2024:11237 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile:1.0.31 security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libsndfile-devel-1.0.31-8.el9_5.2.s390x.rpm 96e938e35849dbe0d09e57a6d2b7f83e97fb1f6511b2182c49f33e8379a1190b ALSA-2024:11242 Copyright 2024 AlmaLinux OS 0 1 Moderate

mpg123:1.32.9 security update

The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries. Security Fix(es): * mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default mpg123-devel-1.32.9-1.el9_5.s390x.rpm 6af2f4becf6a9e89719cadd8c4d0c881e14bdfdc36837008d4f239aa6925781a ALSA-2024:1141 Copyright 2024 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911) * mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982) * mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21955) * mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966) * mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972) * mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980) * mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033) * mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046) * mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053, CVE-2023-22054, CVE-2023-22056) * mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058) * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114) * mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111) * mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115) * mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-2097, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964) * mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967) * mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981) * mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983) * mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984) * mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985) * zstd: mysql: buffer overrun in util.c (CVE-2022-4899) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038) * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113) Bug Fix(es): * Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22454) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default mysql-test-8.0.36-1.el9_3.s390x.rpm d71878bfb56621aec3d33d39d61422e44a1425d9cd67c991be96afe2fd1449fe mysql-devel-8.0.36-1.el9_3.s390x.rpm de69222d31f8028a3b11be14bf9c4ae23c74097bbad394faa7716d2960ada8e3 mysql-libs-8.0.36-1.el9_3.s390x.rpm f5bd37517b6b9b9b46d84bb8c910769c8ed2c968b098b65a6d8eb08e3f3cce7d ALSA-2024:11486 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: bpf: Fix a kernel verifier crash in stacksafe() (CVE-2024-45020) * kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out (CVE-2024-46697) * kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CVE-2024-47675) * kernel: bpf: Fix a sdiv overflow issue (CVE-2024-49888) * kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099) * kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110) * kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125) * kernel: Bluetooth: ISO: Fix UAF on iso_sock_timeout (CVE-2024-50124) * kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (CVE-2024-50115) * kernel: xfrm: validate new SA&#39;s prefixlen using SA family when sel.family is unset (CVE-2024-50142) * kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister (CVE-2024-50148) * kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192) * kernel: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CVE-2024-50255) * kernel: sched/numa: Fix the potential null pointer dereference in task_numa_work() (CVE-2024-50223) * kernel: bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.19.1.el9_5.s390x.rpm 419047a8331cad2d04d1d8baa2036a1bc3f0ef335e30acfbef2feb2d99bdb2e8 kernel-cross-headers-5.14.0-503.19.1.el9_5.s390x.rpm 4c90c7738423bf0df1817f6449f08b362fcfab843df58c98ce5d18ddb11b749b ALSA-2024:1239 Copyright 2024 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default opencryptoki-devel-3.21.0-9.el9_3.alma.1.s390x.rpm e683e9a6eb8853165d5a44907a4336ad6974ebcb3d560f8fdb3cfeecbadeab82 ALSA-2024:1309 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.117 and .NET Runtime 7.0.17. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.117-1.el9_3.s390x.rpm b17d066582cf988d779b0e47eb9f560fdf7e1489215006072a42859a82c421b7 ALSA-2024:1310 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.103 and .NET Runtime 8.0.3. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.103-2.el9_3.s390x.rpm 05cdabb373e056d9bc123b39ae29ca81fdfd6cc07fa0411b996e25a997e73bfb ALSA-2024:1691 Copyright 2024 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default varnish-devel-6.6.2-4.el9_3.1.s390x.rpm f29676d3fe31c14d0de08da208ec42733f68aea97e7085c4d6b5a98ce7bab368 ALSA-2024:1750 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. The default combination of the "control-use-cert: no" option with either explicit or implicit use of an IP address in the "control-interface" option could allow improper access. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged local process to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. To mitigate the vulnerability, a new file "/etc/unbound/conf.d/remote-control.conf" has been added and included in the main unbound configuration file, "unbound.conf". The file contains two directives that should limit access to unbound.conf: control-interface: "/run/unbound/control" control-use-cert: "yes" For details about these directives, run "man unbound.conf". Updating to the version of unbound provided by this advisory should, in most cases, address the vulnerability. To verify that your configuration is not vulnerable, use the "unbound-control status | grep control" command. If the output contains "control(ssl)" or "control(namedpipe)", your configuration is not vulnerable. If the command output returns only "control", the configuration is vulnerable because it does not enforce access only to the unbound group members. To fix your configuration, add the line "include: /etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf". If you use a custom "/etc/unbound/conf.d/remote-control.conf" file, add the new directives to this file. (CVE-2024-1488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.5.s390x.rpm ed68fd1fb61a83c616ab1f6f0cbe87f94e3c12ee5d391c6a98df6cc3089c2db1 ALSA-2024:1789 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default bind-doc-9.16.23-14.el9_3.4.noarch.rpm 22ea42050319c6952320fdfdb1eb6f005290375161f8b1ae7f8089901182832f bind-devel-9.16.23-14.el9_3.4.s390x.rpm e8f6380ead1bb50227b442f9ed716967b8c6317c1b41a490cc95da9116593919 ALSA-2024:1822 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-11-openjdk-headless-slowdebug-11.0.23.0.9-3.el9.s390x.rpm 3508c06f5845c83bf5ec3c3cec5964620ac02c58f96f705ca9e98bdb8277b7df java-11-openjdk-devel-slowdebug-11.0.23.0.9-3.el9.s390x.rpm 70fbef84d71e8abe7db1ea266001cac03c419bce7fd225f97a0606729dff4efc java-11-openjdk-src-slowdebug-11.0.23.0.9-3.el9.s390x.rpm b8245eb9514a55e7f292f1dd0ac711b1e9541948d9b8ae40f4afe7a733a4bd25 java-11-openjdk-demo-slowdebug-11.0.23.0.9-3.el9.s390x.rpm c628f98b6b8890b902c1e37b7947cbd808cf0db7096b59385d4e947072a4b5bc java-11-openjdk-static-libs-slowdebug-11.0.23.0.9-3.el9.s390x.rpm ca86101133c8da866997953ff719488f05923ecefb29a7f3abc0424c9328bcf1 java-11-openjdk-slowdebug-11.0.23.0.9-3.el9.s390x.rpm da59bcc2e2747b4a961f428d94accf991b6c1b30b6286b8cb22bfdc86a3e2f22 java-11-openjdk-jmods-slowdebug-11.0.23.0.9-3.el9.s390x.rpm eaec58066327d43c21dca5193b983fddc9e6636afc98b77dd344003c62ed3fd0 ALSA-2024:1825 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-17-openjdk-static-libs-slowdebug-17.0.11.0.9-2.el9.s390x.rpm 491a275263ff33bc2352acdf82f1c3fc51bff74d3e8ca3fa9d8b3581170bf6c0 java-17-openjdk-jmods-slowdebug-17.0.11.0.9-2.el9.s390x.rpm 4bfc9a0647acf749d86f04f42c8c9a6c3398c188b3c7b65a1bee5a1333b8e17a java-17-openjdk-demo-slowdebug-17.0.11.0.9-2.el9.s390x.rpm 584d2dd72533517c849e616a55dfe850c38cd7b8dbea430231dbe70d8ed1ed9d java-17-openjdk-devel-slowdebug-17.0.11.0.9-2.el9.s390x.rpm 65f4b2ef482be846350064142e8bca777811605ab42d72e5a52cf564a45eedd8 java-17-openjdk-slowdebug-17.0.11.0.9-2.el9.s390x.rpm 991a8d4e946c4f744f121e16fa4109a918e2017417c320432f9bb1ef966d3e27 java-17-openjdk-src-slowdebug-17.0.11.0.9-2.el9.s390x.rpm b3f29ec931f1c80c0d670732bf052dc18582af7a31a5c80876e3396588a3ca7f java-17-openjdk-headless-slowdebug-17.0.11.0.9-2.el9.s390x.rpm cbb2f031e3d21e6e7d6d8badb613f6f886803bc4bd7eb0fdcb983efd52063d98 ALSA-2024:1828 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_3_default java-21-openjdk-devel-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm 02414f45ec84331238928d526037ff7ad821e2f0abbcd5d0ca3a0ef732c60f4b java-21-openjdk-demo-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm 250813a5320e3ee37d006d25b18ef955766e97ddc78cb901fab0e9ed0986f816 java-21-openjdk-jmods-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm 33f94762f8d76f412de471f62d735d691bd90a976428a1dfc582a286684074db java-21-openjdk-static-libs-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm 61fabcd0c9f1ad6cdc416333ea13d6d605b2ca53a6ce199ebf8a06e17734d675 java-21-openjdk-headless-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm b5f2b8349cf733a38be4b7c6ab849804a909119896669ca0c473ec15e34a2f0c java-21-openjdk-src-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm e93824b0bd44f9c4ff9c8ad417af78d2bb78d4082138c57e1edc430543d964cc java-21-openjdk-slowdebug-21.0.3.0.9-1.el9.alma.1.s390x.rpm f2fc217813ff509bebb438d9752b978a8eeef1ebe7169b7e4dac9057a3b4dc40 ALSA-2024:2147 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-ipatests-4.11.0-9.el9_4.noarch.rpm d851142c22ff4c5d9ddf230430e8aced17c7f7736aaced76c0e7c45c4580cf6b ALSA-2024:2169 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377) * xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (CVE-2023-6478) * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816) * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVE-2024-0229) * xorg-x11-server: SELinux unlabeled GLX PBuffer (CVE-2024-0408) * xorg-x11-server: SELinux context corruption (CVE-2024-0409) * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885) * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886) * xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-24.el9.noarch.rpm 312de6141de8edf176752f753a27b2608f335b89d5c094f576bbb86755bd521f xorg-x11-server-devel-1.20.11-24.el9.s390x.rpm 7ef72de6b434cddf1f436b96692b9c56c372c48e59b8acaaeff178922fc55345 ALSA-2024:2184 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in src/mat4.c and src/au.c leads to DoS (CVE-2022-33065) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libsndfile-devel-1.0.31-8.el9.s390x.rpm 5988451f6673eb8024b012d1a511a402e79d061a6fe206f02b85bf3b0a187e17 ALSA-2024:2199 Copyright 2024 AlmaLinux OS 0 1 Important

pmix security update

The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fix(es): * pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default pmix-pmi-devel-3.2.3-5.el9.s390x.rpm 0a8ed7f4f28fc0050682c6a49ba5594df9cb15acc8b05874eb87cdbc508de240 ALSA-2024:2204 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871) * libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default ocaml-libnbd-1.18.1-3.el9.s390x.rpm 26690f05a3318f65a9297c32c9e01d80f5f9327e2233abb25011770c21a79f0d ocaml-libnbd-devel-1.18.1-3.el9.s390x.rpm 46635e35ef5d06324225c5419502e80d7e68ea2c3e872b21bd0be8c63546a048 libnbd-devel-1.18.1-3.el9.s390x.rpm 84032db32c0a51fd2c0bbba8e40d206d2642f8d55afc099bd09813075111b536 ALSA-2024:2208 Copyright 2024 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350) * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351) * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352) * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356) * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186) * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567) * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations (CVE-2023-40569) * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589) * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353) * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354) * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181) * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libwinpr-devel-2.11.2-1.el9.s390x.rpm 0e932d10ad80a54dd06a9dc8c53c62f98057f5f0e56bbb8e8df0544ecc36b12b freerdp-devel-2.11.2-1.el9.s390x.rpm 57fe36d950db5dd66f9e554a0c737c746cde634400dcf0b8e918c28837311add ALSA-2024:2236 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: NULL pointer dereference in udevConnectListAllInterfaces() (CVE-2024-2496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libvirt-daemon-plugin-sanlock-10.0.0-6.el9_4.alma.1.s390x.rpm 4f1ce1ce362c0a2ccbec254f97eef3a539b7f4d259e7f6f81f30e9a58f194069 libvirt-docs-10.0.0-6.el9_4.alma.1.s390x.rpm 76160c50fecde8ae6d2e7796c06835aa478b0392a6a0f4b2a8c50bb5ddb5fb40 libvirt-devel-10.0.0-6.el9_4.alma.1.s390x.rpm 90518d4cd8a7c11b7c71d71626309b71c0b5dc6df37b37fbc396e086e015687e ALSA-2024:2276 Copyright 2024 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: incorrect integer overflow check (CVE-2023-51714) * qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-9.el9.s390x.rpm 180e2c5cdeaff5fb06eae99d0fc989e255c5d92e09f5c8aaf16ed641c8551187 ALSA-2024:2287 Copyright 2024 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video (CVE-2023-40474) * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (CVE-2023-40475) * gstreamer-plugins-bad: Integer overflow in H.265 video parser leading to stack overwrite (CVE-2023-40476) * gstreamer-plugins-bad-free: buffer overflow vulnerability (CVE-2023-50186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default gstreamer1-plugins-bad-free-devel-1.22.1-4.el9.s390x.rpm 0deb5d700b3248b6d5882b346a6f1154483db4a9d19406847c102a4bc76d921b ALSA-2024:2289 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090) * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618) * libtiff: integer overflow in tiffcp.c (CVE-2023-40745) * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175) * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9.s390x.rpm 3460f4be1c2bf1096dd75ab21d7ef2d158e9198481a15ea7eca2d5f3aa3adb7d ALSA-2024:2292 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-test-3.11.7-1.el9.s390x.rpm 2b70a86739aff3ca3f85e41d25171eb4b47ff8a97fa086d369d2f71cc8e61bca python3.11-idle-3.11.7-1.el9.s390x.rpm 68b9b801259c4ed0ef0c31daa8a3c358105500c01743e0cda4e6dba07136a827 python3.11-debug-3.11.7-1.el9.s390x.rpm 79d5dcf31ca117e4d0850c8f1b2481b4d0918a5d5e41e186cc89dfe5aa68f401 ALSA-2024:2295 Copyright 2024 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default turbojpeg-devel-2.0.90-7.el9.s390x.rpm 3a5d0be1ebf54739f3c7ea921cedda99a3763762cb3138c28704d0fca37fe80e turbojpeg-2.0.90-7.el9.s390x.rpm 3b7f277ce028f54c5f1c48e5eda7b5ae96b860a6f139eab905d4aafc88da164c ALSA-2024:2353 Copyright 2024 AlmaLinux OS 0 1 Moderate

mingw components security update

MinGW (Minimalist GNU for Windows) is a free and open source software development environment to create Microsoft Windows applications. Security Fix(es): * binutils: Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfd_getl64 (CVE-2023-1579) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default mingw32-binutils-2.41-3.el9.s390x.rpm 0edbb04623435a7fd8c1fd90e79d3aaca29949bc0cfc3712ffb133de77c88548 mingw-binutils-generic-2.41-3.el9.s390x.rpm c0a6afc90882f594bf4da7d1b74958766dc1a40ca3b037408bca6e47966342e5 mingw64-binutils-2.41-3.el9.s390x.rpm e2cdde4deda19b7a47942d7542217bb8cb1c7c4dc91c897c17beb7b27858c056 ALSA-2024:2377 Copyright 2024 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default zziplib-devel-0.13.71-11.el9_4.s390x.rpm 04251345a83fb720606d5eceec63ff84b1fe5ef2134214e42411f4f417ef018d ALSA-2024:2394 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546) * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582) * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480) * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448) * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934) * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040) * kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531) * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931) * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023) * kernel: irdma: Improper access control (CVE-2023-25775) * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464) * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866) * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083) * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194) * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756) * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863) * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434) * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489) * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522) * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581) * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578) * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580) * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610) * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565) * kernel: tls: race between async notify and socket close (CVE-2024-26583) * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584) * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585) * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586) * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593) * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602) * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609) * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176) * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476) * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620) * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.13.1.el9_4.s390x.rpm 21b0ef353557882c3a2976c88e1925401fb5618e730ce782dde7626ba025919e kernel-cross-headers-5.14.0-427.13.1.el9_4.s390x.rpm a174e6680c7cdcceaf4bedd1d5d9636c93a33b616f2b4aa15255fbe1ced56201 ALSA-2024:2433 Copyright 2024 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469) * avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470) * avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471) * avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472) * avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default avahi-compat-libdns_sd-0.8-20.el9.s390x.rpm 36519353a282ca163fb8dbc617c43ac9ed99fc1f44060a03e17d97903cb59391 avahi-compat-howl-0.8-20.el9.s390x.rpm 37ba3700c1dd120dfafaf57bd170fb992f573d54d9c280b4ca57f308d0323e28 avahi-compat-libdns_sd-devel-0.8-20.el9.s390x.rpm a9d262530fd2a07226139885fa916295979dced285158b0aff28d0d8e136c8e0 avahi-glib-devel-0.8-20.el9.s390x.rpm c669583132c3aaa2cd0251f1c3e8a11a8b6a17f87929bde9447b032fd6abf035 avahi-compat-howl-devel-0.8-20.el9.s390x.rpm d5372d50a9f7490fba2ff8f1c96f389ce38df0fb323c6c27a45078b4f2452f73 avahi-devel-0.8-20.el9.s390x.rpm fc5518e3f11a0504fe8c44bc71eef01027a91001ee431b7c365122afa3054492 ALSA-2024:2512 Copyright 2024 AlmaLinux OS 0 1 Low

file security update

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Security Fix(es): * file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default file-devel-5.39-16.el9.s390x.rpm 8946435b2395b86393c330d3c109d164a14579cae8e0bb95b7cbfecf47cd015b ALSA-2024:2551 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) Bug Fix(es): * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default bind-devel-9.16.23-18.el9_4.1.s390x.rpm 71e539a68214a74173f6fe92fa60be3ec7c28400842101607565c6cd9019d742 bind-doc-9.16.23-18.el9_4.1.noarch.rpm f79829629665932a43bcf0575918edac6feb3858caced0cd6b7d9228d46c6ec4 ALSA-2024:2560 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security and bug fix update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441) * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() [almalinux-9] (JIRA:AlmaLinux-25081) * libvirt: negative g_new0 length can lead to unbounded memory allocation [almalinux-9] (JIRA:AlmaLinux-29515) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libvirt-devel-10.0.0-6.2.el9_4.alma.1.s390x.rpm 1ce6d9af7a26503ce907836cef03d031d989d5f5afd72d516925f8fb57288394 libvirt-docs-10.0.0-6.2.el9_4.alma.1.s390x.rpm 285b83061cbfae3adc11aca8406a99886da257ddabb100247a57045694414078 libvirt-daemon-plugin-sanlock-10.0.0-6.2.el9_4.alma.1.s390x.rpm b1d2ea14179e9838d8734f6453c73cfdb4b82a2c90a7e6b711739f8fa802ddad ALSA-2024:2571 Copyright 2024 AlmaLinux OS 0 1 Moderate

sssd security and bug fix update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758) Bug Fix(es): * socket leak (JIRA:AlmaLinux-22340) * Passkey cannot fall back to password (JIRA:AlmaLinux-28161) * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (JIRA:AlmaLinux-27209) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libsss_nss_idmap-devel-2.9.4-6.el9_4.s390x.rpm ce832588925084f7b2d342ff8893ce6138c921170fda0d1114bda83c0c133a25 ALSA-2024:2758 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240) * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-SN-3008,CVE-2024-25742,CVE-2024-25743) Bug Fix(es): * ffdhe* algortihms introduced in 0a2e5b909023 as .fips_allowed=1 lack pairwise consistency tests (JIRA:AlmaLinux-27009) * mm/mglru: fix underprotected page cache (JIRA:AlmaLinux-29235) * [EMR] [TBOOT OS] SUT could not go to S3 state with AlmaLinux 9.2 Tboot OS One CPU return -16 running BUSY (JIRA:AlmaLinux-29673) * system hangs completely - NMI not possible (JIRA:AlmaLinux-30678) * ice 0000:6f:00.0: PTP failed to get time (JIRA:AlmaLinux-30110) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.16.1.el9_4.s390x.rpm 0559ae2fe508e5a4cecc896540baebc1b60e79cb6e00984eaf57740b5fe67424 kernel-cross-headers-5.14.0-427.16.1.el9_4.s390x.rpm 6a283f0041149a6801884c22c90f3b5b35a78b645062fc0b84adb685fc67023e ALSA-2024:2842 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.105-1.el9_4.s390x.rpm 5af4400e0474925cd3661b30cc38af01c218f940c086fa8821a175d2740d5bbf ALSA-2024:2843 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.119 and .NET Runtime 7.0.19. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-7.0-source-built-artifacts-7.0.119-1.el9_4.s390x.rpm 7f88c9f1e140e77a561dba1e728b812e1680d5d04e30fec45173d9d15c2f34c8 ALSA-2024:3306 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.18.1.el9_4.s390x.rpm 36059fe4c160ae79f3bd04b43d44d76de980e962a58a6ddda304736720202a28 libperf-5.14.0-427.18.1.el9_4.s390x.rpm 8482f5fa3f3886fc56d8924ee4da441da2a5ba2825cbfb327521016c46187c2f ALSA-2024:3339 Copyright 2024 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (CVE-2024-2961) * glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599) * glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600) * glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601) * glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default nss_db-2.34-100.el9_4.2.s390x.rpm 3b2f0b957f4e27f7a4be55c911c2cce7a59bf57617e2c196228b61a4a6de9d0e glibc-static-2.34-100.el9_4.2.s390x.rpm 8d4a445cb8136aa663a229047698b93b8b6b390841a08847a9b5db10aff7786b nss_hesiod-2.34-100.el9_4.2.s390x.rpm 98daccbdd3411f75b3eec5dcca41b0b7dc3037f961820a23f164fe6f62ee4422 glibc-nss-devel-2.34-100.el9_4.2.s390x.rpm c92275f6a90280242e8a93b3d1ad481fc36055c542f1b2a3834507b3db20102c glibc-benchtests-2.34-100.el9_4.2.s390x.rpm e36a60002a56b1b0622fd06a580f34f5e6693bd7005dd90703640433bd7b9eff ALSA-2024:3501 Copyright 2024 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default nghttp2-1.43.0-5.el9_4.3.s390x.rpm 19cfd3cc6191ab58c8b9f92551a8b873ff10f25d15c1340da397b5bba8eb4788 libnghttp2-devel-1.43.0-5.el9_4.3.s390x.rpm 7b0730f815e8caf56e4bdefa91bac9ad33045154ada94229120759ed08b50a8d ALSA-2024:3619 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.20.1.el9_4.s390x.rpm 33b5defedba2c5b11a80f94cdff0074b65b2eb306c3ba26f7d9d80e0dceb2c38 libperf-5.14.0-427.20.1.el9_4.s390x.rpm 77c11b7fb291ee2660b2f4ad5fddeac35bf5bb912fae4e8aa9568ff95965f4ad ALSA-2024:3754 Copyright 2024 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVE-2024-2698) * freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVE-2024-3183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-ipatests-4.11.0-15.el9_4.alma.1.noarch.rpm 78a871b98a4d70c7e4965a260510e083551216826811b20ae35783e13bdd5fdd ALSA-2024:3837 Copyright 2024 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657) * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-8.el9_4.s390x.rpm 9d3cb10dc814d7e80e7ad5747c47f666e9cf259e110b460aabf7acb7bf951fd6 ALSA-2024:3838 Copyright 2024 AlmaLinux OS 0 1 Moderate

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0). (AlmaLinux-35740) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default ruby-doc-3.0.7-162.el9_4.noarch.rpm 08fa7f7a8c78fdb7c1bcc7a1c92de0956e0c4e18dc0c8953ef596a1a75bec22b ALSA-2024:3959 Copyright 2024 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default flatpak-devel-1.12.9-1.el9_4.s390x.rpm c5c3db2e7d85a7288b76553b8625181a06a257e4c3780815415b402968ac5704 ALSA-2024:3999 Copyright 2024 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: OPVP device arbitrary code execution via custom Driver library (CVE-2024-33871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libgs-devel-9.54.0-16.el9_4.s390x.rpm 1bcd4847fd20e6f108e876feafc640e40c4535252da121454d90d0fd31b9955a ALSA-2024:4077 Copyright 2024 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.1.s390x.rpm 56f13dcf5d2b2f4e2c70cf340f919738bafc4cf4fc9cfe695d39fa5f58133083 python3.11-test-3.11.7-1.el9_4.1.s390x.rpm 5f5e98c36a7e5d7f641dceaa320f264c9867c0a67a48687d285f94757b8eec4f python3.11-idle-3.11.7-1.el9_4.1.s390x.rpm b069c89111207ab1682191c282cd0316c18d17122c643d71f931561d20cd6a03 ALSA-2024:4078 Copyright 2024 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-debug-3.9.18-3.el9_4.1.s390x.rpm 24fe9dda92c94f42000d55763f7849b91168247fbf5dc2798694818a843c6fe4 python3-test-3.9.18-3.el9_4.1.s390x.rpm 3b9b4c91c0f2d0b0b37fcb4b6d800e3f5c9078b88a0a6c0d1c291c3a5cb05431 python3-idle-3.9.18-3.el9_4.1.s390x.rpm 884145416a485559d2404fef93576f2774e2ec8715fcf22bbe358f2a4c30f3ac ALSA-2024:4349 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801) * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974) * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393) * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667) * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870) * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960) * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400) Bug Fix(es): * cifs - kernel panic with cifs_put_smb_ses (JIRA:AlmaLinux-28943) * BUG: unable to handle page fault for address: ff16bf752f593ff8 [almalinux-9.4.z] (JIRA:AlmaLinux-35672) * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [almalinux-9.4.z] (JIRA:AlmaLinux-36220) * [AlmaLinux9] kernel BUG at lib/list_debug.c:51! [almalinux-9.4.z] (JIRA:AlmaLinux-36687) * ice: DPLL-related fixes [almalinux-9.4.z] (JIRA:AlmaLinux-36716) * CNB95: net/sched: update TC core to upstream v6.8 [almalinux-9.4.z] (JIRA:AlmaLinux-37641) * IPv6: SR: backport fixes from upstream [almalinux-9.4.z] (JIRA:AlmaLinux-37669) * [RFE] Backport tmpfs noswap mount option [almalinux-9.4.z] (JIRA:AlmaLinux-38252) * Isolated cores causing issues on latest AlmaLinux9.4 kernel and not functioning as desired. [almalinux-9.4.z] (JIRA:AlmaLinux-38595) * [ice] Add automatic VF reset on Tx MDD events [almalinux-9.4.z] (JIRA:AlmaLinux-39083) * [HPEMC AlmaLinux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [almalinux-9.4.z] (JIRA:AlmaLinux-34953) * bnx2x: fix crashes in PCI error handling, resource leaks [almalinux-9.4.z] (JIRA:AlmaLinux-43272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.24.1.el9_4.s390x.rpm 72a4fc7a83c969efbd85e94335a4bfe556dfc4528161a4d2a6e46bb22d32fba3 kernel-cross-headers-5.14.0-427.24.1.el9_4.s390x.rpm e5934fe93f2e8a841805b02eace35dd5cac77fcd03f9719744b5069aa59aeec8 ALSA-2024:4439 Copyright 2024 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.132 and Runtime 6.0.32. Security Fix(es): * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.132-1.el9_4.s390x.rpm 52a017aec3bb4912af0dddcefc40a6d531d7839483f578c132ce19950ebb0909 ALSA-2024:4450 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7. Security Fix(es): * dotnet: DoS in System.Text.Json (CVE-2024-30105) * dotnet: DoS in ASP.NET Core 8 (CVE-2024-35264) * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.107-1.el9_4.s390x.rpm 78db88777135e1ccd5be44e93554b8dee95472ef0b1647c589a251178357a117 ALSA-2024:4567 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-11-openjdk-src-slowdebug-11.0.24.0.8-2.el9.s390x.rpm 505e354c1d7113b89103c05062b4acde74b6872ffd86f845c61ce7951b0c2e0f java-11-openjdk-demo-slowdebug-11.0.24.0.8-2.el9.s390x.rpm 5c7928beaa26e4537d1aa51f357fe00863baeda76977bc0218d0e7eec07c6d83 java-11-openjdk-static-libs-slowdebug-11.0.24.0.8-2.el9.s390x.rpm b709b8a6bfc5704a9203e01886813957e18ae080775f3929fdfe1fd919860810 java-11-openjdk-slowdebug-11.0.24.0.8-2.el9.s390x.rpm b9eaf10be0080bd4b75ce386b659aa8a2decb62bf4549b2da6a73d4add728b29 java-11-openjdk-jmods-slowdebug-11.0.24.0.8-2.el9.s390x.rpm c5582cf5e8613db958df2f7e2a3d8a811e286b28506b060ea2e7735ef79b5ab4 java-11-openjdk-headless-slowdebug-11.0.24.0.8-2.el9.s390x.rpm cd871e4276ad9e0b80eec98b5b546ff228eb7a9cf08a48d25e1af1e31be60502 java-11-openjdk-devel-slowdebug-11.0.24.0.8-2.el9.s390x.rpm eebb065a897f6a2023291c2075ed698623a1f7c18045e927a6281152fa92cd7b ALSA-2024:4568 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-17-openjdk-demo-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 18b3a06e2356708dac5490b3745b5d9ac73719d1d5ba2925c690d7c90001b6d1 java-17-openjdk-static-libs-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 341f3b2f69b054c5ffc1aeaab4ab8c21f2341995fc4c34ecd0b639bbf7718b2c java-17-openjdk-headless-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 3a597c62d613de3f4fd23c4ac097776799ed275301e461623cc255593cb81b05 java-17-openjdk-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 4a9b988b4169613fc929c260d3888b0fd897b2ac663556a53498b0eae6258f93 java-17-openjdk-devel-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 52662dc6597bba8147e7e3a3bdd267577c9a8bd692e3523a57f7926a1ad77d0c java-17-openjdk-src-slowdebug-17.0.12.0.7-2.el9.s390x.rpm 577c63c84ff94db7303239c692129fddd996a49626df53ccc4dc9edab725e51a java-17-openjdk-jmods-slowdebug-17.0.12.0.7-2.el9.s390x.rpm f0a3988d094f6cebf14eb2a761c4b63f72c6c64c2a1bdd6f2df30d4928dd6598 ALSA-2024:4573 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-21-openjdk-src-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm 241fb0cf69c64365c54552515934e6b3e884902407732cc9f8696804aca1690e java-21-openjdk-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm 6ff7793d93d4d32de1fa90601db1f88bee28dd648fdb1d976460c3600212c8ad java-21-openjdk-devel-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm 920120466e848a802f1bf965fd1c5394bb6b987716066c4c66e9d48e4f05d0e1 java-21-openjdk-demo-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm 9aa29725145335ae7999dae3adfccfdf020e4b74fb58cfc55360d80f9493a191 java-21-openjdk-static-libs-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm d20859fbf88e28cd2eef4d813047e90263d27acd007cac4c931f0240ce92bcb3 java-21-openjdk-jmods-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm e40031ee5da99a6bdcc146a73a5fb5b01c25000cb71a22d8ca267a02affde183 java-21-openjdk-headless-slowdebug-21.0.4.0.7-1.el9.alma.1.s390x.rpm f60891f4941393b844909040fed8bf275e951a7d3af528f044660424b45a033d ALSA-2024:4583 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (CVE-2024-26858) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435) * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958) * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904) * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543) * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593) * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957) * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.26.1.el9_4.s390x.rpm 848c9a9cd9a571e592924b90fa8f44295c563e252acb69e9dd72ef3ec6247a53 kernel-cross-headers-5.14.0-427.26.1.el9_4.s390x.rpm 9c2f36a87be3bfac174c3fbc8527c5dc320d661fd7613c740b397d288928718c ALSA-2024:4623 Copyright 2024 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-10.el9_4.s390x.rpm 9ca9f36a9be356aab2094334ee06086fdd33aa51b0a15fc30ab9d9b07bf3823b ALSA-2024:4749 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default edk2-ovmf-20231122-6.el9_4.2.noarch.rpm 07ab65898528b14bd133dcc29037207a0575b113ba24d06b8ec9fb9a2740a4a8 edk2-aarch64-20231122-6.el9_4.2.noarch.rpm 9a5248396531529aa0a93ef15d4a30176a9c18dced35b724cbc45a4b1e0b3784 edk2-tools-doc-20231122-6.el9_4.2.noarch.rpm c756059b460fd70f02088389aa5bc06026f457801491df61042de96189563f25 ALSA-2024:4756 Copyright 2024 AlmaLinux OS 0 1 Moderate

libuv security update

libuv is a multi-platform support library with a focus on asynchronous I/O. Security Fix(es): * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libuv-devel-1.42.0-2.el9_4.s390x.rpm d5736a99625818827faba825d3a6fb42b2caffd50a63731115f9352d67212176 ALSA-2024:4757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: stack use-after-free in virNetClientIOEventLoop() (CVE-2024-4418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libvirt-daemon-plugin-sanlock-10.0.0-6.6.el9_4.alma.1.s390x.rpm 09d7b4c473aab4916c26bc64ea6570b6d59f8f6a27ed44959355a7e989963da1 libvirt-docs-10.0.0-6.6.el9_4.alma.1.s390x.rpm 40ab56b1209138eee043177480b39a2c0214dbfc06796918838e96f23de30a4f libvirt-devel-10.0.0-6.6.el9_4.alma.1.s390x.rpm e651edf307444dc850893dcd1dee2b935f9c9f659b7e4ba741f343e9713e8160 ALSA-2024:4766 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.3.s390x.rpm 04a23771100a0e30934ddaa1c7e843bfda32fb4c43fc00db8f3f7ffa709d92a2 python3.11-test-3.11.7-1.el9_4.3.s390x.rpm 3b523c6329249a84c6ae8286eb7c2301aaa672552df64bdaf715d8d7f10025a0 python3.11-idle-3.11.7-1.el9_4.3.s390x.rpm a12f831e498f31a6d7f9bb8ab576b6b697ffa865e7c8e24fae5670b04e3e8e00 ALSA-2024:4779 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.3.s390x.rpm 0e277c9552c53ff7a012b1f4cf82722387a9cc05c2c47113e0507865e2cee46a python3-test-3.9.18-3.el9_4.3.s390x.rpm f63778866cf40455803aca25311e91af0ce610ac6b6aff1312d87fbf19574955 python3-debug-3.9.18-3.el9_4.3.s390x.rpm fa6b035e5d309eb13767087e60144a36bb17abd4dae049842e1344717f966b2a ALSA-2024:4928 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458) * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773) * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737) * kernel: dm: call the resume method on internal suspend (CVE-2024-26880) * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852) * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) * kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046) * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030) * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857) * kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907) * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885) * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809) * kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459) * kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924) * kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952) * kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743) * kernel: epoll: be better about file lifetimes (CVE-2024-38580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.28.1.el9_4.s390x.rpm 104d66173fe54230ad353fc58828a153ddc52cee76c0be90e34faaa73de62e41 kernel-cross-headers-5.14.0-427.28.1.el9_4.s390x.rpm f31cbe3c9c46a09927d2ff9a71e06c09bffbfd005ecc240c416ba12cb2263669 ALSA-2024:4935 Copyright 2024 AlmaLinux OS 0 1 Important

freeradius security update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: forgery attack (CVE-2024-3596) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default freeradius-mysql-3.0.21-40.el9_4.s390x.rpm 3b078b4c432bc070adc98f102cf4b0d55113e45a1d36ff3700b7b93208cad216 freeradius-perl-3.0.21-40.el9_4.s390x.rpm 46f4582985044f490fda073681f9f318ea000152f292e629fe643b0efbbdb01c freeradius-postgresql-3.0.21-40.el9_4.s390x.rpm 56ade177d208dd19e707b748167d34b802542635e2c1c2c92638ae2767b51b9b freeradius-rest-3.0.21-40.el9_4.s390x.rpm 6986cb5aa07056479a15388c51512bad286a8e6e32d0352586811a8866b8d14a freeradius-unixODBC-3.0.21-40.el9_4.s390x.rpm ceac0ecb6aa91b7169748670cd27f70c980cc56c7c9d5a1f5a939639ec764cba freeradius-sqlite-3.0.21-40.el9_4.s390x.rpm d7dde466198e358e519cae8913c17172cf2337d72e9424bd03053f3c52b102de ALSA-2024:5192 Copyright 2024 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953) * 389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request (CVE-2024-6237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-9.el9_4.s390x.rpm 4840dd677ba9d8c550a50979970d78180da6b96b2b67349b07b4a4b408e0b710 ALSA-2024:5231 Copyright 2024 AlmaLinux OS 0 1 Important

bind and bind-dyndb-ldap security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam (CVE-2024-1737) * bind9: bind: SIG(0) can be used to exhaust CPU resources (CVE-2024-1975) * bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content (CVE-2024-4076) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default bind-doc-9.16.23-18.el9_4.6.noarch.rpm a5ec8a6da6cd1f20a2976b83bb6408fc04182069d72450b79a1f8eac28b51e2b bind-devel-9.16.23-18.el9_4.6.s390x.rpm c743261a6ea40ac4e7b5aba894990e8a59895e9858bd781b72a13dc97346530a ALSA-2024:5334 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.108 and .NET Runtime 8.0.8. Security Fix(es): * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.108-1.el9_4.s390x.rpm fe3cab0030854986cb4cf0af2a39f3c03fa59f5c6dd0b72d324f1e1f55ffb216 ALSA-2024:5363 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: phy: (CVE-2024-26600) * kernel: netfilter: multiple flaws (CVE-2024-26808, CVE-2024-27065, CVE-2024-35899, CVE-2024-36005) * kernel: cifs: (CVE-2024-26828) * kernel: wifi: multiple flaws (CVE-2024-26897, CVE-2024-27052, CVE-2024-27049, CVE-2023-52651, CVE-2024-35789, CVE-2024-27434, CVE-2024-35845, CVE-2024-35937, CVE-2024-36941, CVE-2024-36922, CVE-2024-36921, CVE-2024-38575) * kernel: nfs: (CVE-2024-26868) * kernel: igc: (CVE-2024-26853) * kernel: dmaengine/idxd: (CVE-2024-21823) * kernel: ipv6: multiple flaws (CVE-2024-27417, CVE-2024-35969, CVE-2024-36903, CVE-2024-40961) * kernel: vt: (CVE-2024-35823) * kernel: efi: (CVE-2024-35800) * kernel: mlxsw: (CVE-2024-35852) * kernel: eeprom: (CVE-2024-35848) * kernel: ice: (CVE-2024-35911) * kernel: platform/x86: (CVE-2023-52864) * kernel: i40e: (CVE-2024-36020) * kernel: rtnetlink: (CVE-2024-36017) * kernel: net: multiple flaws (CVE-2024-36929, CVE-2024-36971, CVE-2021-47606, CVE-2024-38558, CVE-2024-40928, CVE-2024-40954) * kernel: ipvlan: (CVE-2024-33621) * kernel: tcp: (CVE-2024-37356) * kernel: virtio: (CVE-2024-37353) * kernel: tls: (CVE-2024-36489) * kernel: cxl/region: (CVE-2024-38391) * kernel: bonding: (CVE-2024-39487) * kernel: netns: (CVE-2024-40958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.31.1.el9_4.s390x.rpm 62eed94375dc2475a1fb6efc0b1693bb0c6c7355a74937b9602f4073da173ed7 kernel-cross-headers-5.14.0-427.31.1.el9_4.s390x.rpm 74ce356e73f31c912e4b3483c4d96cd2d012d7c8f4db87d0da0bbd3f266db146 ALSA-2024:5533 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12-setuptools security update

Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.12-setuptools-wheel-68.2.2-3.el9_4.1.noarch.rpm 131b0a0f2d74e9412a6cc9f472ba83b59d41a1569d92fe31ea3e11e061212f48 ALSA-2024:5928 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nftables: nft_set_rbtree skip end interval element from gc (CVE-2024-26581) * kernel: netfilter: nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) * kernel: vfio/pci: Lock external INTx masking ops (CVE-2024-26810) * kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CVE-2024-26855) * kernel: x86/xen: Add some null pointer checking to smp.c (CVE-2024-26908) * kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (CVE-2024-26925) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019) * kernel: netfilter: flowtable: validate pppoe header (CVE-2024-27016) * kernel: netfilter: bridge: confirm multicast packets before passing them up the stack (CVE-2024-27415) * kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898) * kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897) * kernel: netfilter: validate user input for expected length (CVE-2024-35896) * kernel: netfilter: complete validation of user input (CVE-2024-35962) * kernel: ice: fix LAG and VF lock dependency in ice_reset_vf() (CVE-2024-36003) * kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race (CVE-2023-52771) * kernel: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (CVE-2023-52880) * kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (CVE-2024-36025) * kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608) * kernel: crypto: bcm - Fix pointer arithmetic (CVE-2024-38579) * kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (CVE-2024-38544) * kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540) * kernel: net: bridge: xmit: make sure we have at least eth header len bytes (CVE-2024-38538) * kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (CVE-2024-39476) * kernel: ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905) * kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station (CVE-2024-40911) * kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CVE-2024-40912) * kernel: mm/huge_memory: don&#39;t unpoison huge_zero_folio (CVE-2024-40914) * kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CVE-2024-40929) * kernel: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (CVE-2024-40939) * kernel: wifi: iwlwifi: mvm: don&#39;t read past the mfuart notifcation (CVE-2024-40941) * kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957) * kernel: scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978) * kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983) * kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090) * kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091) * kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041) * kernel: NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076) * kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (CVE-2024-42110) * kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.33.1.el9_4.s390x.rpm 0e3ca02fab428e23d0138e609f0fe6246d2ca427c9f2568d59b9774742d18b1e libperf-5.14.0-427.33.1.el9_4.s390x.rpm 3aada235114a35439c19b1fcc993d56032258244fa1207abbd0033f8e17a86f3 ALSA-2024:5999 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default postgresql-test-13.16-1.el9_4.s390x.rpm 05f0595e9163cc1548304cfd65ddeb18a1e3d3b42f04b2702bbe6bad8a622877 postgresql-docs-13.16-1.el9_4.s390x.rpm 6e98dec91ff15abaae71debc6149cb5ab5089c2c6022523bd2df325cbfc00f0e postgresql-private-devel-13.16-1.el9_4.s390x.rpm 7c0e744a935f72cfd46d6f2879c311a265bf45aaf00aa4d0e801881b686db478 postgresql-upgrade-devel-13.16-1.el9_4.s390x.rpm 7cbe62b59ed1b0e66d9a086cce98b58b84b9892a0b6c5f301fde6e735e2f0551 postgresql-server-devel-13.16-1.el9_4.s390x.rpm aec8ba77bbb03daa1fc7ce39f2bb1eba8d3f9e069c1b92f78a9ca88e0d37fe84 postgresql-static-13.16-1.el9_4.s390x.rpm ce20a5149c9b630c75ed5b7f9293ff3c871757ed82555dcb39d364a7f0df69af ALSA-2024:6146 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.12-debug-3.12.1-4.el9_4.3.s390x.rpm 057ef4b248a4b9b360412a5b3520836fb8c53e414d5a11bc407948fd95299354 python3.12-idle-3.12.1-4.el9_4.3.s390x.rpm 7f830497c0a21c0089f179ffdd85fc717f313fcf133bf475cd3fed789e99c68d python3.12-test-3.12.1-4.el9_4.3.s390x.rpm d36a6b1f2f56a90ad82dab589d181f5e29e7e2bfad283343313465b9231bea12 ALSA-2024:6163 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.5.s390x.rpm 9988e6b052409383b0325fb0bdf368f8e66cb711b44e9121913aea5408ca9d2d python3-debug-3.9.18-3.el9_4.5.s390x.rpm 99bc8b8dc724f67b9f6c9eb856839ac19302e18d2ce44ba0a512c3e86a77911c python3-test-3.9.18-3.el9_4.5.s390x.rpm a9bed5681549754f2c760bb77ae59a5b7447da23412471acfe4285c49759c4b8 ALSA-2024:6179 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-idle-3.11.7-1.el9_4.5.s390x.rpm 1f7ce3163145944be7220d75d67291ad4dbb8c8a4216d688fa70c20129c4b9fc python3.11-test-3.11.7-1.el9_4.5.s390x.rpm 368830eaaa810e1e47dd8c1f3699ed7b4e3b7cca9e07bad23703349d21d1ca54 python3.11-debug-3.11.7-1.el9_4.5.s390x.rpm ebee4587ff0ff815f95f6dd85a85260fbec29b1dae6c292aed621a9b5636d16a ALSA-2024:6197 Copyright 2024 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: format string injection leads to shell command execution (SAFER bypass) (CVE-2024-29510) * ghostscript: path traversal and command execution due to path reduction (CVE-2024-33869) * ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths (CVE-2024-33870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libgs-devel-9.54.0-17.el9_4.s390x.rpm 868b43f8b1538f7083293f336d20695baacd49810e79cd41983170beb8ff1610 ALSA-2024:6356 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default flatpak-devel-1.12.9-3.el9_4.s390x.rpm de78ab298f6f8bac40874e1cc8e7ac8b867105e881f0baeafb5c118a646e11c6 ALSA-2024:6464 Copyright 2024 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default glib2-static-2.68.4-14.el9_4.1.s390x.rpm 206170d6dd9dcb4eb5f152da4c42a8a12a20c5ce9e7a6353f4645a2529bc3c24 ALSA-2024:6529 Copyright 2024 AlmaLinux OS 0 1 Moderate

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dovecot-devel-2.3.16-11.el9_4.1.s390x.rpm 6fba7c12a902532f5116b61b3f905de2bbf7701b8041631129af2f1d26ed7c62 ALSA-2024:6567 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) * kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886) * kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946) * kernel: KVM: SVM: Flush pages under kvm-&gt;lock to fix UAF in svm_register_enc_region() (CVE-2024-35791) * kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797) * kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875) * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000) * kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801) * kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883) * kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019) * kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) * kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979) * kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) * kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927) * kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936) * kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040) * kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096) * kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082) * kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096) * kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34; (CVE-2024-42102) * kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131) * kernel: nvme: avoid double free special payload (CVE-2024-41073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.35.1.el9_4.s390x.rpm 28432c673b48ecebe1137a72b276fa8eae6a8f79b6002def889b9e3b2ee2b91e libperf-5.14.0-427.35.1.el9_4.s390x.rpm 4b042db0abed48fb06b932d982aecc5aa18300bbe6ac91eca968a8c1cc102c86 ALSA-2024:6757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: NBD server improper certificate validation (CVE-2024-7383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libnbd-devel-1.18.1-4.el9_4.s390x.rpm 15cb96647b33f28232aed07a8fd75ce23fffc8b6ead18abfe450ed6d01dc5939 ocaml-libnbd-devel-1.18.1-4.el9_4.s390x.rpm c8e5af630554d99f397212928a9ab3276af233f024bb607c8f462b4ffe791a54 ocaml-libnbd-1.18.1-4.el9_4.s390x.rpm d496c61022b89d9189303dccfbdf415a1c6dcebbb93d1018dafd60eb1e521171 ALSA-2024:6997 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439) * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739) * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947) * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931) * kernel: scsi: qla2xxx: Fix double free of the ha-&gt;vp_map pointer (CVE-2024-26930) * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929) * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022) * kernel: KVM: x86/mmu: x86: Don&#39;t overflow lpage_info when checking attributes (CVE-2024-26991) * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895) * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899) * kernel: cpufreq: exit() callback is optional (CVE-2024-38615) * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601) * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573) * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570) * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562) * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884) * kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; (CVE-2024-40984) * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071) * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225) * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.37.1.el9_4.s390x.rpm 0e38dc943f66a13185d2d0e86e0124ac3cb2b25404de4ed89929325c1ce927a6 libperf-5.14.0-427.37.1.el9_4.s390x.rpm 5a0083bc5be5c555f5990bc586c6263e68dd4743c820d6af8abc60b3cd28d09c ALSA-2024:7346 Copyright 2024 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source () * cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes (CVE-2024-47076) * cups: libppd: remote command injection via attacker controlled data in PPD file () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default cups-filters-devel-1.28.7-17.el9_4.s390x.rpm 4e5792788e56dccaf1358c931e8c1d4b1582c5eb30ffad8528567216f7473b67 ALSA-2024:7867 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35. Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.135-1.el9_4.s390x.rpm 5b3d39438609cbee9ee900deae681b6968635ae755194b045046ad3075f51705 ALSA-2024:7869 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.110 and .NET Runtime 8.0.10. Security Fix(es): * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.110-1.el9_4.s390x.rpm 3b46039dcae9f02ab563bbda59287085ffe2e5bbc840eeec30c03d1f4227e178 ALSA-2024:8037 Copyright 2024 AlmaLinux OS 0 1 Moderate

OpenIPMI security update

The OpenIPMI packages provide command-line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. Security Fix(es): * openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator (CVE-2024-42934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default OpenIPMI-devel-2.0.32-5.el9_4.s390x.rpm 757d5a5688a12fe873c20369cfbb6d99f53a1f422cbcd6777ca988be215b5136 ALSA-2024:8121 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-11-openjdk-jmods-slowdebug-11.0.25.0.9-2.el9.s390x.rpm 3ea2bcb72c22d1887c55bbe1524c2374dab83c3ee6f4dbb06a5481e08814617a java-11-openjdk-slowdebug-11.0.25.0.9-2.el9.s390x.rpm 61238ec111914158006268d078ee9079b7410a292dcd9d6631767d18e055cdfb java-11-openjdk-headless-slowdebug-11.0.25.0.9-2.el9.s390x.rpm 617a20ca2d86c01c01b54c0d51154b8d7ad496815218ad8680c6b2f7ef4bd156 java-11-openjdk-src-slowdebug-11.0.25.0.9-2.el9.s390x.rpm 8d70fb968685e04e337b21943a42990ef15d30dad51aa5fd7a6bd439bbe2fe66 java-11-openjdk-static-libs-slowdebug-11.0.25.0.9-2.el9.s390x.rpm 936739ecc51c9e711e65661f8d5b70107fdfdcae088a38041aa0ca009c2af5b4 java-11-openjdk-demo-slowdebug-11.0.25.0.9-2.el9.s390x.rpm a1b5f372a7ceffac7c1aed75bd95df0ea63d6b5113cd299c220277e5e4dccd72 java-11-openjdk-devel-slowdebug-11.0.25.0.9-2.el9.s390x.rpm dbd6bae8e37053a3e17a200d394633534be33b453a4a34b8282204a048a95681 ALSA-2024:8124 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-17-openjdk-headless-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 08e27b480d3fdb8a7b29db83103e8d4b9776cff08ce3d3db0c2523776d02f948 java-17-openjdk-src-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 0ab32af9cbf4ac655c39f37c5240e34c47d8d21be05a392e3ec6cef5091fbd85 java-17-openjdk-jmods-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 4023225da7dc61d829c46142a202d856eec48df9da4d2a6ce2fe4f7862b412e3 java-17-openjdk-static-libs-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 43fc27dd08127ca1ac843774e8f3a244f9ae3723608278cc8b74b5b4131d30ca java-17-openjdk-demo-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 48d34042714f3687c900d816023e1f5aa75007476e77f6cf2e79fdae43965f85 java-17-openjdk-devel-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm 4ec478cd996c0ce8ffd297310e65a65a4736fc971680421334c46023b3435087 java-17-openjdk-slowdebug-17.0.13.0.11-3.el9.alma.1.s390x.rpm ec01152d95ef13e189487f38d799bdb1d1b039ecd36c827640fa33790a43d124 ALSA-2024:8127 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 runtime environment. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default java-21-openjdk-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 21deac5fcc7a7935a8ab3e2043a117d84533ce1a56004b4be19a4bc9fcd04799 java-21-openjdk-src-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 34621334bf49e6efc59d5b7df0659c2c4db2258ee68131d3bfa77253166fa1f0 java-21-openjdk-devel-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 47ab33c662e4a1fd37a5f2ba449c21b0d4ba88f70988db66fbd796202b96723e java-21-openjdk-headless-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 65b5ed3f3548b6df70acfeade10c671a0fa4bb37f28eaf42635f92912e1b9279 java-21-openjdk-jmods-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 7b8494fd2294d14f32215fc694edd79d9a8b15bd3c0dc47243ca17730289c904 java-21-openjdk-demo-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm 9ea9f871fa123821e67b2c7392cb980f47a9b61cda7a7fe1b51acbc1afb2c6b8 java-21-openjdk-static-libs-slowdebug-21.0.5.0.10-3.el9.alma.1.s390x.rpm cd58a30c5141423d22c656d15c7a563f207c6c04f9fbda03ef72eefe11b1a149 ALSA-2024:8162 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Local information disclosure on Intel(R) Atom(R) processors (CVE-2023-28746) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34; (CVE-2023-52658) * kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989) * kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47385) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) * kernel: net/mlx5: Add a timeout to acquire the command queue semaphore (CVE-2024-38556) * kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVE-2024-39483) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959) * kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079) * kernel: sched: act_ct: take care of padding in struct zones_ht_key (CVE-2024-42272) * kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.40.1.el9_4.s390x.rpm 3c70aa06ad6248fdd59121f87fc70ee11fe5a0eb6fa8ff76874bfca62b27f490 kernel-cross-headers-5.14.0-427.40.1.el9_4.s390x.rpm 8b17c8ac109f5b2b6bf354aabb7d96d0c1cfb2b29395af80df245b89b87b0b12 ALSA-2024:8374 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.6.s390x.rpm 22bee12d76867a589c7824ab66923f952046ed85befe5af59291c0745350e192 python3.11-test-3.11.7-1.el9_4.6.s390x.rpm 770ac9e78f8340e07c37090df2f9db9d4a71ad3e264aaf92a317a3e43b555df5 python3.11-idle-3.11.7-1.el9_4.6.s390x.rpm aed55e27432aad43ffe95def344bae22f8f69bdbe871b8329f2576d6e0f56dc6 ALSA-2024:8446 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.6.s390x.rpm b2dea5b3669fe7bb4e2828f25e414c8451adf8241e655679889d6ee74ddcefa4 python3-debug-3.9.18-3.el9_4.6.s390x.rpm dcccba2fc8fc2cfd62afe0a35f0da510a1c35ed45b9bbc6ae31e7652f72b8c7f python3-test-3.9.18-3.el9_4.6.s390x.rpm dd331f57e41cfa14aa4c059dfdf76d2db9c477398b303840815a3d525d08a8e2 ALSA-2024:8447 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.12-idle-3.12.1-4.el9_4.4.s390x.rpm 1aaa933886745123ce6aa63fcc6ee6dde7bf76a1d3d4f1d70ade4891e1d04678 python3.12-test-3.12.1-4.el9_4.4.s390x.rpm 7e8213eaa767c6d15b0f26cc7e153979dc0f6718c502c0400136e1640ff111a5 python3.12-debug-3.12.1-4.el9_4.4.s390x.rpm eccbfeee396946651105127a029f38edf34e0779454f727195f684fba1f977b0 ALSA-2024:8617 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923) * kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961) * kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935) * kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383) * kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244) * kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472) * kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504) * kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904) * kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931) * kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960) * kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972) * kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977) * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995) * kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() (CVE-2024-40998) * kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005) * kernel: xfs: don&#39;t walk off the end of a directory data block (CVE-2024-41013) * kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libperf-5.14.0-427.42.1.el9_4.s390x.rpm 3a786c4e9aa00cb70f66ea11ccc7d76ebae950d6ef42084641fbbf07e37609de kernel-cross-headers-5.14.0-427.42.1.el9_4.s390x.rpm 909d28c769bc52d55991658d8aebda21e66d77af304a0c2ee7ed7d70e7b979b1 ALSA-2024:8800 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_4.1.s390x.rpm 60f71126eedcadbc59f0b48720f4683f7b9750a023e22700673de8baf69deb5d ALSA-2024:8914 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9_4.1.s390x.rpm b4bb2f5e0699d723e0ac8ba0609ee7445d30fe8246845693af0ac53b9b3f33f6 ALSA-2024:8935 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default edk2-aarch64-20231122-6.el9_4.4.noarch.rpm 6ead2d3429f2753faeac142fafcbdb556ed7e654686566cc8c3c51d6d0443a73 edk2-tools-doc-20231122-6.el9_4.4.noarch.rpm ba46cd872396c59af904379ce10005c4a600251e4545cdf711095752271afbd0 edk2-ovmf-20231122-6.el9_4.4.noarch.rpm f240e4196ec775d8927b7347b3954c802adec030b855c4acc8bda3228f24530f ALSA-2024:9093 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default xorg-x11-server-Xwayland-devel-23.2.7-1.el9.s390x.rpm d5e6c9aef66edbffc6049aac2412bf11efccfa31e52af7455ffe7fca5c4f13f9 ALSA-2024:9122 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-26.el9.noarch.rpm 04014f59feac5b00a0590cbb6cacb7c373f1b5fc9e24cb3e7ba498b0e97163f9 xorg-x11-server-devel-1.20.11-26.el9.s390x.rpm f6ef287282cde791a90e7131286804b34e6ccc7869d8cf93c1ec210255ddd8f5 ALSA-2024:9128 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Crash of virtinterfaced via virConnectListInterfaces() (CVE-2024-8235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libvirt-daemon-plugin-sanlock-10.5.0-7.el9_5.alma.1.s390x.rpm 213329d239487fa0c3c8862c24684fc6087ae544a6424a0c6679a19dbc84dc75 libvirt-docs-10.5.0-7.el9_5.alma.1.s390x.rpm 3c0fe4a3dc2ba32e91d16acc9beb5ac2551ec078f85d5bc674273b2fb693abd9 libvirt-devel-10.5.0-7.el9_5.alma.1.s390x.rpm c303d51f53e2613a781071ccd7f73dc1662df9b7f26785284e19149b0b10738d ALSA-2024:9167 Copyright 2024 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default poppler-glib-devel-21.01.0-21.el9.s390x.rpm 3936f44ba460ca9bc8ccaaea504b86ed5830b4e35fc9726271a52716f7c4323c poppler-devel-21.01.0-21.el9.s390x.rpm 44818f034a0fc067683b6e00437725c14f54ad76f0be2defaa15378a22c9b5d2 poppler-glib-doc-21.01.0-21.el9.noarch.rpm a61fb4d179262e8f7b527744c120382860ebb8da6f1f7d37d23fde01e3e82987 poppler-qt5-devel-21.01.0-21.el9.s390x.rpm a93bfb15d1dd08f2e44ddcc52fea6c2737b9b5814f2a4cf85d8333606bcc1fad poppler-cpp-devel-21.01.0-21.el9.s390x.rpm b9b257d6a839942831fa99e798684e5fb1b073ac782730efd69c61d7b7eb675a ALSA-2024:9181 Copyright 2024 AlmaLinux OS 0 1 Moderate

jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * jose: resource exhaustion (CVE-2024-28176) * jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libjose-devel-14-1.el9.s390x.rpm 5dc81a134979aaf9d863b9eff5c7ded16a4b216c05d95e3aea5a8acb2355b675 ALSA-2024:9184 Copyright 2024 AlmaLinux OS 0 1 Moderate

gtk3 security update

The GTK+ library provides a multi-platform toolkit for creating graphical user interfaces. The gtk3 packages contain GTK+ version 3. Security Fix(es): * gtk3: gtk2: Library injection from CWD (CVE-2024-6655) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default gtk3-devel-docs-3.24.31-5.el9.s390x.rpm 8fbd65d8d737b838fcc77f9f803b60c8ce07517dccf17cd4f7530c13c54212d1 ALSA-2024:9187 Copyright 2024 AlmaLinux OS 0 1 Low

bcc security update

BPF Compiler Collection (BCC) is a toolkit for easier creation of efficient kernel tracing and manipulation programs. BCC uses the extended Berkeley Packet Filter (eBPF) tool. Security Fix(es): * bcc: unprivileged users can force loading of compromised linux headers (CVE-2024-2314) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default bcc-devel-0.30.0-6.el9.s390x.rpm 3958b07bc3d68a84cd7a6853ccd9de99a27799a4729312738344f67c282a73c8 bcc-doc-0.30.0-6.el9.noarch.rpm bfa0e15890e368fcde724436ef7855beb8037f5b9570b22facd5dbaf178346b0 ALSA-2024:9190 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.12-debug-3.12.5-2.el9.s390x.rpm 0e90638c1f03e02547321b305d1eaaf2e628c2320cc91d3996442406b2ae5fcd python3.12-test-3.12.5-2.el9.s390x.rpm 771e17bc4c37b1d61569eb903ec78d82da4407b9fbe6570c55370fedcce6f09b python3.12-idle-3.12.5-2.el9.s390x.rpm f1eb92f1931eab26535318cd7610485ad686a6b8f8fe6f99db3ebd9a8d67b72d ALSA-2024:9192 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-idle-3.11.9-7.el9.s390x.rpm 339c2c37d72f70188d64a36b14e19f7cf4982ea9ed789a0e2a1e9dcde726bfc6 python3.11-debug-3.11.9-7.el9.s390x.rpm 9543f2ec9560048c913edf16927c1d5e5ed68d033cf5b52d03694427a2a23946 python3.11-test-3.11.9-7.el9.s390x.rpm f13409388df2814a83e7c0e039f62858927389fe9667db75fbced6f91e8ecde7 ALSA-2024:9317 Copyright 2024 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: Denial of Service (CVE-2024-6501) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default NetworkManager-libnm-devel-1.48.10-2.el9_5.alma.1.s390x.rpm 610382eda9eb7565631fcfc7f46ad716a0a712cfe31384f28756a5ec0b63cb73 ALSA-2024:9371 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-idle-3.9.19-8.el9.s390x.rpm 2d4f95389dd7ccbdf7acf2c181f366ebd02fbb022ba0b2286e9d062ee105d805 python3-debug-3.9.19-8.el9.s390x.rpm 4f303e895bc06f7aac6e18e9583ab872fbc5ba55bd992b615e2171aeb65241d3 python3-test-3.9.19-8.el9.s390x.rpm 63ce2797152ba59668a641545058ad2f36d15501bfd39fee448bb3a17d3a43f9 ALSA-2024:9413 Copyright 2024 AlmaLinux OS 0 1 Moderate

bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files. Security Fix(es): * bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default bluez-libs-devel-5.72-2.el9.s390x.rpm 76ddbac006ca360de5c0aee9d3b32f358b2fe39c9e34c127f6639cb6bd6dc9d4 ALSA-2024:9439 Copyright 2024 AlmaLinux OS 0 1 Moderate

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082) * fontforge: command injection via crafted filenames (CVE-2024-25081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default fontforge-20201107-6.el9.s390x.rpm f282e4142f9e64540475d754ae3bed76845a102c5ab8e20dbf6b7044ba05e645 ALSA-2024:9449 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default flatpak-devel-1.12.9-3.el9_5.s390x.rpm 9e985726a1f0d54568495fa4ec69f3f5f08a5517d2b30daba97a847081c18f77 ALSA-2024:9450 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.11-idle-3.11.9-7.el9_5.1.s390x.rpm 3197015bc351d05417368f1ed2dee9ea9dfe69f7aac7d9df33672ad4e1959f40 python3.11-debug-3.11.9-7.el9_5.1.s390x.rpm ccb5cd2a906a03be6b03d0e705db90b00bcb72389111eb20887c0198ba1dcc25 python3.11-test-3.11.9-7.el9_5.1.s390x.rpm db132c84c937833b07e138af6c26b0c5cad8e8eddf6a55192edce4accf8a9453 ALSA-2024:9451 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3.12-test-3.12.5-2.el9_5.1.s390x.rpm 879d4da0fc6571c4d5e0b5d130756bec95f08167dd5694bf63f5157383d99fef python3.12-debug-3.12.5-2.el9_5.1.s390x.rpm 924b0ed7f376d12f24798ee25aa09c3b5b228154372b663a1abd757319858d05 python3.12-idle-3.12.5-2.el9_5.1.s390x.rpm e613eb312adba104131307d85ba1555871ed610bfabb185f8958708ffa34a0d6 ALSA-2024:9468 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default python3-debug-3.9.19-8.el9_5.1.s390x.rpm 07e394a5bd88738a56de1bf57a402a509d4174b0d216dc6ac42bec2aae74f767 python3-idle-3.9.19-8.el9_5.1.s390x.rpm d4eacf8cd0171c4fbf1c60fa508cfa67ede2dcb4f82aac2453ceae8772b035f8 python3-test-3.9.19-8.el9_5.1.s390x.rpm f65423d2d73a108271a50b3b5eb4bec68dd0cbd7110606f53bf973f8f82daf2f ALSA-2024:9543 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.100 and .NET Runtime 9.0.1.0. Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default dotnet-sdk-9.0-source-built-artifacts-9.0.100-1.el9_5.s390x.rpm 06ec1afb3477f8a1160fd74681f449c4f18dc6120d45ef79a9adab495a410dee ALSA-2024:9548 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_5.1.s390x.rpm 9f48e1a33828904b4dea9b8b8a2788f77f4c6cc55864fcb287c7d8bc63b4f6e9 ALSA-2024:9605 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283) * kernel: iommufd: Require drivers to supply the cache_invalidate_user ops (CVE-2024-46824) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default kernel-cross-headers-5.14.0-503.14.1.el9_5.s390x.rpm 39e7c76a180342c266488aa3c72360c2899cfc6102ab3168c7d98d073c01b61d libperf-5.14.0-503.14.1.el9_5.s390x.rpm 5f6b9fecabc47a0d03176335b6bf9ae9a53aa1562aaecbd6d662fc1748b7abae ALSA-2024:9827 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_4_default libvpx-devel-1.9.0-8.el9_5.s390x.rpm 4106cdf068bbde446492f2ddc7479a294550b5897327d554e0aaeb05e7fc1d90 ALSA-2025:0059 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: perf/aux: Fix AUX buffer serialization (CVE-2024-46713) * kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (CVE-2024-50208) * kernel: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CVE-2024-50252) * kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (CVE-2024-53122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.21.1.el9_5.s390x.rpm 631370b878793d2e7aa846eddd650d15f622b35e617101d1dae27fa97912cb06 libperf-5.14.0-503.21.1.el9_5.s390x.rpm b8b94566ae7aff0f2eb64cd78e526f2ca9b076f5e1c2973b5008349f7bc674cf ALSA-2025:0312 Copyright 2025 AlmaLinux OS 0 1 Important

raptor2 security update

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default raptor2-devel-2.0.15-32.el9_5.s390x.rpm f62d3142c26cb45518608dc136f64a55b40ed320e02439900fbeba80235608a4 ALSA-2025:0334 Copyright 2025 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: Administrative user data leaked through systemd journal (CVE-2024-11029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3-ipatests-4.12.2-1.el9_5.3.noarch.rpm 63c9534df50cf8bcb1e19b77e31e903b15a1c98caad904dce2fa4fe6deeae352 ALSA-2025:0377 Copyright 2025 AlmaLinux OS 0 1 Moderate

Security and bug fixes for NetworkManager

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security and bug fix(es): * Routes in table different to main are not deleted on reapply [almalinux-9.5.z] (JIRA:AlmaLinux-73013) * Route to VPN server not stored in routing table that is specified by ipv4.route-table [almalinux-9.5.z] (JIRA:AlmaLinux-73166) * VPN connections do not support ipv4.routing-rules settings [almalinux-9.5.z] (JIRA:AlmaLinux-73167) * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic [almalinux-9.5.z] (JIRA:AlmaLinux-64726) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default NetworkManager-libnm-devel-1.48.10-5.el9_5.s390x.rpm ac4488b8ba7f050738f7a99d7524a5255329223266a894fd281450e07a8c42b7 ALSA-2025:0422 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update for AlmaLinux 8.6, 8.8, 8.10, 9.4 and 9.5

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) Bug Fix(es): * The AlmaLinux OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later AlmaLinux versions (AlmaLinux-73867, AlmaLinux-73871, AlmaLinux-73872). For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default java-17-openjdk-devel-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm 10ff4c65d6a95c5c2019edabd6fec03ccf28c404d1028af0d1cffc7bee3db792 java-17-openjdk-static-libs-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm 159f43127207b707839bd617607380988dd0e38fa84858355ebee0779e8b53b8 java-17-openjdk-src-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm 861a55963fd4bfe7f1a514e2cfb65f15ca190b18e2800a42f514e6e5d9b3a865 java-17-openjdk-jmods-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm af283db3b2f2cb7a6710991a79d4a8643e400a2a9577a59c110f5f82e667782a java-17-openjdk-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm b60c86ac1712dede9ec7f2c93d8678e5ab4abac1a1f8099b426c944947f759cd java-17-openjdk-demo-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm c0f49e295a504e8e210665b99df11fa38c640f90afa47972b6a075b9cab6db2e java-17-openjdk-headless-slowdebug-17.0.14.0.7-2.el9.alma.1.s390x.rpm cef13bf563b7d883c016a71f739ae89ebf6fde7083da742fb221fb212c977123 ALSA-2025:0426 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update for AlmaLinux 8.10, 9.4 and 9.5

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default java-21-openjdk-jmods-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm 05166e96bfe9d0763068726d0c04d04ef913c818d03eb8a73324841ca8c77ab2 java-21-openjdk-devel-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm 2a800fef1a79c8aa35b594f6825b0ef2b91003ddeda5cb218151907ab326dbf6 java-21-openjdk-static-libs-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm 52ed0f0c2a9044b6b75f8ab7d6c13a75b4d42e6f136743932e51f849ec75120d java-21-openjdk-headless-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm 534eda7b4fa4a06a6222cc3aec0a87cf7ddc63e48bcc9093b17e63a033618802 java-21-openjdk-demo-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm c4874a48bf48c154850d647621c2757813428359d0f8788bd850e51f7b7a1f30 java-21-openjdk-src-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm c608862babcf77c7f28fe43e569a625435b2c9387512200a379cc963ef5eff1c java-21-openjdk-slowdebug-21.0.6.0.7-1.el9.alma.1.s390x.rpm e090ad526259e3ef022e47979e23ae0e074ca5549ef55955e141753fdeeaf897 ALSA-2025:0578 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp/dccp: Don&#39;t use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154) * kernel: arm64/sve: Discard stale CPU state when handling SVE traps (CVE-2024-50275) * kernel: i40e: fix race condition by adding filter's intermediate sync state (CVE-2024-53088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.22.1.el9_5.s390x.rpm 3a1162333b3dd922dba5d4028d6f9a8c2b6aa187ccddce6e888d74a2a8352958 kernel-cross-headers-5.14.0-503.22.1.el9_5.s390x.rpm cb85f046c0525d74b0f25c4e2d275f556a84cb5f4ce9244eb8dcb07c420318b7 ALSA-2025:0914 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22084) * mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024) (CVE-2024-21096) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default mariadb-embedded-devel-10.5.27-1.el9_5.s390x.rpm 0d38cb70e0139b64e133eb1fed2116635df1a7a80707df3a5e4cea44e0efae66 mariadb-test-10.5.27-1.el9_5.s390x.rpm 550b41019062db99bb479560313d643c4e002f36d2f59fe697a95ec2bcda16ec mariadb-devel-10.5.27-1.el9_5.s390x.rpm ae0fe22137527d193b5d950ce9ffc481389c58a6a0e6e1c94590174116db2030 ALSA-2025:0936 Copyright 2025 AlmaLinux OS 0 1 Moderate

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default mingw32-glib2-2.78.6-2.el9.noarch.rpm 128871448c9b21e7438cc3cd483f74cabf6ad09cafb61734200e78dde1ff505f mingw32-glib2-static-2.78.6-2.el9.noarch.rpm 14c2bcca8f6ae2d21d055d6512d0ab1fa9240841b82a53c8867c02309045b42c mingw64-glib2-static-2.78.6-2.el9.noarch.rpm 80af2ec3a3e874c32f2aea0701782b80a34937781e0e90351ad79d08faad2031 mingw64-glib2-2.78.6-2.el9.noarch.rpm 8db5e55d188be13f2170097af43b9038911ee0712db69a4a9363fe07c8ff5010 ALSA-2025:10136 Copyright 2025 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3-test-3.9.21-2.el9_6.1.s390x.rpm bb044d8b0a9319f832cccb909ab976df275a3d41b1aeca84b789f649dcfe8a06 python3-debug-3.9.21-2.el9_6.1.s390x.rpm f2ee81410fe3101eaea981ef3dfd5c3d23602e0f0b28d7b8e6e56e25bae0f5fd python3-idle-3.9.21-2.el9_6.1.s390x.rpm f5f6b3bd3733741cc3f5ade6859bceb4b27c06eb6ff66205a65b27430e590727 ALSA-2025:10148 Copyright 2025 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.11-test-3.11.11-2.el9_6.1.s390x.rpm 1bac8f2b0d8799535b73a2e3cfb523d5b09b12310af20953e130100548aec732 python3.11-idle-3.11.11-2.el9_6.1.s390x.rpm 710e5fa1e12f6255a3d58ae9baf8c3971deac13bf2bd311f8347f8264cfc53aa python3.11-debug-3.11.11-2.el9_6.1.s390x.rpm d12af522e2392dd3d9f0f5e4b06bfa53442469bd32e3cffb1a34fb127055abdf ALSA-2025:10189 Copyright 2025 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.12-debug-3.12.9-1.el9_6.1.s390x.rpm 43149f6ded0bbe344c9523c994289c883fd77f23a028278a9497286ec9c17c12 python3.12-idle-3.12.9-1.el9_6.1.s390x.rpm 5657686eee4eca3022e4ecb0f52b7c60451d26fb07bb170b1e85527edd25245c python3.12-test-3.12.9-1.el9_6.1.s390x.rpm f063701d3bc6f61af8c903931ccb3031cb9badaf46e6b9a2d033fb9e1189b3e2 ALSA-2025:10379 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887) * kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004) * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846) * kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.25.1.el9_6.s390x.rpm 021667f1882d1deb7f8c0c78bd7e1d17291fc49fb4c41c8615527078a37efb75 libperf-5.14.0-570.25.1.el9_6.s390x.rpm 1f135a38f16881f93e5e968b2be6cbb99cd3045cfd2a0382f6d187b066d96f88 ALSA-2025:10585 Copyright 2025 AlmaLinux OS 0 1 Moderate

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337) * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default jq-devel-1.6-17.el9_6.2.s390x.rpm 20d1faa02ec582b64cbbc670b3fc3bee5200f7038fb49bb7906d7853ebc1b96f ALSA-2025:10837 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.26.1.el9_6.s390x.rpm 7019e09233b506bab150c4f9ddcbf1ce31d4e78053dd0594e35c08b588b81101 libperf-5.14.0-570.26.1.el9_6.s390x.rpm b3dfbc11c8e14af009977366d2b605a5653bc8bb5af41139305c0ce251ac17e5 ALSA-2025:10867 Copyright 2025 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102668, AlmaLinux-102669, AlmaLinux-102670, AlmaLinux-102672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default java-17-openjdk-demo-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 11577e55f0aeb5bd22977b130d08ecc506743ef7ed949a97a50b57db78a33abf java-17-openjdk-static-libs-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 1637a54fb52152982330fec1e830caf1ef147c16a116ad3984b69e75052d8170 java-17-openjdk-headless-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 2493ed0d7c540f19a2d4a5c3692a65930fc499aa916ad38652bb828fa2b80c00 java-17-openjdk-src-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 44a9ef8f07afadb43b9071c24c8a941e48aace05e627e65e729b6f354a9929ea java-17-openjdk-jmods-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 5b3ec522027a3ded06aa0e363cfba3277a6e5ff0086975bc16d5cff121256555 java-17-openjdk-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm 670204704ae6bce7bec7c371e5f05f392421c6cd8c79e3cce4b5b29981d42fa1 java-17-openjdk-devel-slowdebug-17.0.16.0.8-2.el9.alma.1.s390x.rpm ddc47ec3d15a05d4c849982acc177acca6fbe2cfcbdfbf9bbb5863e5373b3c81 ALSA-2025:10873 Copyright 2025 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default java-21-openjdk-devel-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm 0d1e8ffb946d81b42810ffe387a3c766dd6b6337145a58398e426a5cb8283bef java-21-openjdk-static-libs-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm 94f48583de2d6a8cc55cb760fa90d19412ec2369063d52ac39b7c42d9bd4883f java-21-openjdk-headless-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm 969a17621ad825177e73720f0d4617bfc9c21f00f5a980d6a95deff65ab92b80 java-21-openjdk-jmods-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm b64c5bdc434f9809afc3e14f4e922281b0b038d8ee3d184bafac132b6b32d14e java-21-openjdk-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm bd1eac1f970e3c40fbd9e40710d1286be3adbf746cbf4d677b068c9f50589cbc java-21-openjdk-src-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm c8edeea442f604a900ab0006850129a596e8a5dfa8de13a55d51aedeed9cb4aa java-21-openjdk-demo-slowdebug-21.0.8.0.9-1.el9.alma.1.s390x.rpm ed05d25be0cf3af60990d3b86279f81540d0dda7bfb8dbe2b9188fcdf7911855 ALSA-2025:11140 Copyright 2025 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) * glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default glib2-static-2.68.4-16.el9_6.2.s390x.rpm a83dc52875cee3dca4a7a2e80a1405e7e20b8f11251fc42cbac988f349d6c829 ALSA-2025:11411 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.28.1.el9_6.s390x.rpm 03aab6de5cbbfdf702818fe821ecef6b766582a2d43fa73f5bb10d0ad4e14e2d libperf-5.14.0-570.28.1.el9_6.s390x.rpm 53132e67c523b176164c356c9f585f17b7cacb36b42b74889e316ae18eb651f9 ALSA-2025:11849 Copyright 2025 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default unbound-devel-1.16.2-19.el9_6.1.s390x.rpm 32a7803f56970f4fdb1911b1fdb3a6808b448029092c9f7efa4256420cdd7c6e ALSA-2025:11861 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091) * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.30.1.el9_6.s390x.rpm 60d8515d3dd78076f53cc7eb47301f8d17dd6bce7e27d5012f1bdb53a791a3a4 kernel-cross-headers-5.14.0-570.30.1.el9_6.s390x.rpm b26f44df6e8a492b9dfab79cb758bb78e6224343e436f481828201f67d1145a2 ALSA-2025:1262 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.23.2.el9_5.s390x.rpm 23924e03594721d64f3ede30df6d7b0f20935f2af815e0f1da8fafb37ab75c96 kernel-cross-headers-5.14.0-503.23.2.el9_5.s390x.rpm b59c7b0c3786d9297b1a9a3789965b9f9c1352d4c7e0c5594ce9b53fc0ece919 ALSA-2025:12746 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.32.1.el9_6.s390x.rpm 2e187f77f8a36f6ebc0551bf38ac5d7ed27d69d9067f8d500aadc8e78b7780e2 libperf-5.14.0-570.32.1.el9_6.s390x.rpm 551dd34548fe94164ae7c641d9310a0b7bb486f4a47b3b8347f9c4a76f6fa436 ALSA-2025:12834 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12-setuptools security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.12-setuptools-wheel-68.2.2-5.el9_6.noarch.rpm 83201e0efc35e4acac2f56109e56c0bfecd0dcf82c365da609724664ce30f19b ALSA-2025:1329 Copyright 2025 AlmaLinux OS 0 1 Moderate

doxygen security update

Doxygen can generate an online class browser (in HTML) and/or a reference manual (in LaTeX) from a set of documented source files. The documentation is extracted directly from the sources. Doxygen can also be configured to extract the code structure from undocumented source files. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default doxygen-doxywizard-1.9.1-12.el9_5.s390x.rpm 930af920c0e059143f13edf0db693facf3044acf9a538e20fea19dc099959b5a doxygen-latex-1.9.1-12.el9_5.s390x.rpm c6b6eb5762e793d047989f5fe77d45393e17e946eceeed7352768a46625e8229 doxygen-1.9.1-12.el9_5.s390x.rpm d27da5b2835b4b78359853656e96a1c781ea91f401fc8b9d77efc3b4b4b388f9 ALSA-2025:1346 Copyright 2025 AlmaLinux OS 0 1 Moderate

gcc security update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libstdc++-static-11.5.0-5.el9_5.alma.1.s390x.rpm 567f8ebe4bd7c5437f9ea2d4f72015441ced5d97739c925a26bcae999d409f70 gcc-plugin-devel-11.5.0-5.el9_5.alma.1.s390x.rpm a8e2d3da7d07b48d059233d9e1749a11eb75b205006fcdfec7121ec7b0b95152 ALSA-2025:13602 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) * kernel: wifi: ath12k: fix invalid access to memory (CVE-2025-38292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.33.2.el9_6.s390x.rpm 0448a10fde15933d36d6a61cae5b5f07b4adba7723cacfa24c9c36e21d9a9d6a kernel-cross-headers-5.14.0-570.33.2.el9_6.s390x.rpm bb6d58fdec7162b2734510c1d31fb2ddfcdd73eafd630cd035488aa0f3bc5666 ALSA-2025:13962 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867) * microcode_ctl: From CVEorg collector (CVE-2024-28956) * kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084) * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) * kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124) * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380) * kernel: tls: always refresh the queue when reading sock (CVE-2025-38471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.35.1.el9_6.s390x.rpm 038424cee90cfbe7dc9c0a6bce2c2ea7124fd9c6ca1ea17c25aa60eebde90654 libperf-5.14.0-570.35.1.el9_6.s390x.rpm 66c26e1e100525f01069a0627afa4594833412fd22c5350b5fde8498900a7cf8 ALSA-2025:14420 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Fix memory accounting leak. (CVE-2025-22058) * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.37.1.el9_6.s390x.rpm 052119c2948b7c78aac8f944c5e7dfbbedab90e57e808ab4f6eb6e53ac1771eb libperf-5.14.0-570.37.1.el9_6.s390x.rpm c2bd823054c4f3b1a9a31fd3f5bdd96ee1df5754f03122b48205b17c5bd55adf ALSA-2025:14878 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default postgresql-docs-13.22-1.el9_6.s390x.rpm 6129403de32cd734bcfe114ae063a96965771fb274c8e99ff03bd988d48e4dc7 postgresql-static-13.22-1.el9_6.s390x.rpm 72ade605a5e773211ce8c8cb98c086efc12859af694aef9707f4585f716367dd postgresql-server-devel-13.22-1.el9_6.s390x.rpm 86525ad00c9b5e1509c15e71cdc82b8532cdf4d0c0dd68060c5613c0b5c6aaeb postgresql-test-rpm-macros-13.22-1.el9_6.noarch.rpm 88c18db9bf4a72203801e595dd0f50c658e931d0189ebe0d2fb782adc972a2bf postgresql-upgrade-devel-13.22-1.el9_6.s390x.rpm 8b099ef4c5c5943dc26094a4734dc4b264ee392fea0a6f8eee81e8676006a8bd postgresql-private-devel-13.22-1.el9_6.s390x.rpm e67f53ba51bff705bb31f5c24c0011d5de49897b3e1976c5662fe2e26cd5ec56 postgresql-test-13.22-1.el9_6.s390x.rpm ec0794181fbb60e5fe6f3f8c0255a158410ed59d2624d42b85fe4e123032a413 ALSA-2025:15007 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.12-idle-3.12.9-1.el9_6.2.s390x.rpm 05f5c299989b0d34fc3116c20b7fe55d990a24d70adaf0d8f4fcd58cc4e33482 python3.12-debug-3.12.9-1.el9_6.2.s390x.rpm 150f8d537fa5c5bb5475c5856edca972a6a8859daf7318e4099aa1b5cf9df9ea python3.12-test-3.12.9-1.el9_6.2.s390x.rpm 777978cb82abebd10e0d4c4e13a5fa674318eeeb29f4dbb05ac33e616e71eb86 ALSA-2025:15010 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.11-debug-3.11.11-2.el9_6.2.s390x.rpm 2cf5ce55f45f3465826d9ffe912eeede5c49ec551f49d56ce42aa310cf968e90 python3.11-idle-3.11.11-2.el9_6.2.s390x.rpm 8986528375c8e6ce2d87cf369cc0be6bfcdd60ca7fcf86cc42c5bb64140d37d6 python3.11-test-3.11.11-2.el9_6.2.s390x.rpm ccd4c6763afcb87c2f4a24823296e757b443176af1f4bfc8d6c37597460057aa ALSA-2025:15011 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823) * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461) * kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.39.1.el9_6.s390x.rpm 582957b90da83e4bbca338d8f17a9033f0dc84000276d625a020361bea92d2ba kernel-cross-headers-5.14.0-570.39.1.el9_6.s390x.rpm 725e4b1f36b96df7348fedee32dae146cddc644bd735da9b6b090f1036014617 ALSA-2025:15018 Copyright 2025 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libudisks2-devel-2.9.4-11.el9_6.1.s390x.rpm d0805b3108fa39a10662cfa4136c98d84da519e9cb89dc572a359c67c2dc7ad4 ALSA-2025:15019 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3-debug-3.9.21-2.el9_6.2.s390x.rpm 765fbfa5aea829b5d6f8f0538d3f40e6fa41c70549d21a4d1b609d6964f5c304 python3-idle-3.9.21-2.el9_6.2.s390x.rpm ca142fd2b5021c87ffdb26430445638446a42c7ec697102c4c609152720188b2 python3-test-3.9.21-2.el9_6.2.s390x.rpm f244d20c73f47929d3b738e5015602c5c7eb7d37e3497cdd1e117ccfc6a0da93 ALSA-2025:15429 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.41.1.el9_6.s390x.rpm c8c0ccb1dfbfc38f10676e4e31dde1f94b2681c1ebd4d1530a762cb89dd0d60d kernel-cross-headers-5.14.0-570.41.1.el9_6.s390x.rpm fd839780dd7ff7af892cdab20ad223dbef912e83a8162e1a5801b41dfb151c05 ALSA-2025:15661 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.42.2.el9_6.s390x.rpm 44a69575297bf1d7c1614dfe7af0b6376a75f27671ca4094f208b68e4c7d8d6b kernel-cross-headers-5.14.0-570.42.2.el9_6.s390x.rpm fe75b2ec7fe6c3ed0b598ede03496a1a8411be36612b27475e2c1531526b9ade ALSA-2025:15740 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.44.1.el9_6.s390x.rpm 39224d909a46486b46d25b3b8e4c613bddefbb320e69579952efcae17f1b167f kernel-cross-headers-5.14.0-570.44.1.el9_6.s390x.rpm dc3ec5c43632f1ea47f0887f8155832168430232fd519cdabae4218b7b1539ae ALSA-2025:16086 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688) * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699) * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575) * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092) * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077) * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085) * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082) * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087) * mysql: Replication unspecified vulnerability (CPU Jul 2025) (CVE-2025-53023) * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084) * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default mysql-devel-8.0.43-1.el9_6.s390x.rpm 1dc3c54c196bde19dec297f95d2f423543c1e965662eeae59512215b688d0e2e mysql-test-8.0.43-1.el9_6.s390x.rpm e9f13ea01a44905751b7cc0e74951a80e5902e4267b0c1a3a75f4447a41149f4 mysql-libs-8.0.43-1.el9_6.s390x.rpm ee6112407190b6205d66e06ac866fd0d96791be644dfa9cde586a609b5cee661 ALSA-2025:16398 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125) * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.46.1.el9_6.s390x.rpm 4e4fce7af61f60a2fb8eda7aeaecf301220bb4bdda15b5cb48beb1190d0d80aa libperf-5.14.0-570.46.1.el9_6.s390x.rpm f90718445d514fe0cd4776dd667aa83a1ac3f1c3f584d4d66f0cd0c5999af7e1 ALSA-2025:1659 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: mm: migrate: fix getting incorrect page mapping during page migration (CVE-2023-52490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.26.1.el9_5.s390x.rpm a34c585eb94887bd3978f486223fa7989ac650a1315f1a009a70f376375c7617 libperf-5.14.0-503.26.1.el9_5.s390x.rpm e31458f7b3d1583afd0dc984cdf3deeae60b30f97713e062f76b4362506c0cb9 ALSA-2025:1670 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVE-2024-12705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default bind9.18-devel-9.18.29-1.el9_5.1.s390x.rpm 54cb879e21320ce3195ac053652d317c670cfa77bdcdcd1c08e6ab585b4e1964 bind9.18-doc-9.18.29-1.el9_5.1.noarch.rpm 77c63238095876975f73c8eaaf24d184ac4b256cba65b144aebfaaff277235c2 ALSA-2025:1671 Copyright 2025 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) * krb5: GSS message token handling (CVE-2024-37371) * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264) * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238) * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241) * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231) * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236) * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237) * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203) * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212) * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199) * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193) * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198) * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239) * curl: curl netrc password leak (CVE-2024-11053) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497) * mysql: MySQL Server Options Vulnerability (CVE-2025-21520) * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555) * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491) * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501) * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519) * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559) * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523) * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default mysql-libs-8.0.41-2.el9_5.s390x.rpm 8f7a9dddd8f2fcf8c22892eb27f84efa83fdf2e77a299dc29042fe5c1c4624d2 mysql-devel-8.0.41-2.el9_5.s390x.rpm 90fd07fc425021cc957eca019434f8207c813f473e1701547203d5f9f1bf7627 mysql-test-8.0.41-2.el9_5.s390x.rpm c6672b99ed1de9647f85ea0061d4f1c586dc715071ff9a0171e6be68b93d91c5 ALSA-2025:1681 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default bind-doc-9.16.23-24.el9_5.3.noarch.rpm 045097af79111a6f6690a054d83f198561c6696a82ba817f9b4b1ca59004895a bind-devel-9.16.23-24.el9_5.3.s390x.rpm 788f4bc1c749c6d3baf5015fb15cfeb33a9e560624da234266f7c6f20100e7c1 ALSA-2025:16880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472) * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) * kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682) * kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.49.1.el9_6.s390x.rpm 5ce2ae4e28fd925b05986a62cef9b8d9f1f85ee3e2fd9a93823e1e4dbecc8d19 libperf-5.14.0-570.49.1.el9_6.s390x.rpm 801990267da25449d0d73504d5ce37c8b23a1bae5f189b0f44acf7e0d24e29ed ALSA-2025:17084 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.5.noarch.rpm f11bab0e5d897b89c5f9cda819ac846db881e4a46077033f48563660e1fc9dd3 ALSA-2025:17162 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fix(es): * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default perl-JSON-XS-4.04-1.el9_6.s390x.rpm d056e770be417a357ebf9549b36c656782e6d73be2e25fd9923ce55cf8b58717 ALSA-2025:17377 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301) * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.51.1.el9_6.s390x.rpm 7eadbdacaa4f9e7330a08bf724f214c44de69ffa46b4f597afb4e454d364d758 kernel-cross-headers-5.14.0-570.51.1.el9_6.s390x.rpm ef814d5810bb9d5be2bf77f7aad211ff2f5170ebe7e8fa85a9852839467dc612 ALSA-2025:1742 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default postgresql-test-13.20-1.el9_5.s390x.rpm 0d20f4ad44a64133e839c69b7a95e385088dbdc77cb31e2f81f07dd0c3730d7d postgresql-test-rpm-macros-13.20-1.el9_5.noarch.rpm 167bf6673ce0e88f70019e49d0937948c321511b6c62d9f015003e4796450bab postgresql-server-devel-13.20-1.el9_5.s390x.rpm 1998451b163ab480e0c8322f85404a910f6e619bdf14a95b4ece4e2d2c587464 postgresql-upgrade-devel-13.20-1.el9_5.s390x.rpm 6204d119043755765a78da4ffb59c85a5c67192638ef1395452ed4f32f8cdb54 postgresql-static-13.20-1.el9_5.s390x.rpm aef96008fc92852f792c83f3200c6407983e9724bfecaaeaea062a1e39815a5f postgresql-docs-13.20-1.el9_5.s390x.rpm bf3f5bb8d1410d7696cc9bc5dc680c89ebed209feffdea624448d91a7591fa80 postgresql-private-devel-13.20-1.el9_5.s390x.rpm d2d00b63a6c6fbeb748c4881af836444a52a553466d761e485b8a74b6f927de6 ALSA-2025:17760 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614) * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.52.1.el9_6.s390x.rpm 5f9833ae1b60df6013155bcfc482419daa35d5289e1dab277e4fcaf7f79ebf8e libperf-5.14.0-570.52.1.el9_6.s390x.rpm dfca77359817bf8b7ed84d9e80d6cfd06fb936dca29d890ae3785953edd255f4 ALSA-2025:18149 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6.s390x.rpm 9a46dc2501c00ebca3bf430dce1317702fd5c3cf9a3764b3078d7ed160953b5a ALSA-2025:18151 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el9_6.s390x.rpm 4d2b20f7d000ca8eed818b7550c917300d533352bb87a4b35176f066ded59d42 ALSA-2025:18281 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087) * kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571) * kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566) * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849) * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.55.1.el9_6.s390x.rpm 57c52e3270f948e4e5086843234289d87716cb7b7e6780939830e2ec5bbd0b2d libperf-5.14.0-570.55.1.el9_6.s390x.rpm 7dfefb6293fe40f0e74ace02a3c6f4269a60d766ddb9f8797c117289515e15ff ALSA-2025:18821 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) Bug Fix(es): * Since the 8.8 release of AlmaLinuxand the 9.2 release of AlmaLinux OpenJDK 17 has used a single build repackaged for each major AlmaLinux release. With this release, this same build is now also used by the following older releases: 8.4, 8.6 and 9.0 (AlmaLinux-118788, AlmaLinux-118789, AlmaLinux-118792) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default java-17-openjdk-jmods-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm 0dcbccf26be10d2cb21753e82e950a0c9c05e7f87f737e276a559cb48a3c8abb java-17-openjdk-headless-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm 0e13a1e79fafc9463a476a1b7a49d35df99b17e181cc8cdc172d7add48d7aa92 java-17-openjdk-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm 5259c02a046f5d0c14257363c8bd30ea814b757bbd6e6cd866240657496ba9f6 java-17-openjdk-devel-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm 58d137b103c73441b6dec0a1b404ec0c03f9b4261a6efa4f2c0b3fe9da5b6f60 java-17-openjdk-static-libs-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm c25eb4655dc22721ace04bd331f5491c25ce243fa40193600961241ea2b6fc03 java-17-openjdk-demo-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm d76b88c02540e8a4c5912c534ba7922a7b88741dbfc02ee860a67ebe70d77232 java-17-openjdk-src-slowdebug-17.0.17.0.10-1.el9.alma.1.s390x.rpm f6a0c6b4fac14e4a967e69598bb7896cde1f4b8be3b7a60ac59b4ecf4b5c4195 ALSA-2025:18824 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) * JDK: Enhance String Handling (CVE-2025-61748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default java-21-openjdk-jmods-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm 52532e6a3b3c0301717b69b5691f34297df14ecf8f9335d17a5747ed172b26d7 java-21-openjdk-headless-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm 849d3c712a69c9b3e94f43e4b863cfcade43507ff3bc5539a6c042c9b7874f46 java-21-openjdk-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm 8798b48ece81ea4768bc66387263cef486fc005146db8aae4b6741c030fed38f java-21-openjdk-static-libs-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm 8e590de8bb481eab31e08a8c404d1fe001a5a1b369ad13397cb217ca898d1d39 java-21-openjdk-src-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm b50b8ab957eef96ba2984997da20ca42afe6449c6d50dcba4a105d179d7aa2d1 java-21-openjdk-devel-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm bd40a9d6ddb4f25b1a7f382a0fcfbb736a98e8cb88ec55bbbfad3c7d5dc8ba51 java-21-openjdk-demo-slowdebug-21.0.9.0.10-1.el9.alma.1.s390x.rpm f235f2b2d734a913f34c8eb5136d0a9f16cc1c38d94e2f1ddc7df60444128d1f ALSA-2025:19113 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libtiff-tools-4.4.0-13.el9_6.2.s390x.rpm f85f45a91695c5daa6ca3e4717c53493d960273168d482b220efbe86a24e9fb9 ALSA-2025:19409 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702) * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367) * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.60.1.el9_6.s390x.rpm 7b363e47aacf69ea6ee1bc9cdf79cad3b2a43e674b4f47c11da42ba9d142d81b libperf-5.14.0-570.60.1.el9_6.s390x.rpm 9f1c01514be5ed09f71301301f83f794ee2ab6e6637cf8a6646643d47605b2df ALSA-2025:19584 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

Galera is a fast synchronous multimaster wsrep provider (replication engine) for transactional databases and similar applications. For more information about wsrep API see <https://github.com/codership/wsrep-API> repository. For a description of Galera replication engine see <https://www.galeracluster.com> web. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default mariadb-test-10.5.29-2.el9_6.s390x.rpm 173c731868e4aa50cc1d743d2aa7817ed15cc3881b2966ce94d5f29c71da5557 mariadb-devel-10.5.29-2.el9_6.s390x.rpm 5b77b3b55a423c98dba5ec728644ca4f85658e7e437965a9adc91134d4969210 mariadb-embedded-devel-10.5.29-2.el9_6.s390x.rpm eac2eae1ad852228c5740a93ff6576e1cbf00fddacf62a860fb777b7d0c918c7 ALSA-2025:19930 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-570.62.1.el9_6.s390x.rpm 837c72c9bee4678a9987e133e2ab2effee2079c5319870201db5da13399b9efa libperf-5.14.0-570.62.1.el9_6.s390x.rpm 94653d643987abdc7fcec3e426efab48ad4c6f270e3c6d219c96a8ad69a66233 ALSA-2025:19950 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default bind9.18-devel-9.18.29-4.el9_6.2.s390x.rpm 078d9155080db8f68c8c9cbef17797bb0094c9445a0ae15828a65853f4e37cb5 bind9.18-doc-9.18.29-4.el9_6.2.noarch.rpm 96d3c97bb463ee4e457f2ba7e81f71eac1d9181a66f082476952e3305244b877 ALSA-2025:20518 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830) * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689) * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744) * kernel: vfs: fix race between evice_inodes() and find_inode()&#38;iput() (CVE-2024-47679) * kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727) * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864) * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060) * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024) * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195) * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294) * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052) * kernel: afs: Fix lock recursion (CVE-2024-53090) * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119) * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135) * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241) * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229) * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170) * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216) * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672) * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662) * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675) * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690) * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709) * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739) * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786) * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332) * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680) * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648) * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647) * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631) * kernel: zram: fix potential UAF of zram table (CVE-2025-21671) * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672) * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696) * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702) * kernel: usbnet: fix memory leak in error case (CVE-2022-49657) * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432) * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672) * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353) * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437) * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627) * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670) * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269) * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643) * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623) * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357) * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443) * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648) * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746) * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795) * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728) * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456) * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987) * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014) * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988) * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714) * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570) * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (CVE-2024-57993) * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729) * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989) * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015) * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998) * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739) * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786) * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738) * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986) * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726) * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791) * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787) * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981) * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790) * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990) * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765) * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012) * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745) * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806) * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072) * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068) * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062) * kernel: idpf: convert workqueues to unbound (CVE-2024-58057) * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828) * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083) * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826) * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077) * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075) * kernel: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" (CVE-2025-21829) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837) * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851) * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855) * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844) * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853) * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847) * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864) * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088) * kernel: acct: perform last write from workqueue (CVE-2025-21846) * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861) * kernel: io_uring: prevent opcode speculation (CVE-2025-21863) * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848) * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056) * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845) * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116) * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.5.1.el9_7.s390x.rpm 1b486f3a95a6032db4f07c97ef7580605e926b85b33a2da0c2bafa1b6fd04e41 kernel-cross-headers-5.14.0-611.5.1.el9_7.s390x.rpm 5d40d13c2f64572883bd389dbc02e9625f97e78144c3a2748188d7ae22bbe20a ALSA-2025:20559 Copyright 2025 AlmaLinux OS 0 1 Low

shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default shadow-utils-subid-devel-4.9-15.el9.s390x.rpm 5141eb7092e1798977abdfd56fe5930159572413f0bf712b48be604faec6f61d ALSA-2025:20838 Copyright 2025 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default zziplib-devel-0.13.71-12.el9.s390x.rpm e32da0c0d2bca4a27c805a3da528195c905ef317bc97bd8611187d63be8019df ALSA-2025:20928 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-ipatests-4.12.2-22.el9_7.1.noarch.rpm 73735cb3f9e7836a82214b31eebc711a3dab45d846b482e539c88ccd41cc2083 ALSA-2025:20954 Copyright 2025 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libsss_nss_idmap-devel-2.9.7-4.el9_7.1.s390x.rpm a2cc253155ee20420e1a9ebe8b75468d4bfbc7a7ba108b1bdf666fb411df68f1 ALSA-2025:20956 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.2.s390x.rpm 38c00b462f108f99317be9cf5c3407e7c4817fd29dba1173e4908405c70821ff ALSA-2025:20960 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-5.el9_7.s390x.rpm 6a3ca00bc23b9e69ce9f69e2eb3a81d75c0b636c48f877dbe81b8b83aed4f65c ALSA-2025:20961 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default xorg-x11-server-devel-1.20.11-32.el9_7.s390x.rpm 480f943c729608f0e9b98e9837df277437d1a7312bc23abf22300ef1236f619c xorg-x11-server-source-1.20.11-32.el9_7.noarch.rpm 95e1253a06af7d378305502d5dbb69dbe4f15e3169d304ac2956aa023e59f083 ALSA-2025:21110 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default bind-devel-9.16.23-34.el9_7.1.s390x.rpm 5c46a42bdb388b89563173cd7719180f9aa32827fb4e00e4e3bfcc0e2fe91eea bind-doc-9.16.23-34.el9_7.1.noarch.rpm d5fe5e92ce924c40cfb8e5ffee39962cc0864de759ade57a74b9aeafe5b15352 ALSA-2025:21111 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default bind9.18-devel-9.18.29-5.el9_7.2.s390x.rpm 3cdcf0fe72bee7ded0c13aa536124743b411c2e6cc741f0734ed644900bfb3f7 bind9.18-doc-9.18.29-5.el9_7.2.noarch.rpm 3e89b39addd198c4c8835a6dd4053f4cd2690e3e639cf581ebcd64478a751bd8 ALSA-2025:21462 Copyright 2025 AlmaLinux OS 0 1 Critical

lasso security update

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fix(es): * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default lasso-devel-2.7.0-11.el9_7.3.s390x.rpm ddae4deb7d33572f2c62ce889a513b913f1882ee7eb4daef44898cbe8645ed35 ALSA-2025:22405 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.11.1.el9_7.s390x.rpm 62d7d127e91e64ac0e626f542e3d845162446b9d66877763da318e761319203b kernel-cross-headers-5.14.0-611.11.1.el9_7.s390x.rpm dcd7a48226b736b6f58c922e299bfa1aa9d24d94de2a367de33cea866bf57927 ALSA-2025:22865 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.13.1.el9_7.s390x.rpm 666e4698a3c073416fa2a7f7a5009496d0eae8d10a238b4940f09639f70d37e2 kernel-cross-headers-5.14.0-611.13.1.el9_7.s390x.rpm bc8a356f21740a60ce26f15977e81d27ca9902bb733213dea5ba74e1f7c41685 ALSA-2025:23109 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default mysql-devel-8.0.44-1.el9_7.s390x.rpm 67c571ced97827f9ee8b8095fa4f50caea8070d04d6da39b15780d9359473faa mysql-test-8.0.44-1.el9_7.s390x.rpm 9f3087fbea252ded8fe47e0c16872a356e2968a8a07554e93ff29af92bbf6905 ALSA-2025:23142 Copyright 2025 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default wireshark-devel-3.4.10-8.el9_7.1.s390x.rpm 2770f805d7de8f70191a5a2dc1d79e9e4c08c2b03ed129cfdd9d8023d57a4204 ALSA-2025:23241 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499) * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966) * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.16.1.el9_7.s390x.rpm 1ccc6e8071fa0bbe246fc6307469ac2064e24f410d7ac3cf704ce3ec885fb980 libperf-5.14.0-611.16.1.el9_7.s390x.rpm 6eb3c7997a09c41618ff01fc3e3862e813bb79e6ae018402a2645031ee08ad72 ALSA-2025:23323 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-debug-3.12.12-1.el9_7.s390x.rpm 00fb506e1dae233ca08eb386103c58021064d6c4aba5f649b85da7b0deaa7637 python3.12-test-3.12.12-1.el9_7.s390x.rpm 80636de2e7dd9bb652e9af63cb979ae12d760ef5d4d8e19b9ff96f387903dcab python3.12-idle-3.12.12-1.el9_7.s390x.rpm d3287220c2967682252f11b6ad4f3e4d20e31bb93f9bce13f4696052d79544bd ALSA-2025:23342 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642) * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-test-3.9.25-2.el9_7.s390x.rpm 290569ca2a394e20b49e53a81ef780e81fdd631fa9e9bb95e5fd61072e50c655 python3-idle-3.9.25-2.el9_7.s390x.rpm d63f8a0027ba332b979db9517988cb30cee9528254e695e337596abd19f88618 python3-debug-3.9.25-2.el9_7.s390x.rpm ec602f6002eeb48eb703ae94f8f730bdb593d1bd64424e02a3da87e853d07763 ALSA-2025:2627 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ACPI: extlog: fix NULL pointer dereference check (CVE-2023-52605) * kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264) * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302) * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922) * kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (CVE-2024-53113) * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVE-2024-53197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.31.1.el9_5.s390x.rpm 33ce4fa6fbbc24f441688dc816d9dd32c94966509f4a218530f62b08349aa8f2 libperf-5.14.0-503.31.1.el9_5.s390x.rpm cb8d2ddf7f87a013598c6ec29afd2f907239b29e9c85ccfc309e08e6955d1a47 ALSA-2025:2668 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default dotnet-sdk-9.0-source-built-artifacts-9.0.104-1.el9_5.s390x.rpm e39304bd808acb082714424e3b59a72d7eb55388def0c7bb543bb9fd74f3ef9a ALSA-2025:2669 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default dotnet-sdk-8.0-source-built-artifacts-8.0.114-1.el9_5.s390x.rpm bec595831e9607e8772b795e73db80f3aa6700c32a95405f002e247debf21e1a ALSA-2025:3631 Copyright 2025 AlmaLinux OS 0 1 Low

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3.12-debug-3.12.5-2.el9_5.3.s390x.rpm 275cd33832680a587230d5bd9a0566cb15e73890e22c9bace3ae8384de732a46 python3.12-idle-3.12.5-2.el9_5.3.s390x.rpm abfa113ead645ea37162663543b0f546a8abe36a0029d2d8fc71c33e3466c2f7 python3.12-test-3.12.5-2.el9_5.3.s390x.rpm cef2633bab44043f6fc421e6e15113b9847783675306ab6a88c2c65e43e78f27 ALSA-2025:3634 Copyright 2025 AlmaLinux OS 0 1 Low

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default python3.11-debug-3.11.9-7.el9_5.3.s390x.rpm 07bcb7a144168ce8467fcd0b13e91565847768e27122471cb0d04cb7d1590036 python3.11-test-3.11.9-7.el9_5.3.s390x.rpm 43eb5dd360b6ef9d5088fe7b629a9d0f5399c9b2c048a1f477354542e5cb3d82 python3.11-idle-3.11.9-7.el9_5.3.s390x.rpm 5d97c6a8ee978093d4125c1ffcc1c11cffb27dcde3767c77f9f74e81499f0ed9 ALSA-2025:3852 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default java-17-openjdk-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 0cfe21eb58e33e20f4f3e4a56cbb97d01005b9a7ffef3b73e8cc77e8788b5298 java-17-openjdk-devel-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 13406f53167d8754db6c92e465b2e4618d8a1caf6a1695428b741164743aa97a java-17-openjdk-headless-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 46dc3a646493fb443b146d7669f7452590dd86d3d6f0ae6ea935998ec48cb094 java-17-openjdk-jmods-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 51223e05b1a0ff626a517df360e7c47bf065d9e7139ccefe1ab900587669efaf java-17-openjdk-src-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 65ec352e4527424b4108dd848b0e21d7f2cde4ed6fa1fa6cea9f717c9f169cce java-17-openjdk-demo-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 85831499d09ca9bf18793a2f96d3f0832a9e457d67229a9b346f4322c0dceb01 java-17-openjdk-static-libs-slowdebug-17.0.15.0.6-2.el9.alma.1.s390x.rpm 980fc59d69506718324c8d7d5127670d9d68196a6e8d581b2d4da37b52670415 ALSA-2025:3855 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default java-21-openjdk-jmods-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm 0a561b5cfa8749cf9d85d0f61e9748dbedd19a9e1e6c242ccdc0cdda127f8d21 java-21-openjdk-devel-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm 1cc6317a1a56078becffef2378726b18fb3fef74d9737839df25978398eef13b java-21-openjdk-headless-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm 367766c146889b20b0d91e065a39a72f05863092f46e4d7ededb780efc7ea86f java-21-openjdk-demo-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm ac29956093c476175963cce8816413dc7db009a86c57443c5c8732151c8b3125 java-21-openjdk-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm d11547f7db1b661f0352bc2fa81fc8ab006cea431345de67a377d3d30f44ba6a java-21-openjdk-static-libs-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm e75c0988966e84c34edb69b69994fb874a271135d849ed4923a2b9c107dcda79 java-21-openjdk-src-slowdebug-21.0.7.0.6-1.el9.alma.1.s390x.rpm e7ef75798b7b23307987d5262d896d21f6ae77fbd8e28ac426d1812cf6e734b3 ALSA-2025:3937 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default libperf-5.14.0-503.38.1.el9_5.s390x.rpm 5fe9aceb3e749b905df03048cde211bf090cb378cfd04ad101ccf2b503832d59 kernel-cross-headers-5.14.0-503.38.1.el9_5.s390x.rpm 997953659a77e9294b64c767d639e330ceb0a0a93a25fb2d5982554534119682 ALSA-2025:4244 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default nss_hesiod-2.34-125.el9_5.8.alma.1.s390x.rpm 029097814fcf09f1e6b2b8ca967d7f99f1528e63f16d76ee77d387e92ab530f8 glibc-nss-devel-2.34-125.el9_5.8.alma.1.s390x.rpm 35781fd980af41564ebea6e89278265958c822115075e3e936eec69ec4b4315d nss_db-2.34-125.el9_5.8.alma.1.s390x.rpm 8e08b6c3f8ad3b2d515aca0fe4ea13a5d342dca68fed66f4c56794e461f2192c glibc-static-2.34-125.el9_5.8.alma.1.s390x.rpm ea543fc40c4a1746fde6bbe4d48f8b969dd4c9bedf000327fe44297d68c9171a glibc-benchtests-2.34-125.el9_5.8.alma.1.s390x.rpm f214d69e98b9690024772a7d9601e8fe1c6c89f37f6d1104722840cf2e19acee ALSA-2025:4491 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_5_default 389-ds-base-devel-2.5.2-9.el9_5.s390x.rpm 5eeb8067a2b58901b55ad8dce7eb56f5c520aa6cafe178c02856301ca60a8869 ALSA-2025:6977 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3-debug-3.9.21-2.el9.s390x.rpm 45e7d06bc3d54cf4fa18d4070c8e57a41ce56a4ab18b335738c4411e71469a45 python3-test-3.9.21-2.el9.s390x.rpm 5318bf0bcea19d11d3db3204c842101854bc90551b54196915debdee91f0c7ee python3-idle-3.9.21-2.el9.s390x.rpm 5441f14ea1bade9f1a46056b714679a53dcc37897cbb8dd5b1ae177c1bac98c6 ALSA-2025:7107 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.12-debug-3.12.9-1.el9.s390x.rpm 1d67d697aaf29311f8bd7679a34ce62d24f262495087287c8df88cfa4bb18ffb python3.12-test-3.12.9-1.el9.s390x.rpm 9d91b30445d42aa10ccd33bae3f13677138eba06945c7a550ee72778b53d593e python3.12-idle-3.12.9-1.el9.s390x.rpm b3390337dfe036a67a0ac720933900299687dd7afa1e98b251bf969e236db07f ALSA-2025:7109 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3.11-idle-3.11.11-2.el9.s390x.rpm 15d33b5d51a684fd603587f4eabe4efd729ef0b73524447460b35e756022a759 python3.11-test-3.11.11-2.el9.s390x.rpm 994a83fb476cf885b61e1c9982dc86b2aab19ed3da08f519c924a1f0ae339e0e python3.11-debug-3.11.11-2.el9.s390x.rpm e679f6da1b2816150a6a68926fe0d21f533c8a637592cc19700b1c60081fd979 ALSA-2025:7138 Copyright 2025 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default protobuf-lite-devel-3.14.0-16.el9.s390x.rpm 6a5ab59cd0cf7ce1049a2c0135b34023403e2ec4011ad1fdc88c3d2d47a7aa6e protobuf-compiler-3.14.0-16.el9.s390x.rpm c39327b1d5287c9a744e261c5bff8e1f4c65878debb34eac9385d92ed685ac47 protobuf-devel-3.14.0-16.el9.s390x.rpm eaf6c9a89cb61453fe80340f1abdceb0a469330b7c1f28cdf6eaf1e31dd157a9 ALSA-2025:7163 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default xorg-x11-server-source-1.20.11-28.el9_6.noarch.rpm 3b5bd53a2a3f676acc5de9d501d20df93aa48d19e1ee9f9f51594d08563b468b xorg-x11-server-devel-1.20.11-28.el9_6.s390x.rpm c1bc39823d4996a2dcd410fa00eb7a8cb15db1ce2a7fdc5c7f80ea7e0cc6c7bd ALSA-2025:7165 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default xorg-x11-server-Xwayland-devel-23.2.7-3.el9_6.s390x.rpm 513e9d30e7603bfba2557a380825f3805bd28d585be0b9330f4cb39c68fbce8d ALSA-2025:7178 Copyright 2025 AlmaLinux OS 0 1 Moderate

gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fix(es): * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453) * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-3.el9.s390x.rpm 7d76dd7f159c0b28d61712abe561710f6dd73ad4fcdc09a5ed57503a65aba069 ALSA-2025:7201 Copyright 2025 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default corosync-vqsim-3.1.9-2.el9_6.s390x.rpm 5dbf3a6dff3c327fde9c09b997cda5f4e7f53eb565f3658f657af23503410c8b corosynclib-3.1.9-2.el9_6.s390x.rpm 6d7d26d47200b5ffa1616a8da8f37093e94d3278b78cebd2db137451e1fd9d2c ALSA-2025:7309 Copyright 2025 AlmaLinux OS 0 1 Moderate

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: heap buffer overflow in bin/common/color.c (CVE-2024-56826) * openjpeg: heap buffer overflow in lib/openjp2/j2k.c (CVE-2024-56827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default openjpeg2-tools-2.4.0-8.el9.s390x.rpm 383699754145c277afa8fb70402b5961efa4c90ff68f496862dc237770f68ef8 openjpeg2-devel-2.4.0-8.el9.s390x.rpm 91f00cea697a4ac25cac571b19b2afb7db726544f7fa04ff6fd7d4fdb2ceb518 ALSA-2025:7350 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-Module-ScanDeps security update

This module scans potential modules used by perl programs and returns a hash reference. Its keys are the module names as they appear in %INC (e.g. Test/More.pm). The values are hash references. Security Fix(es): * module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default perl-Module-ScanDeps-1.30-6.el9.noarch.rpm 58e02999f61c36061ec35282d70735bc5f2aa26e5cd90232472bc3205b37ee54 ALSA-2025:7395 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default 389-ds-base-devel-2.6.1-8.el9_6.s390x.rpm 901d9ce99549badd9e088101f9bcae7ab99cfc1136a50608a044983b8dbdf6bd ALSA-2025:7402 Copyright 2025 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Memory corruption in the ngx_http_mp4_module (CVE-2022-41741) * nginx: Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742) * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default nginx-mod-devel-1.20.1-22.el9_6.2.alma.1.s390x.rpm f118abca7b83767ac16647d95bbbeb516a93a1d7932ab39798a67ffd022b09b4 ALSA-2025:7422 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: dangling pointer in gdev_prn_open_printer_seekable() (CVE-2023-46751) * ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952) * ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951) * ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954) * ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953) * ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libgs-devel-9.54.0-18.el9_6.s390x.rpm 16da12cebba223156f9e48639e01b78fa9ce08e4b7bae4b4d3d5df84a48333b4 ALSA-2025:7423 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633) * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005) * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) * kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927) * kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CVE-2025-21993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.16.1.el9_6.s390x.rpm 48be527bc5ea595870ed5c914d1b6d59d3d877f5a4c624fd598ea248404f3cb7 libperf-5.14.0-570.16.1.el9_6.s390x.rpm d0cebb3ad1379275dfe6961f174020fa43d38cd5983a57cfa4144a9bb4d24a34 ALSA-2025:7430 Copyright 2025 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: Arbitrary file read (CVE-2025-3155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default yelp-devel-40.3-2.el9_6.1.s390x.rpm b98ac42c5689b6d9af9f97adf82b30f1102d6efda4b2ba38d2596ac9fcb3a2e0 ALSA-2025:7437 Copyright 2025 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Avahi Wide-Area DNS Predictable Transaction IDs (CVE-2024-52616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default avahi-compat-howl-0.8-22.el9_6.s390x.rpm 267f88bb1ea7cd5e8ed8d13080aac8902050c48a2c1260574e3c90ea578b3f57 avahi-compat-howl-devel-0.8-22.el9_6.s390x.rpm 4043acafccae39a235f5824e3a918cb98f2b72a64bc619ce829d52a6edbaad25 avahi-compat-libdns_sd-0.8-22.el9_6.s390x.rpm 6cb1c3ee2104c4a186181f86c921ac0dd90c4bc78b24909de6b424ace44d37ea avahi-glib-devel-0.8-22.el9_6.s390x.rpm 72c4b0c219d22084314ae7a186fa0cef0ed394cf50de0818ef7f3b17224a3a51 avahi-devel-0.8-22.el9_6.s390x.rpm 7f0ec3f39889883d04df83c0439f0b44676e4cfdda1d3a8f4410a1708a749c8c avahi-compat-libdns_sd-devel-0.8-22.el9_6.s390x.rpm ebef32bffb91e9408670af722ad3436b51fadd4d35e4da1d4cc028e90d4adba0 avahi-gobject-0.8-22.el9_6.s390x.rpm f7efde2ef357eb80f73a006ef2082269e6151353feaa64d6b4ed993a7f7790c4 avahi-gobject-devel-0.8-22.el9_6.s390x.rpm fe28781f94bf4ced2ec9207d75f820971f09c7e15f4982681aa80f0ee6d73c85 ALSA-2025:7586 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libgs-devel-9.54.0-19.el9_6.s390x.rpm 04221f0a3c99fa8ef0fd8c203e557fd39a9b302f022838caf0680f4126139ef4 ALSA-2025:7598 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.116-1.el9_6.s390x.rpm a6022ce5d98ee7d7f743ca25d283146709aa123295c526e1ae07304a44b1ecba ALSA-2025:7600 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.106-1.el9_6.s390x.rpm 12742bf15374d2634eab9a293c3979aa4ef4f8fe26f1150674894cea78dbd961 ALSA-2025:7903 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756) * kernel: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CVE-2025-21966) * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.17.1.el9_6.s390x.rpm b464ea3913243c19db4f5fd7f5fa117eccef6990991ce78dc36a1beac6d9e342 kernel-cross-headers-5.14.0-570.17.1.el9_6.s390x.rpm d66838bbbe28e3ff63d84b3594addb7fec47bc365b519e079a8d8353626d1dc5 ALSA-2025:8142 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.18.1.el9_6.s390x.rpm 5b33b48cad90602c7a680c1d7566172932b5d9c0b84b1e0c6161d8097bfeda5c libperf-5.14.0-570.18.1.el9_6.s390x.rpm c4cbf76d0bf1fee6c46a27024c023a4adb787d1b8ec4fd5ab402e6e0beb9c1b7 ALSA-2025:8183 Copyright 2025 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-4.el9_6.s390x.rpm e53ce4bb5ddbe77162cd4c41da57e4357faee84b1f555620060337e69589bd53 ALSA-2025:8333 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Use after Free in gru_set_context_option leading to kernel panic (CVE-2022-3424) * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.19.1.el9_6.s390x.rpm 58c7e70ab1432479d04b23045ff8c46e398097b4410fce4d26f1f0560fc4595b kernel-cross-headers-5.14.0-570.19.1.el9_6.s390x.rpm d3b25517128305443e8d0e4b1dcff419c6b6f3c5b392e614d752f4e2ba392877 ALSA-2025:8337 Copyright 2025 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: request smuggling attacks (CVE-2025-47905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default varnish-devel-6.6.2-6.el9_6.1.s390x.rpm 8357cfc03a1c0d3f54b82fa2085b9f76cb8e474bc3ed929bbbe843c8cd3f70a8 ALSA-2025:8643 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926) * kernel: vlan: enforce underlying device type (CVE-2025-21920) * kernel: xsk: fix an integer overflow in xp_create_and_assign_umem() (CVE-2025-21997) * kernel: net: fix geneve_opt length integer overflow (CVE-2025-22055) * kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785) * kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CVE-2025-37943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.21.1.el9_6.s390x.rpm 47dfb936866abebf425b11ef52c095c7fcedce68b28b24f55755dde726688346 kernel-cross-headers-5.14.0-570.21.1.el9_6.s390x.rpm 95cbff1fb09eeab89b3b087a912b406cdb961f6e0c4d20cea10a104b362b9f8a ALSA-2025:8655 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default glibc-nss-devel-2.34-168.el9_6.19.s390x.rpm 3527544122f1ac12114cf4dcc4de64b83a75eed5def1b1c6075ec2da324b4cec glibc-benchtests-2.34-168.el9_6.19.s390x.rpm 62b0759c67cbbdd1a18dd925ac0743cbd158357d6ae4702526cc054da56bbac4 glibc-static-2.34-168.el9_6.19.s390x.rpm dd598c4550d9a4be957da5d5a38d70e673fd48574ada53df5f8cc1a0e7f5265a nss_db-2.34-168.el9_6.19.s390x.rpm ec92c702bdc699907ef33bff6d1741168c0f7705f091d0d437660132e0721cae nss_hesiod-2.34-168.el9_6.19.s390x.rpm edbdf9a13b0c40bbb706993f60a5a22a750b123a911c16ade6e1a0c239e98b9b ALSA-2025:8813 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.117-1.el9_6.s390x.rpm 4bec9033d31aaf238c2c239f2911019434d11d3f0b33867863d4625f0477d82b ALSA-2025:8817 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.107-1.el9_6.s390x.rpm 0da8305cbaeb93892cdc20009968f755a87b3acd16f3e2b1c11f8bbb1fb66792 ALSA-2025:9080 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961) * kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (CVE-2025-21969) * kernel: cifs: Fix integer overflow while processing acdirmax mount option (CVE-2025-21963) * kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy (CVE-2025-21979) * kernel: proc: fix UAF in proc_get_inode() (CVE-2025-21999) * kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126) * kernel: smb: client: fix UAF in decryption with multichannel (CVE-2025-37750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.22.1.el9_6.s390x.rpm 8abe9d40bf5a80b7a26eb96ef6d8a0abe169b9243ce812244636ec7513597a66 libperf-5.14.0-570.22.1.el9_6.s390x.rpm d9e5331c821553ba2f58c9d97c7d010e0aaf90ba048afd477f1168c1a45f6a30 ALSA-2025:9114 Copyright 2025 AlmaLinux OS 0 1 Important

apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default apache-commons-beanutils-1.9.4-10.el9_6.noarch.rpm d5abbee0a7923ce4b894aea8eec8e6a87711d651ce8d72837dcad10c7084c5ca ALSA-2025:9118 Copyright 2025 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double-free in libvpx encoder (CVE-2025-5283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libvpx-devel-1.9.0-9.el9_6.s390x.rpm fdc47905259fcf6236ec6699877d546c9a7185874dae081e25514ebdd7286c4d ALSA-2025:9184 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.1.noarch.rpm 331040804a9215b0f5fbcec70e7f800344c4d1f1a1394413916a202c09c06a91 ALSA-2025:9302 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883) * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919) * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104) * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150) * kernel: ext4: ignore xattrs past end (CVE-2025-37738) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default libperf-5.14.0-570.23.1.el9_6.s390x.rpm 565cd0a3d701123822f5a70c483fd7b0834ebfd8a2d9c8f13d09e150d4d5e683 kernel-cross-headers-5.14.0-570.23.1.el9_6.s390x.rpm 8750dd7decb0542111e0bc7ad022e4d5bde1dafb21d28c7c382ddd2cabacd527 ALSA-2025:9303 Copyright 2025 AlmaLinux OS 0 1 Important

xorg-x11-server and xorg-x11-server-Xwayland security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default xorg-x11-server-devel-1.20.11-31.el9_6.s390x.rpm 92077d81d396f7d1d61377bb8530419f83367cef9ca49f59904168baed6b187d xorg-x11-server-Xwayland-devel-23.2.7-4.el9_6.s390x.rpm ad1a6dd583473c0123aeae396b58d4c3f45b2b42c461853ab5dc58a45cab8ba9 xorg-x11-server-source-1.20.11-31.el9_6.noarch.rpm d0597aa66c866770c5ea810962474f4c55c86264f84a5f75b4e92f416e1c22a3 ALSA-2025:9330 Copyright 2025 AlmaLinux OS 0 1 Important

perl-YAML-LibYAML security update

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby. Security Fix(es): * yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default perl-YAML-LibYAML-0.82-6.1.el9_6.s390x.rpm 0844fade9644e0ada1be8cf1b8c274c0b825145954e1d574649a0b09d50105b2 ALSA-2025:9462 Copyright 2025 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default qt5-qtbase-static-5.15.9-11.el9_6.s390x.rpm 52c398c2197e8a8f585870db287eaf882c6eac5ecc087a622622764899debe5d ALSA-2025:9517 Copyright 2025 AlmaLinux OS 0 1 Important

perl-File-Find-Rule security update

File::Find::Rule is a friendlier interface to File::Find. It allows you to build rules which specify the desired files and directories. Security Fix(es): * perl-file-find-rule: File::Find::Rule Arbitrary Code Execution (CVE-2011-10007) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default perl-File-Find-Rule-0.34-19.1.el9_6.noarch.rpm 6e134185b9d45a1f2b199fbad1e1785420082f93ed527bddb5aa6eb456432605 ALSA-2025:9877 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Vector register overwrite bug in glibc (CVE-2025-5702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default nss_db-2.34-168.el9_6.20.s390x.rpm 04671a6025fd5d2c5500236ab7b80ea951b695ef28b1d8725ce392a036c17b4b glibc-benchtests-2.34-168.el9_6.20.s390x.rpm 077b0bfc94e8d222bcefb036e396e130627b4ced44bdb46fdce5eec7ea628e20 nss_hesiod-2.34-168.el9_6.20.s390x.rpm 480e5c877f41276b04a61aa93e0853345ca7cd5eb069b8e4ac14465af6124aaa glibc-static-2.34-168.el9_6.20.s390x.rpm 973bfa0f8ce5ed098e4c1a3c8d27aa36dc2e7f26146285aa4644b100b5b74b8c glibc-nss-devel-2.34-168.el9_6.20.s390x.rpm ebfabfe123aa43add1e6777516439c42951f0649a3bdc9f62df3b73d9b228431 ALSA-2025:9880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.24.1.el9_6.s390x.rpm 7b74d4c48947ead46389f800a457b810cb67df16efbce6927d2191a49a2aab07 libperf-5.14.0-570.24.1.el9_6.s390x.rpm da2bce44a1d0c2a52dc002fa7cebbaaac5b02cda99475686cba508ad38a74efa ALSA-2026:0126 Copyright 2026 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default poppler-glib-doc-21.01.0-23.el9_7.noarch.rpm 2361e9dc4e8e5d5f1179ab44710407d24f216ee1d6c884ac602529632cff4d39 poppler-glib-devel-21.01.0-23.el9_7.s390x.rpm 2d6332d2441bbebbaad11a8155182d70591baad3cc70eecd6de0db4d1e422a56 poppler-cpp-devel-21.01.0-23.el9_7.s390x.rpm 42e0fe5634417656b9efb54cab7d6587e59d51667d630e278efd823b8c03a566 poppler-qt5-devel-21.01.0-23.el9_7.s390x.rpm 476d1002710a18740f1aed96955abbb9d3fd3bb0b7dc0aae01e82436335910fb poppler-devel-21.01.0-23.el9_7.s390x.rpm 7c50e83124735172961034bcbc0d44e3fbf7f331d37ad56f9639102466698ed2 ALSA-2026:0137 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default mariadb-test-10.5.29-3.el9_7.s390x.rpm 8f4dd9e8c0e8f5cffd077a0eb33707ebdad500d78f27d7baf2706b2701b2b729 mariadb-embedded-devel-10.5.29-3.el9_7.s390x.rpm 936b0253f100926fbb1633b45ef8c030e2b49ec686669223c4309143fba9dd2e mariadb-devel-10.5.29-3.el9_7.s390x.rpm 98944ad0bb4d9f93d79b4eac172723f13372ba10e675a1610aa51f92a7d96f1e ALSA-2026:0445 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806) * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.20.1.el9_7.s390x.rpm 7a5114eb2d4add3818b7efb7b2f16d69fdfc4da249dc2e4294aa81526aa90e44 kernel-cross-headers-5.14.0-611.20.1.el9_7.s390x.rpm c53c52320321ffe28cf1139edfcba55260abdbc7344dba6d02194d4abc0dda31 ALSA-2026:0491 Copyright 2026 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default postgresql-server-devel-13.23-1.el9_7.s390x.rpm 20f010c693b76bc037e419ef0db02f22917208c95afea2ce32b5bd8d08631d5e postgresql-private-devel-13.23-1.el9_7.s390x.rpm 2228a61497c4b1aeafd5ebcae1da9ec191ae4939ec3766b5baa08e0f362b0553 postgresql-test-rpm-macros-13.23-1.el9_7.noarch.rpm 8a5cd0ac240429ef34bfd5533793e0653bf11ce77496984eca7ac903213ae11d postgresql-test-13.23-1.el9_7.s390x.rpm d4736ec3c6618ffba109563cc22886934e781b3aaee37ea907b9fd1b4b6f97e1 postgresql-docs-13.23-1.el9_7.s390x.rpm dacd1f94f1814401531c6447ac051ccecfaf1541c292e2935fdcd052bf8ed642 postgresql-upgrade-devel-13.23-1.el9_7.s390x.rpm fb24fd488382fe0dd7ab0463c955a9602a50fac56cb6f7210b379247604ae887 postgresql-static-13.23-1.el9_7.s390x.rpm fdf3d608f256ab3ede3d3cff678aaa95bdc077d521d9121afc71d386c77dced6 ALSA-2026:0700 Copyright 2026 AlmaLinux OS 0 1 Moderate

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages. Security Fix(es): * xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default transfig-3.2.7b-11.el9_7.s390x.rpm c18c6cb20a4ff14f98be7f14c93e0097d79ccaade6461c1dea39cf906e5ae828 ALSA-2026:0793 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.24.1.el9_7.s390x.rpm 23115b67215e46f1bca3b70a4f700f339a7f2f8d1cbf5f2039debf42b3b0a97d kernel-cross-headers-5.14.0-611.24.1.el9_7.s390x.rpm eb334978e2c58e9f5e5dc6d4d73ec6124f14944f7be229ff79e120ce7eb2561d ALSA-2026:0927 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142862, AlmaLinux-142881, AlmaLinux-142882, AlmaLinux-142883, AlmaLinux-142884, AlmaLinux-142885, AlmaLinux-142886, AlmaLinux-142887, AlmaLinux-142888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-17-openjdk-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm 037893149f47aa6e7002c1dcf04c0d72aadbbbb991468ab28c621920d2860369 java-17-openjdk-devel-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm 51dee4d44feb1d779e217abf87e5b724b6365c6e6260ea7df8c7a33a23bb0818 java-17-openjdk-headless-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm 8eaf1f52a007dbd68298c00c415f134130dad9a088f37ff2ae48b2246273de16 java-17-openjdk-jmods-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm c8f6bef58bbd94ace8804dbabe60b608cc5a09f9b89b3db59309ec36e873830b java-17-openjdk-src-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm d2d798e841bf706d2f85bce765c2f98f50ba5848e0970712e9fc5223c3a4e69f java-17-openjdk-static-libs-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm f07a048717a921a976cca1cce64e5768c189ceaf680a807e11219f49539d8567 java-17-openjdk-demo-slowdebug-17.0.18.0.8-1.el9.alma.1.s390x.rpm f0a6ab9944c11b58dccd0af40113a6cd501f2f35880ce680743a9c41ca168cd2 ALSA-2026:0928 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142860, AlmaLinux-142876, AlmaLinux-142877, AlmaLinux-142878, AlmaLinux-142879, AlmaLinux-142880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-21-openjdk-static-libs-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm 2ae3981412dd1d7d449d7acdd8dd3033792724cb6b6acd24759161ba99fb1496 java-21-openjdk-src-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm 372ab1ba489881ff6763b5ce69fe4ac1026df8245035e77c3b2def3dc904276c java-21-openjdk-jmods-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm b54847c5a7a118a8e546acfbe661798dc20144e048696e71d67773177fe91c09 java-21-openjdk-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm d406d36a6c4ce15b9841dfecd3dfc328e6c746c5c3aa8c8a5a1a26103eb095f3 java-21-openjdk-headless-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm e480fab069d1b02676c591827fae81d7cbb7d1ab8b22501f359e1e91e6685151 java-21-openjdk-devel-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm ecdac096885b2d95fb9bbd26bdf29afb11b1bb79053998710a9e8ea72fdc80b6 java-21-openjdk-demo-slowdebug-21.0.10.0.7-1.el9.alma.1.s390x.rpm fc939ec8a9709918bb307cc7173b952a63af54a102b8220a10abc27fc58ad452 ALSA-2026:0933 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-25-openjdk-static-libs-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm 1539f2a58f39be6635df1507edd05a3790f117efb2170fdd381b6d12dc0a677f java-25-openjdk-headless-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm 8b2e059cd5caa827fe0d3ce61d49caafc69f18c6587839436b797cd42e8cdd3c java-25-openjdk-src-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm a49e86d4dde3a1c1f1067d3c5ff3cdf0423effa5bc19ca63b8a53252a8dba208 java-25-openjdk-devel-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm dfef9402f64a7f1b06016310707b934d1b9a6c39794b02b90e313995d48d1949 java-25-openjdk-jmods-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm ee263ac9cbb13125f6dc56562611fc2b9500597a931d8545b25bb0ac9b5a184a java-25-openjdk-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm eee28b87b2a5328779c87d6fd5b6136e73c45023cc2609f4b3bd533ea538a050 java-25-openjdk-demo-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm ef5b30385b658cf81f9670c9058300681d7d54cc19060d220572213b5d55b8db java-25-openjdk-crypto-adapter-slowdebug-25.0.2.0.10-1.el9.alma.1.s390x.rpm ff53d387169d73476de75359e204008444feaac7a8f2141980c49220cf85f788 ALSA-2026:0936 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.1.s390x.rpm 4aad953900096c3b476f2732e08adad257186a95e3c3f9c6cb9103569a2f6a12 ALSA-2026:10745 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.3.s390x.rpm 60b8c973531fa94b79a9eff562dfb58b0698a3317de9d0d37fe5a4d4f2318a1d python3.12-idle-3.12.12-4.el9_7.3.s390x.rpm 937f5e240780e74d82dd07a02be4af9aa256844bb70912912b4a334b77147bb6 python3.12-debug-3.12.12-4.el9_7.3.s390x.rpm b149c5a5364f763f6868a720dd44ae1378bd097aef79cbd5332de63c544c8c89 ALSA-2026:10774 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.11-test-3.11.13-5.3.el9_7.s390x.rpm 9b95433a02e3b650d761663ba7e3527910a9033a1dc4aa14b75b6cd9f6c3daf0 python3.11-debug-3.11.13-5.3.el9_7.s390x.rpm 9de35a73ddf8013768d88b5221adc879e206cdb677501969359c53bb153a6000 python3.11-idle-3.11.13-5.3.el9_7.s390x.rpm dfaef69ed48d0b15dd4fe8359bf8d3d3b4afb0774fc7b6d306446b72db0fed01 ALSA-2026:10949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.3.s390x.rpm 48ac940f61a9e4b81f2c6457dc5dc85ab22245d0f0a5251f43eeaf3086effcc5 python3-debug-3.9.25-3.el9_7.3.s390x.rpm 537779cf1e9b90aa98a01efb894a51ce4ef48e6c6821e14d3d4fc004797ca338 python3-idle-3.9.25-3.el9_7.3.s390x.rpm d1aa6efdb7c7823628e375790f112a3e98de43b33e453128682b423a23e7870e ALSA-2026:11369 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-6.el9_7.s390x.rpm 528b1d40ad653e8ee2d306d0f3950b691c953d9c82be48b0f4341bec99d40550 ALSA-2026:11388 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default xorg-x11-server-source-1.20.11-33.el9_7.noarch.rpm 7977bc9d7b343335f336cba8f279e8bdf48d3f7f820fe02724c0c96b17777138 xorg-x11-server-devel-1.20.11-33.el9_7.s390x.rpm b4bea9bb0ed9c043b17019665fc399cc3507f563aa3a21b62f85a60391e04e52 ALSA-2026:1143 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301) * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.26.1.el9_7.s390x.rpm 90724ce798731d9b7cc45c23bf042a10d750dda3af361e0d4bce532892611d5d kernel-cross-headers-5.14.0-611.26.1.el9_7.s390x.rpm d0ce27a6f5d91f633f84e3f0724d3d683cb2e49a853b9cf5c9e13862b6dc1867 ALSA-2026:11504 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default PackageKit-glib-devel-1.2.6-2.el9_7.s390x.rpm 77310c16ad5b4c714a5c30fc38363b73c43d8ae4df301bcf0ccc9bbe4174d54c ALSA-2026:12271 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.3.s390x.rpm c3adb0eaa948461d508369c09c61b2c02f5988f62947ac7271fa48bda2263a93 ALSA-2026:13565 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.54.1.el9_7.s390x.rpm 3edfb485095f06725210d627a6fa4e7f2bb3845c9cdfde4f17f693c7caa9735a libperf-5.14.0-611.54.1.el9_7.s390x.rpm 9d55dab5f5d5cb0bad6fee659b3ee75afbab234d7f9fe84685d9699bc8f4c5ff ALSA-2026:13673 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default corosync-vqsim-3.1.9-2.el9_7.1.s390x.rpm 43a5a53803c8f16b9509f7cdadfde1b0326847e0cd1f5e0f730c397c7d229437 ALSA-2026:13857 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default dovecot-devel-2.3.16-15.el9_7.1.s390x.rpm 0c764e54404277b8bd7b54d29f54a7923b3e6ba9189f8322354155d97fd07930 ALSA-2026:1408 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.s390x.rpm 55b4824872eb589027843217e6286bf151e869b48aeb6d3402fbdd94d9299a94 python3.12-idle-3.12.12-4.el9_7.s390x.rpm 7e3027d0b7e6a9ac0eea955aa8573f5ba05cb85102de9c8537ceef47eb05a3e2 python3.12-debug-3.12.12-4.el9_7.s390x.rpm baaf22e259d17194d1c01300d3ec045afebf3f5651992e2bb0abff68165008d6 ALSA-2026:1410 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.11-test-3.11.13-5.el9_7.s390x.rpm 66c839f2eb447f0a39a967cd0cf7fedeace10ec2da3c7c8cb53073fbbfee1613 python3.11-idle-3.11.13-5.el9_7.s390x.rpm b4d419d699dd2be8688da854a5b629bcfc01889aaa78edfb7ebdb9427630f59b python3.11-debug-3.11.13-5.el9_7.s390x.rpm d0e343fd11910c755ebb731662528417677c07e987186ef30bfff77f55f69444 ALSA-2026:1478 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.s390x.rpm 4db6b0e1bf78b0cfb5cb0d6d4ac6aad69c34e53af5044c137a7c01602b8a6ab6 python3-debug-3.9.25-3.el9_7.s390x.rpm 5ba57db28100186771e832570355d641a3f89532c531061f0751d49000d8c457 python3-idle-3.9.25-3.el9_7.s390x.rpm d9b1829773db277fab82f163b31bfa9070cee545b4ab8676edb12d3542e938fd ALSA-2026:14819 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default freeipmi-devel-1.6.17-1.el9_7.s390x.rpm bfac41e521a9decc324c9adbe093b2710a2212c6b95235e9a983c73b8bc22caf ALSA-2026:15887 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.2.s390x.rpm 88352674693e4361d194a5b9e59e8fe85ad5c8def0e54999d340c51a2f49e2cc ALSA-2026:15971 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.2.s390x.rpm 0689474f3315ca4529754017e2a53117c7b39d2aaefb0c249dcb87671e64a9c0 ALSA-2026:1617 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.27.1.el9_7.s390x.rpm ad7d83cd1406842e01be10fa9d86d3747b8bbfc097be5509439bcb72d8c5a061 kernel-cross-headers-5.14.0-611.27.1.el9_7.s390x.rpm bf9fd86d4870f3c38b88d6c536fb8eed30f8b931eb7696a57a28743c69c0c19e ALSA-2026:16206 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-611.55.1.el9_7.s390x.rpm 81cac20b38268c90a6c570b55e12fe4edf24d896c065bb7e84104fb477043eb5 kernel-cross-headers-5.14.0-611.55.1.el9_7.s390x.rpm 948b82a498a0e293ba346372ccc41bedd6d04b55d9ca9240569f3fe660d08013 ALSA-2026:16482 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.7.s390x.rpm 55515246ccf85418115dec240c78020e8d61edc88e8efbf32c93e95c31160676 freerdp-devel-2.11.7-1.el9_7.7.s390x.rpm c1c8947e6254a948eda31eb4cbb2fcddc9665a29a79a34874f3c38f879d6a9f7 ALSA-2026:16693 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default jq-devel-1.6-19.el9_7.0.2.s390x.rpm a934aac8200ebdaabee42f82f033ddfed9f9add3f1293069286fdaea4315512e ALSA-2026:18029 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.3.alma.1.s390x.rpm 109ff63561b23dfaf15aa8eb468adfe73547ad5742a1497cffaef2a42e3e341d ALSA-2026:18039 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default ruby-doc-3.0.7-166.el9_7.noarch.rpm dc441426fb8f8b1808179658f6ed2f8315c547c138f967c0ed5905c8f7bc328e ALSA-2026:18587 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bonding: check xdp prog when set bond mode (CVE-2025-22105) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (CVE-2025-38400) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.5.1.el9_8.s390x.rpm 35804b303300e9e37c0bb178e4f3f91945ff24996967078f0029cc111dbe507c libperf-5.14.0-687.5.1.el9_8.s390x.rpm c297dd15d28ac36604b890ec9d68c85528855b5c7bd25b72a9750b374dbf4463 ALSA-2026:18597 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-2.el9.s390x.rpm ca643b300e6ab33796487357dcb67f2861dbdb054d83058e7e77bfffce5a95c0 ALSA-2026:18748 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libvirt-docs-11.10.0-12.el9_8.alma.1.s390x.rpm 08f7649c27a971bf75eac7b4f92735cd31dfd263f0a1a5568bc9a00c566ac288 libvirt-daemon-plugin-sanlock-11.10.0-12.el9_8.alma.1.s390x.rpm 1ea74865bda9c40bca794499eecdabf5fbff55b1689a42e62a690f226ddd5861 libvirt-devel-11.10.0-12.el9_8.alma.1.s390x.rpm f667cff5bf2dbb87ef3e230a88b42c27e86292b9873ed9e8e4facf41c1fd94e8 ALSA-2026:18786 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.1.noarch.rpm 7a708ea0e5ade26de56d37e766f45520e410ae5dad31b2b35508a727f6a1907b bind-devel-9.16.23-40.el9_8.1.s390x.rpm a0fdc17175568f0948f5e1e7d915d18e7f7c05aa1363c3d676a724197802682e ALSA-2026:18824 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libluksmeta-devel-10-1.el9.s390x.rpm aed1a7ea7b38d4c2594d476e190225e33f0f8758215fc71883b4a24c6b175aa8 ALSA-2026:18931 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-2.el9.s390x.rpm a13a775c4bc49044761435e2e039a1e088338012726df7d28c6946c90a394fdf ALSA-2026:1913 Copyright 2026 AlmaLinux OS 0 1 Moderate

util-linux security update

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libsmartcols-devel-2.37.4-21.el9_7.s390x.rpm 14b8d12e65c9c2079c4643e0a3d9668290de38b601b75e9fe6c5d4ad020e3637 libfdisk-devel-2.37.4-21.el9_7.s390x.rpm a7fd0663ffb5c5f3220108b2b1b6ffcafec52211510dccd631f0eb2f08c438f0 ALSA-2026:19175 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.11-idle-3.11.13-9.el9_8.s390x.rpm 86439ee988129d48b9f2af879a2e166858b4a988deefa3d472f6fd89a4f10d1f python3.11-test-3.11.13-9.el9_8.s390x.rpm bd04c32f68bfbc05a5f544d9ae82498441349a226abe5d4e59e20f3f9d652206 python3.11-debug-3.11.13-9.el9_8.s390x.rpm eb04c613564f64c7bd3acf504e5c290e88cf35e2d90bd5f43dd96856214a3e08 ALSA-2026:19176 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.14-freethreading-idle-3.14.4-2.el9_8.s390x.rpm 0cf675cb6bdf12eec857deb6be189d44d5de3a882311e0ef47a8ce391c3ca836 python3.14-freethreading-debug-3.14.4-2.el9_8.s390x.rpm 0fc73e2b439cc3d1df2684f8cf9fba0fd07e37f8807cc3a27cd085868736c613 python3.14-freethreading-devel-3.14.4-2.el9_8.s390x.rpm 28be3b058ba0b1a7c37924349582b7a3a7b38bc1831a747f0fa5117dcd80345d python3.14-freethreading-3.14.4-2.el9_8.s390x.rpm 2eba6fdafb5b458b8e36d3f0b0f7016f67bf5d56bd0f936ffe0c41e444876a11 python3.14-freethreading-libs-3.14.4-2.el9_8.s390x.rpm 4febb46d2caf801ae168ff5f2c0d9f473ffa7b7283f5252660a893712b42422f python3.14-idle-3.14.4-2.el9_8.s390x.rpm 81aab0ee5afd9488155d32b4ec7dba3ec7168052c122ce84c25c690ba9206f53 python3.14-debug-3.14.4-2.el9_8.s390x.rpm 87549f24489334e41db9dbccffc09863e388408fd33931e95a5a66df948914c4 python3.14-freethreading-tkinter-3.14.4-2.el9_8.s390x.rpm bbde22d1f1e19d53b59c3a2cbf5773b00524993d13d663d9d04033259b2f8933 python3.14-test-3.14.4-2.el9_8.s390x.rpm eeba54463d2fbb361fe1ed30609964404a0b12f7fdc087831a9202d26a75e883 python3.14-freethreading-test-3.14.4-2.el9_8.s390x.rpm fb5272eb2996b260deff00c60ebbaa8827f0da0d882a3e0e00f622a87b193f71 ALSA-2026:19177 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.12-test-3.12.13-2.el9_8.s390x.rpm 174bb70361a8e949151bb259ad03d9ddfb14ddffa264f857d167a97b7ac841cd python3.12-idle-3.12.13-2.el9_8.s390x.rpm 2f5f1a8ffba92513dc569eedfbdbe50932ddf36df610fed45ecd7160b151c94d python3.12-debug-3.12.13-2.el9_8.s390x.rpm 6071f39ac4d02c6a64adffcac3cf436840123fa1eb19ab6258ee6d831daa2e63 ALSA-2026:19180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.s390x.rpm e28e19a58b21d83e636ee27c43492535842521f32a805e59af16d020068ae8bf ALSA-2026:19200 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.1.s390x.rpm 018bfb509179a82900296f272fc097c1ecd6c5c5cdf6545649f363e11273c56f ALSA-2026:19208 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freeipmi-devel-1.6.17-1.el9_8.s390x.rpm 6edfdd3c1e89f5d1892b3f28ad22ecdf086a018e2df8ff92d7290951c4395eee ALSA-2026:19216 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-test-3.9.25-7.el9_8.s390x.rpm 3b811b67d938bc2c4f8cb8e0ad1e5800baedda7f54c9b907518533b4f1d63406 python3-idle-3.9.25-7.el9_8.s390x.rpm b699204cace8fa47def46ebb571dd45354932471331ff6fb8234c57c132d63fd python3-debug-3.9.25-7.el9_8.s390x.rpm cd943682e54af8bb6ce5cc9d98b5d0bbdf9c6add46fb07b4c39f634d059dc98d ALSA-2026:19225 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.5.3.el9_8.s390x.rpm db6233d5c1cbc8865a70b660e2b1f741152527d2ad9f24fd9fd4c930d31437b5 libperf-5.14.0-687.5.3.el9_8.s390x.rpm f6a77ba4e1c3e175b43da53b18b955de06e30df7188541b295e82c26330ed8fc ALSA-2026:19343 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.noarch.rpm bb78b968af0f2f81e05afecea1ae46d98b6de0d70d3568bef2d7a8d1c64117a1 xorg-x11-server-devel-1.20.11-34.el9_8.s390x.rpm fa4e224b60a6b2fafa161a92f76f5b5c5e8a8cbaea713766fda2cdd3162da504 ALSA-2026:19344 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.s390x.rpm 53066d085e7e008b95a2327e86cda5da7bd31c43097330a86c62e66d4a613ce3 ALSA-2026:19354 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default PackageKit-glib-devel-1.2.6-2.el9_8.s390x.rpm e3bb3bb6da874061630675975b1064d5c6e267dd622b6fd29193baf1023ec6e6 ALSA-2026:19358 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.3.s390x.rpm 0d6765ea38a8cbdf3c24b41a30e6ef675df701cd7e4f99a8cbd38327f311b189 libwinpr-devel-2.11.7-7.el9_8.3.s390x.rpm 348d3b4ac5e51b6ff7347914ae6131790ccf891aa53f306a5c6811761eadfff3 ALSA-2026:19359 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.2.s390x.rpm 97f3c4167b5c6bb9771b44a2f60818d160cd27d258334c623a47e3311a6ec78b ALSA-2026:19361 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.1.s390x.rpm 0c776a78c7285669a8d5a8f68d236034e6854f2155b98d495b5109a9d5f5c0fc ALSA-2026:19363 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.s390x.rpm ffcc3473ece550ca222246abc2df3ec06c5916ae712e0b989f76f1347970f4ce ALSA-2026:19364 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.s390x.rpm 5fc4ca48cb13320837014b8a7e09f9f28260f6df078b1786854424285fd6c89a ALSA-2026:19365 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default jq-devel-1.6-19.el9_8.2.s390x.rpm c62d4768b38acf5e2211fbc27f053ba35504755b39ecac154cde984db66e8edc ALSA-2026:19367 Copyright 2026 AlmaLinux OS 0 1 Important

giflib update

Please update For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.1.s390x.rpm 6623f65e2ecafdccf1af1c838cb6785f712a96d67413d8bfd07619721423233d ALSA-2026:19374 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.2.alma.1.s390x.rpm 30e51fe9852fefa5e54e39482e7d616d0cc4e7db685dbe3d3f02d80dcc8561a5 ALSA-2026:1939 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12-wheel security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-wheel-wheel-0.41.2-3.el9_7.1.noarch.rpm 436b6074dfdf7f27a4a5213aa406d06839c5599bd4ffee848fcac89755ee127a ALSA-2026:19568 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.10.1.el9_8.s390x.rpm 84807fa8173ab3326521f367fffcd78d1fc0f0994c27e29808d4e5dcd77fd8d2 kernel-cross-headers-5.14.0-687.10.1.el9_8.s390x.rpm ea8dab30a584f174c8d551ea4f4d389907194acdc1911715a0889dbeffa32b3b ALSA-2026:19610 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libsndfile-devel-1.0.31-9.el9_8.1.s390x.rpm e06c3cbd398f4ad36d9cd43474eb458be39131f491a2849fdbe061b8bffa03af ALSA-2026:2039 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default fontforge-20201107-7.el9_7.s390x.rpm acf6b292ddf457351a598b2540ba7136db808efafa92c6747fb30f036755326a ALSA-2026:2048 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.1.s390x.rpm 21167e5d5a7a6ad971ccfeb12710bb95eb785a0915590b67fce48fc24f443782 libwinpr-devel-2.11.7-1.el9_7.1.s390x.rpm bc2dcb96ea4d92522994a5a6e9f7a20622fb68555c435832da032c86dbb5ddf6 ALSA-2026:20597 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nss_db-2.34-270.el9_8.s390x.rpm 391226d16daae5f785a2cd4be4d8cf001e911df2f47f897467ca092b903797cc glibc-static-2.34-270.el9_8.s390x.rpm 51af86ba5e79776d1469556ffb69835f5d6159a3e937df8120ad5a2067ee5210 nss_hesiod-2.34-270.el9_8.s390x.rpm 675e3b1ccdb510599ec1b1b33426a86ecbb9c0f107120e0b7bd5d13007dddeb7 glibc-nss-devel-2.34-270.el9_8.s390x.rpm f56eb3ec4ef5fda822c57bd3b3398d0ef7778d3d08e2b1c0c8bd8dc5b94b353f glibc-benchtests-2.34-270.el9_8.s390x.rpm fe9d3f4d0bbd0421ac7299a74cdc87fadb31b63f262cb1fda9853a9df4eb1610 ALSA-2026:21293 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.127-1.el9_8.s390x.rpm bc8783a6b011c507baf3da14de2e59eab2e1939bace955b6a8e1703a836b2483 ALSA-2026:21296 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.117-1.el9_8.s390x.rpm 354790bd2ad65a40c54a2ad8cdac38e4032296a5854e8e1a7c5c01450d977a8c ALSA-2026:21297 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.el9_8.s390x.rpm 281438456c2062ccdd62aa91629c4a21fd7defa4e675340f3bc867dc4c70f152 ALSA-2026:21556 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.12.1.el9_8.s390x.rpm 0eade571d5690f3a60510aea976a94db69bbb4a905820f3e81f5a8462cc8e31f libperf-5.14.0-687.12.1.el9_8.s390x.rpm 92947b1f605e8e95c6569dced01269ec2b6ff00040394b0b4c10437bae4a2ebe ALSA-2026:21755 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.1.s390x.rpm 6ff49228d0de9a7699a2a9ae25bcf4388d965789bbab852e32946bd538723369 ALSA-2026:2212 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789) * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022) * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024) * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415) * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459) * kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269) * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.30.1.el9_7.s390x.rpm 34af5ef541f35789cf31187bf449e8bb899a923b91c3824fa4af89e2f2259c08 libperf-5.14.0-611.30.1.el9_7.s390x.rpm 50c38c58c0b4e8b8dded810d83456ffee924d2745eea9243954fb0ef0f54aeb9 ALSA-2026:22553 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Information disclosure and crashes via integer overflow in Nikon MakerNote handling (CVE-2026-40385) * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libexif-devel-0.6.22-6.el9_8.1.s390x.rpm e4b3ed8fd2d6176b3e8a05e4af43c0bbe41e74454e9df94725bbf6f348ab74e8 ALSA-2026:23332 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-34293) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34267) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default mysql-test-8.0.46-1.el9_8.s390x.rpm 0ad8d3cb548c1aa8ba2fdba32467d9e6a1e48774f51feae9783e62de8cfde368 mysql-devel-8.0.46-1.el9_8.s390x.rpm 13ab5c0e8b4b4dc8b82f23ca546210c03239777c10b68cd02ab03180580dcfff ALSA-2026:24367 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.2.noarch.rpm 61557bd6cb05170436252e5a32b80a4d838bbf099ce27f4a5fbaafc9065f9b18 bind-devel-9.16.23-40.el9_8.2.s390x.rpm b7880408eaace2b1cb56fbde44268f0c181c97ea016d630bafa4d7363c338ccb ALSA-2026:24368 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.2.noarch.rpm 68a27d03850179ffcde06f989314cd19345ba7c77add31751ac85aa364d71405 bind9.18-devel-9.18.29-14.el9_8.2.s390x.rpm adc0fcc39a325a13e46ca73a0601e8d9175a8afe8dab3f6611d9b6a9118d814e ALSA-2026:24369 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.1.s390x.rpm 1a33c0bc6421ad6f2bec6d70d8aff27c112ce9a9e4fc3d0a212bb700f0e5199a ALSA-2026:24381 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.13.1.el9_8.s390x.rpm fa619b0d86ee8e9fbde9e659475369dfebe2677cb94ec572499e2658e4c77adf libperf-5.14.0-687.13.1.el9_8.s390x.rpm ff82c732d618322fef96a7db152fbc74f5cfaf4fe882802c9d88a4e845c058b4 ALSA-2026:25049 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libldb-devel-4.23.5-10.el9_8.s390x.rpm 09455e9d4a9aaed2c69448902a06a8e64f8f4e171c35f9cd0649f11ed5432280 libnetapi-devel-4.23.5-10.el9_8.s390x.rpm 3284d2f1330946968d61a2d1cdfa86852ebab0fac4febeb84dcf6be08d19b02e libsmbclient-devel-4.23.5-10.el9_8.s390x.rpm 69a6f77a25155482b894250b1fada116318b6fc065a558121ec4f838a5b9dba4 python3-samba-test-4.23.5-10.el9_8.s390x.rpm 6a9b9bbdc9679388043ae87969e4b63f910a44c083417517a9bbdc574e1730b9 samba-test-libs-4.23.5-10.el9_8.s390x.rpm 7065baf95f4a60748e536fae487fc00a971225c64417c8f88c916a77c11c0c42 samba-pidl-4.23.5-10.el9_8.noarch.rpm 82b6ede34ba8fb9ae0ea99f63c89050c550ba4960dcf6c895a11e28b43981c3a samba-devel-4.23.5-10.el9_8.s390x.rpm 8a1be6823f8a0135031b10a02a20fd4af8a9b067f35d40881464e270aa937f61 samba-test-4.23.5-10.el9_8.s390x.rpm acd784a489bc9a4aaefe3b84e96cfc9fd58dde13a17dd11cb0c27452fcea629c libwbclient-devel-4.23.5-10.el9_8.s390x.rpm ea57752fc2c1f537fad4a60fceb5d6c4fbaaec5398dba6b5822fffa655ffae73 ALSA-2026:25051 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libyang-devel-doc-2.1.148-1.el9_8.1.s390x.rpm 9ac01fcfe2eb6bdaa6d395d152999ae2c4e23a78acfcad95f4909922fb05f1fc libyang-devel-2.1.148-1.el9_8.1.s390x.rpm b187b1a26377b46cd1b6f5125c9e076b4f78de435b6397774a479bbfc363d8b6 ALSA-2026:25058 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default poppler-cpp-devel-21.01.0-24.el9_8.1.s390x.rpm 0d83597c100406bb21856cc909f368ead169b46213bfbfd49187c0f047f555b7 poppler-devel-21.01.0-24.el9_8.1.s390x.rpm 0f485d656f7e3d3aa098a6069bffcdafe737247d05e0f712c4f532804513a802 poppler-glib-doc-21.01.0-24.el9_8.1.noarch.rpm 5d072daa7f6d715a1e707ca4de274071d907d17358f4152524745c4d42ea6ba2 poppler-qt5-devel-21.01.0-24.el9_8.1.s390x.rpm 99fb028272fb263ca0814d5c1e409301df989bb19f5531a0f2a23df84f9dde7f poppler-glib-devel-21.01.0-24.el9_8.1.s390x.rpm 9ce3e8087edbc11daf757e7f9bb36b67e46c5ffcf3f0c0321551c5e0f7bd67b2 ALSA-2026:25217 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.15.1.el9_8.s390x.rpm 44e3aac53640288a5e476959c1af898f24cfbd25f12bd7f9d664f96f68943b4f libperf-5.14.0-687.15.1.el9_8.s390x.rpm 4b12fd27887f1f02abbc2b887155d6ddb8063dc3b66e92c3aa236b8bf2e5084d ALSA-2026:25220 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.el9_8.s390x.rpm ec89d95257e76ae80a0aaa014c463a6a3cd96629d3d74045367b0fe1a368658f ALSA-2026:25221 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.el9_8.s390x.rpm ddb51d2391e4cc832671464bb8cb571cad6e746c3ca4b8ecafa50578d1f9dae3 ALSA-2026:25222 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.el9_8.s390x.rpm a74393b8e1ae8a29a8941a153c3ba3f9a807d996b6fe3d681cc7238839ef98ba ALSA-2026:26455 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064) Bug Fix(es) and Enhancement(s): * Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [almalinux-9.8.z] (JIRA:AlmaLinux-152356) * Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [almalinux-9.8.z] (JIRA:AlmaLinux-168967) * DS 12 does not handle escape char in bind user [almalinux-9.8.z] (JIRA:AlmaLinux-170269) * [RFE] Add OS-level thread names to all server threads [almalinux-9.8.z] (JIRA:AlmaLinux-174524) * Online export is failing when using the option "-s" [almalinux-9.8.z] (JIRA:AlmaLinux-180716) * Server shutdown during online reindex may lead to data loss [almalinux-9.8.z] (JIRA:AlmaLinux-183895) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-7.el9_8.s390x.rpm 4bb7a929716f23c6a1b3748efb1edf582201a1ddc7ec1a33affb1f378f12f14c ALSA-2026:26590 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.2.s390x.rpm de9911def1fb22db2b04cd5068444aa7f38fd10a769c82c2d6df7e68e338113d ALSA-2026:26610 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security, bug fix, and enhancement update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xserver] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184288) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.2.s390x.rpm c1f4f3f401c0b6e12693a10a06805a45afff7051c56630da9e1ccac3d9469761 xorg-x11-server-source-1.20.11-34.el9_8.2.noarch.rpm fe8d7b998faa3cd785e1f21616963da47934a541405c9daba0277692995ea4cd ALSA-2026:2722 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034) * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304) * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322) * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349) * kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811) * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.34.1.el9_7.s390x.rpm dd842918ab9e5e3d8d785eb8413cdef1b675a7441e4faee5e6f9f381d204eff0 libperf-5.14.0-611.34.1.el9_7.s390x.rpm f90d79371215def4c11f0aa53a345ebc4db53b4041071bcc75bdbff12efe5562 ALSA-2026:27741 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default postgresql-docs-13.23-3.el9_8.s390x.rpm 0d792829e22db403d7be92eebbf11aadf9dccc9db240f2338e056cee3ab9ebba postgresql-upgrade-devel-13.23-3.el9_8.s390x.rpm 117bed0f332054bc41f18cfdc4387f2b5a1ee1c968d6a28954f6b37a8832294f postgresql-static-13.23-3.el9_8.s390x.rpm 1ee3f0f1dd2cf41391de3dfd128f2006fe36e2e1c498ce81929597897c46d703 postgresql-server-devel-13.23-3.el9_8.s390x.rpm 318e322fc4564c096e560957de128c299e4c39c4da433e6c94eaf4a18e815255 postgresql-test-13.23-3.el9_8.s390x.rpm bba99519b56a7f496adbe179e40f8f3eb7fabbb54413ee4b011ca3709248239e postgresql-private-devel-13.23-3.el9_8.s390x.rpm bf70c4551eb311ea58b595ce1c1d9db6016a0f991a3b29fa773b7dd366733313 postgresql-test-rpm-macros-13.23-3.el9_8.noarch.rpm f6060fb4be90b694977de0b268823c300ea7bb804cc5da4363f78ccda9909d03 ALSA-2026:2776 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default edk2-tools-doc-20241117-4.el9_7.3.noarch.rpm 4b87347bffd1678e7310392c107ce78ebc719dac11d389efe0562315bfe5e98b edk2-ovmf-20241117-4.el9_7.3.noarch.rpm b5e7af0c61e51f6617ef9d9b9ae4fc554d01d0de332dade45c8bb7304457a20d edk2-aarch64-20241117-4.el9_7.3.noarch.rpm c529f43a57b1378db756550bd605d19c555f6d0c4d1b8d34861e2a5c1bfb655e ALSA-2026:27789 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048) * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699) * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820) * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823) * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308) * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.17.1.el9_8.s390x.rpm 054eee51bbc1e4fe6bf5becfa4786b316b74fefb7517a110b7f54aa6d9a42937 kernel-cross-headers-5.14.0-687.17.1.el9_8.s390x.rpm 3d1027e5e2a3f321bfdb1daf227b586f372623da707da1a7e6655c65b197e9a0 ALSA-2026:2786 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861) * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915) * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default glibc-benchtests-2.34-231.el9_7.10.s390x.rpm 078971c58da9cb5087e375991384f879a28e4df9f579f291373b4cf1e0053b7a glibc-nss-devel-2.34-231.el9_7.10.s390x.rpm 1aaf33ea9ce8a34d16b8e739573f9c07c9fb2be6fd2a01eef52b14b3617c5aaa nss_db-2.34-231.el9_7.10.s390x.rpm 2417bf392a7b6301dcbcea91fa6f09b5854833db45808129480b52e6ac5a4301 nss_hesiod-2.34-231.el9_7.10.s390x.rpm 300026a31632a2b71ce827f52760176d66318ea409ced05572a60d40ddcf160e glibc-static-2.34-231.el9_7.10.s390x.rpm 92514c31f73c1a472ec6b5e67fb6d23816447b6b36ed2ceeccc5b23605fcabf6 ALSA-2026:28247 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.14-freethreading-idle-3.14.5-1.el9_8.s390x.rpm 04a694a49105971335df5431d6fcae5df69183b8b0986537d6af4b228070246a python3.14-idle-3.14.5-1.el9_8.s390x.rpm 30ebd0bd86ddd207cf11c531ecc773adb12b5c7df57408deb4c00679c9789956 python3.14-test-3.14.5-1.el9_8.s390x.rpm 3222607449d0d6abc3c9866b4afb43f4125e1632991f0dc75befc348b91b9131 python3.14-freethreading-tkinter-3.14.5-1.el9_8.s390x.rpm 4c782f6d3ae4ba9dba7357a3897b264d24577edcc95892100efa7ee53a3be423 python3.14-freethreading-test-3.14.5-1.el9_8.s390x.rpm 655c77eecae5577045c210ead563de92bee964399cebfdcba3d84aaa22c769e2 python3.14-freethreading-3.14.5-1.el9_8.s390x.rpm 7527350ef6e1512842f386c0196296a52bd5aba8306db3a37e59421fc9c3949c python3.14-freethreading-debug-3.14.5-1.el9_8.s390x.rpm 75ae99ec597a8f874372427e28c02b0be7a3bc7d01936319cec091fae2946090 python3.14-freethreading-libs-3.14.5-1.el9_8.s390x.rpm 9d15bfaff0e921d2dd764a0e15e54cf686a0ad9b404b91ab2e387c8382b3f1ba python3.14-freethreading-devel-3.14.5-1.el9_8.s390x.rpm d47d4dc06c89e0d797443a84c6235140ab8a19f4900ff92cf9a214ceff07fec8 python3.14-debug-3.14.5-1.el9_8.s390x.rpm f12ff9b087a6e070d0e77267b26dcb395e9810f5a9c06e1babff9657396870f7 ALSA-2026:28256 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects (CVE-2026-40253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default opencryptoki-devel-3.26.0-2.el9_8.2.s390x.rpm 628fb8592155a043eae76f553af81a52f9265d861416ff9e40c732d6af4eea7a ALSA-2026:28973 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.3.alma.1.s390x.rpm 3dab7011dff0db91ca7af89d2fdf47409ab82b6e11177460fe265603e7e34d8f ALSA-2026:3034 Copyright 2026 AlmaLinux OS 0 1 Important

munge security update

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): * MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default munge-devel-0.5.13-14.el9_7.s390x.rpm 8b0d7a6446fef065c2bfeb38e6c252054ec66f130173fbeae2d7c3d11e55677b ALSA-2026:3066 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: page_pool: Fix use-after-free in page_pool_recycle_in_ring (CVE-2025-38129) * kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.35.1.el9_7.s390x.rpm 86fa7494b7e314567d2a71953ae925da3df37f77eeacbfa3fa232752331ca3d0 libperf-5.14.0-611.35.1.el9_7.s390x.rpm e6fdccadf42fbb3dba19d65a50988881ccb45700b576f28aa320fffc266ed891 ALSA-2026:3067 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855) * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.2.s390x.rpm 191c77d4f70197e67a5a0a008762a2406047798b85713f0d777b7eef630e74cc libwinpr-devel-2.11.7-1.el9_7.2.s390x.rpm 3347bef309454e13124a1355e3354cba1e863d55c71039b5b9c475ed65289b36 ALSA-2026:30848 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:AlmaLinux-169057) * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [almalinux-9.8.z] (JIRA:AlmaLinux-172993) * nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [almalinux-9.8.z] (JIRA:AlmaLinux-178273) * sched/fair: Skip sched_balance_running cmpxchg when balance is not due [almalinux-9.8.z] (JIRA:AlmaLinux-182776) * [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [almalinux-9.8.z] (JIRA:AlmaLinux-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.19.1.el9_8.s390x.rpm 0c07588da2a15ff2e8f454daa11c29ef71ccfa95dd86b066d9d7619a29b24f58 kernel-cross-headers-5.14.0-687.19.1.el9_8.s390x.rpm 6a611fdfde973f1413ef58698c3a96364bba3bedfab7d525d14b3f67346e865c ALSA-2026:3095 Copyright 2026 AlmaLinux OS 0 1 Important

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default protobuf-compiler-3.14.0-17.el9_7.s390x.rpm 62e40c78e4ada992377e4885fea3e9ffb6d5705c021388b0749498d123c61f51 protobuf-lite-devel-3.14.0-17.el9_7.s390x.rpm a57f00630bec15232628a0cc78888cfea46b0f3a01acf868e9bc15ea1c80daff protobuf-devel-3.14.0-17.el9_7.s390x.rpm bb774d46d16d95eecd66498cddd35ce041e21255c96f5d60ecb781b8512ed6f1 ALSA-2026:3189 Copyright 2026 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default 389-ds-base-devel-2.7.0-10.el9_7.s390x.rpm 39470f5c383873804d7c606bd0577236b0a2280620b9ce721c1f57d701eea70d ALSA-2026:33226 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * glibc: counter overflow in __wcsmbs_clone_conv if setlocale is called (JIRA:AlmaLinux-145156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nss_db-2.34-272.el9_8.s390x.rpm 096030d50da52bec1a76c55f6f3696df3b1d8fa37363b1e1627a5b99f84353ca glibc-static-2.34-272.el9_8.s390x.rpm 66f722390c40e42015ed34197f14a878131491e2fcd0bae470ea9bccf3a32b3a glibc-benchtests-2.34-272.el9_8.s390x.rpm c84cf8b80ae051fc7b3d25463e8ad531d8add7e6726c1bdefb41b791871e228a nss_hesiod-2.34-272.el9_8.s390x.rpm c9b3a9f3f0f58bee22e12a25484cbecdd7c45a73cae04fb18fe43492f9829fba glibc-nss-devel-2.34-272.el9_8.s390x.rpm e0c10380e074a6b3a8f9ba70be73e7dd369f50bf4a92c8deab7c197fec34a9cd ALSA-2026:33285 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9.8 Bug] qla2xxx flash image validation failure [almalinux-9.8.z] (JIRA:AlmaLinux-181886) * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-9.8.z] (JIRA:AlmaLinux-182540) * tegra-se fixes and updates [almalinux-9.8.z] (JIRA:AlmaLinux-182760) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.20.1.el9_8.s390x.rpm 25706344357f3924f70e09af9589e34c9bed9d65c1e0a2272ed546750e123b48 kernel-cross-headers-5.14.0-687.20.1.el9_8.s390x.rpm 8f0f40dbe672a2914a984498dabc58278b6770a50fb5233a4a646ca158eb03f5 ALSA-2026:33501 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.2.s390x.rpm bb79604f64fa83c931434d27150fd57033c5411a03683a0934629e930cb1981d ALSA-2026:33512 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default ruby-doc-3.0.7-167.el9_8.noarch.rpm b8f118e66d4cfca0e379d47fc279003251a1a7a6c5748e8cd32d51a663c369af ALSA-2026:34156 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default rrdtool-devel-1.7.2-22.el9_8.s390x.rpm 04bdd8954872c6b2954d6a579d06753ddcf3ce449740d44cb57f9062df78b407 rrdtool-ruby-1.7.2-22.el9_8.s390x.rpm 21188a45eddf1d43a5c922b16a62c4810bb11811a03036c8be64aa91ab702ecf rrdtool-tcl-1.7.2-22.el9_8.s390x.rpm 296c1498f0a8ff8af7ca3d9c2622808ddbd324d5072c6dae0dc71d7375bbf8d1 rrdtool-lua-1.7.2-22.el9_8.s390x.rpm 6051bc32bb6758a5e00de1c96a725940fb763f1c9ce81ed5801f350b1c801ed7 python3-rrdtool-1.7.2-22.el9_8.s390x.rpm b46a6a56bb44f73f4ca286f1423c7ff7c974cc6c3dbcaf6a728cdfb6dad29866 rrdtool-doc-1.7.2-22.el9_8.s390x.rpm e27b42e9d31a46eca2fcd204d61cf77bf8b73a6815d6a576192033d5bc22be4f ALSA-2026:3488 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.36.1.el9_7.s390x.rpm 0953c3a0805a53c3fe1a6dd171072a14ea07531aae0e8f69ee134a60c999d226 kernel-cross-headers-5.14.0-611.36.1.el9_7.s390x.rpm 7399ed9c3ceb839b07e176c6e129e8adb7a15ca5b0a8938ecd8a83bfd94c173f ALSA-2026:36018 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [almalinux-9.8.z] (JIRA:AlmaLinux-160966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.22.1.el9_8.s390x.rpm 46e62eb6ab297b4f87a3059b61f5063628ca60d4146a59a1ddf34ff267030ce9 kernel-cross-headers-5.14.0-687.22.1.el9_8.s390x.rpm 8092f51888fd6a3e916a6bda640386f5c24a6701e7e670041a98a71a017304d6 ALSA-2026:36187 Copyright 2026 AlmaLinux OS 0 1 Important

perl-HTTP-Daemon security update

The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests. Security Fix(es): * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default perl-HTTP-Daemon-6.12-6.el9_8.1.noarch.rpm 7ccd0b8da3d5b0145c065678e99330c75c2530fc2eb51d3841c2d6293f6eb0e9 ALSA-2026:36195 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-8.el9_8.s390x.rpm cf72aeb6fd9b2c481459d338c3cef8ebfb9b1861dc0d4e66ebbb20ee02b7050e ALSA-2026:36210 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freeipmi-devel-1.6.18-1.el9_8.s390x.rpm a5064e61d777acc027e270067e5ce6eabd2260d39370a76f8316934616c4496d ALSA-2026:36331 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-9.8.z] (JIRA:AlmaLinux-190800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.4.alma.1.s390x.rpm 7f42deae2bf33725fcf8485ae1e457f4f3f6da9cb1d608d507e2ed96034fda85 ALSA-2026:36645 Copyright 2026 AlmaLinux OS 0 1 Important

kernel update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) Bug Fix(es) and Enhancement(s): * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite [almalinux-9.8.z] (JIRA:AlmaLinux-182344) * [AlmaLinux 9] Bonding reports unknown speed/duplex for tg3 interface [almalinux-9.8.z] (JIRA:AlmaLinux-182768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.23.1.el9_8.s390x.rpm 9e4b22d6bd93fbe8ad57e97467ed4c7d991b9aa14a0cbee065e2c8cfe0b75976 libperf-5.14.0-687.23.1.el9_8.s390x.rpm b283dbac642f3938f755cb8ec7c2b3940ae03f32eb0f1035eb92490525dcaf11 ALSA-2026:36777 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.2.s390x.rpm 83ebffaecfdcc2d38a7f7de6c67036e61efd0d15ddb448f8aa12c6d03ba0c7b7 ALSA-2026:36834 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.s390x.rpm b368c6b180d9303b7df361a0501d7cc1ea6b5ead9145ac9dc425f71b90d96a23 ALSA-2026:36957 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.24.1.el9_8.s390x.rpm cae70525e6ed741253f79b8b1236cdeae252644f0caeb89aceca99b2a6a59a63 kernel-cross-headers-5.14.0-687.24.1.el9_8.s390x.rpm d47682124c0fec7658bfc0062445f424045b35a07abe8c1e0e5dad78d986120c ALSA-2026:37207 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.4.s390x.rpm 068f5484a29f945176707d383ce8f0bf91fed555c18f4a8127fc3f0be9f255d8 freerdp-devel-2.11.7-7.el9_8.4.s390x.rpm ed1d8436875fc3c6ba98dd460dba3c867616e36e3500f6336bbbab8067d12fe6 ALSA-2026:3730 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default postgresql-docs-13.23-2.el9_7.s390x.rpm 384aaa1a64a7f2819f3eba7671cc4c229e6dc2af0a4b63a2e488aa993428363b postgresql-test-13.23-2.el9_7.s390x.rpm 5200032bae054878d387d6d0e0385b4e29e37fdd7f08000e36540849c97bd2f9 postgresql-private-devel-13.23-2.el9_7.s390x.rpm 8657bd7ec627ed119e04ef960cae7d723980a207be7b90c3352017aa585f6239 postgresql-server-devel-13.23-2.el9_7.s390x.rpm 915147fb48ac0c69d95fb31c2224e7b8f766476e14376e129060a08c9574cde4 postgresql-test-rpm-macros-13.23-2.el9_7.noarch.rpm 9bc6f1d37d6520e5f2e03b04c3ae18345783ee6bd8725a4785f7fcfd8df0d299 postgresql-static-13.23-2.el9_7.s390x.rpm b58ca89c5fbf0ee4e29549de36aee1d99a114c9f1ea96445408d4ce8ad2ddf59 postgresql-upgrade-devel-13.23-2.el9_7.s390x.rpm c5d9b493ca0c2aa7c7d4f89e89fd4138ade064ebb372a4e61f52bf92a53303f8 ALSA-2026:38486 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.3.noarch.rpm 48499a138a6f93c1ab1264a01a39bb13c0536e0479c9928d112ae873477ec932 xorg-x11-server-devel-1.20.11-34.el9_8.3.s390x.rpm facc020114b01c2ea7c54942ebe9ae392522ec0612a57c923ec5645e3e7f425c ALSA-2026:38490 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3.s390x.rpm 913754a1fa1cfe61aba86a9f0c870c91ee4d63d58f2605f0b0175fea15befc5e ALSA-2026:38491 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) Bug Fix(es) and Enhancement(s): * Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.25.1.el9_8.s390x.rpm 56a9251166f20dfae15ffa1ba2755b7443006be8ae02b023b2792f52e17b8749 libperf-5.14.0-687.25.1.el9_8.s390x.rpm d53a2521685a2a6ef4eef39e74a4b3c2f5c5f4a4294b9d26f3211adc7fe31b54 ALSA-2026:38498 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.3.s390x.rpm 15b8db6a2ab65d11093128d4a7a35793b6e39970ed2add3b084ffe1c2b55ed6a ALSA-2026:39309 Copyright 2026 AlmaLinux OS 0 1 Low

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-capstone-4.0.2-13.el9_8.s390x.rpm 62d1b88f9f15d4d1d96f60ef36919f0c00401c3e5ac05328983927000cb91026 capstone-devel-4.0.2-13.el9_8.s390x.rpm b8ebd88154ea87c4da8dca53b833d8bd1c1cabb8efb0d8fde573a6fe28c5517e capstone-java-4.0.2-13.el9_8.noarch.rpm dc79dd0cf954c31a91b07d6c72a509f4dd1e0d453e13741b7bc54e876124392e ALSA-2026:39315 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libsolv-tools-0.7.24-6.el9_8.s390x.rpm 826e8bf07117284acb3a6fc8fa9ca3dcb3b0627d22aba75a3a288130a3cd1742 libsolv-devel-0.7.24-6.el9_8.s390x.rpm d5d0c4ab31a89fb5ba485ede0887949aee846f7f87ccf30e24cdeb41e8446941 ALSA-2026:3940 Copyright 2026 AlmaLinux OS 0 1 Moderate

nfs-utils security update

The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools, which provides better performance than the traditional Linux NFS server used by most users. These packages also contain the mount.nfs, umount.nfs, and showmount programs. Security Fix(es): * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libnfsidmap-devel-2.5.4-38.el9_7.3.s390x.rpm 304a309a4bb082c62ec62ac9afbddffd2c491606a3fcd09235f2c9421031c335 ALSA-2026:39576 Copyright 2026 AlmaLinux OS 0 1 Important

cifs-utils security, bug fix, and enhancement update

The SMB/CIFS protocol is a standard file sharing protocol widely deployed on Microsoft Windows machines. The cifs-utils packages contain tools for mounting shares on Linux using the SMB/CIFS protocol. The tools in this package work in conjunction with support in the kernel to allow one to mount a SMB/CIFS share onto a client and use it as if it were a standard Linux file system. Security Fix(es): * cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (CVE-2026-12505) Bug Fix(es) and Enhancement(s): * cifs-utils: regression with kerberos mount [almalinux-9.8.z] (JIRA:AlmaLinux-192982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default cifs-utils-devel-7.6-2.el9_8.s390x.rpm 4f465e6b1c8e3b69acc08d7c8f35f5adab6c69d92bafce5ace18f0b3a58ca3c6 ALSA-2026:3966 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.38.1.el9_7.s390x.rpm 02131c75431287a80c9d597ef49065d0a7fd96e713be4556ac77a06df8279717 kernel-cross-headers-5.14.0-611.38.1.el9_7.s390x.rpm 404942413fd50d6aa0d9510dd0bc59c309d7d22d5a8b0d2a2996aecb24e6ec1b ALSA-2026:39771 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.12-idle-3.12.13-3.el9_8.1.s390x.rpm 554353ad1b83520d6a36ee4574ac4c92f3645bb4b1285f9ee10b28b5d744e1fd python3.12-test-3.12.13-3.el9_8.1.s390x.rpm d0b216d64d0373f2d2d5f5054440b318f9b4fc4df72519ec44a30ddb9dbda0e7 python3.12-debug-3.12.13-3.el9_8.1.s390x.rpm fa851c47698163f59b800483203076a99bead3246a369ec98bf3b52ed2cbe430 ALSA-2026:39798 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) Bug Fix(es) and Enhancement(s): * python3.9 test_ssl fails ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192) [almalinux-9.8.z] (JIRA:AlmaLinux-194207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-idle-3.9.25-7.el9_8.2.s390x.rpm 3670b17de436c36fb5a408b863babcb480dbc3bb77de001cdd6e8e1629842936 python3-debug-3.9.25-7.el9_8.2.s390x.rpm 8c7b50503eede74f0bcc4d2948beb35a05ce3ed2dcf8ce16a764b1ed5b2b7b77 python3-test-3.9.25-7.el9_8.2.s390x.rpm a4678320a9d71223b39a7abd744080047427199211f7720364cdef971c634ad4 ALSA-2026:4165 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-test-3.12.12-4.el9_7.1.s390x.rpm 2b7687a49fd41ee4239c1f631756ff0abef8067dd3113e39dbdce45d450b1315 python3.12-debug-3.12.12-4.el9_7.1.s390x.rpm d37cadd8dbbb6e152e24c9e084fefa3d571007c5098aae8556b68bfb90a14078 python3.12-idle-3.12.12-4.el9_7.1.s390x.rpm fcb15e0ee004453f00668ea1a2c9dccfcdcdbb1ec4055fd267538e288fb9905f ALSA-2026:4168 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.1.s390x.rpm 11501dd69a84de4e40cd8fe2dec8e87e7e9d9d12dcdfe4345bda2f92b236b2ca python3-idle-3.9.25-3.el9_7.1.s390x.rpm 7b5ba7d682292ba9b19fb9926fd291782af8896bd58c2fc66a90555531cadb63 python3-debug-3.9.25-3.el9_7.1.s390x.rpm f03440b3a564307943ff27f5989c27c9f536ada149812fb9f8578fe66cd5ddfd ALSA-2026:41894 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.s390x.rpm 596c162a48dc3f7772e3211b95f5d2ff355bffbf2cd13d63df1732117780ea1d ALSA-2026:41896 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.s390x.rpm e46a984281b088f158cf2130ff5bfa5befc82e377272e3798994b44eff528c04 ALSA-2026:41898 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.s390x.rpm 8a7018670059e9b2c237ba8048364c6584358148ec1cdb8480925fc9f3650bb9 ALSA-2026:41905 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.1.s390x.rpm 7d93631184b1b7985b97b93f8a14ea05babb9d9c8f5d7fae0c5d135030c9fd94 ALSA-2026:41949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.14-test-3.14.5-1.el9_8.1.s390x.rpm 124e7c3e7e7b9321894dd6feb9dd6ca3233eccc4244ee9f13b78a621cc42b886 python3.14-freethreading-tkinter-3.14.5-1.el9_8.1.s390x.rpm 13712b57fc29f9139710d4c37c28b6d8e85f0db5bcd27f036fe063dc248dba45 python3.14-freethreading-test-3.14.5-1.el9_8.1.s390x.rpm 76532549bdfce509b3a50a0b851b707b7de1466d1e1f77cb136f1c68137f40ef python3.14-freethreading-libs-3.14.5-1.el9_8.1.s390x.rpm 953eaab76155d19699a6db8c0af100cb208d693be4816560ce312cdb85af363c python3.14-idle-3.14.5-1.el9_8.1.s390x.rpm 9653168e4aca4e58f8794e079da0b8dff08af553fcf79c9fcd069793d79e98eb python3.14-freethreading-idle-3.14.5-1.el9_8.1.s390x.rpm aeed002263b020c399adfb8a34d2e6bf1fb49cd0c91b9f1a7dde7752368c9bc3 python3.14-freethreading-3.14.5-1.el9_8.1.s390x.rpm d00e46fe84475e4522eea2c3b4ce6df7a0c924d436778e91b839e5196f8eb374 python3.14-freethreading-devel-3.14.5-1.el9_8.1.s390x.rpm df4ec388267daf6de0a17795a153b3cd2e54afad6f877a01109a49add03145af python3.14-freethreading-debug-3.14.5-1.el9_8.1.s390x.rpm ed3e5ae91415010d6165c9ab428e6c1e3a4f404de191cf80c75d37bb936becf3 python3.14-debug-3.14.5-1.el9_8.1.s390x.rpm f94c5f7b6848323f39055f3971c262df0756db730d2d55c9bff47ecb5c17b078 ALSA-2026:42089 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.2.s390x.rpm 51b5dcdc4dc857e22f3de36ff9038b2e29fdb3e7d5be535bc11bdc6aded8ed20 ALSA-2026:4216 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.11-idle-3.11.13-5.1.el9_7.s390x.rpm 7831e5eca0abcafb0d4ca249e17cdcf9e3ddf61806e15fbd7cdb3a391432f233 python3.11-test-3.11.13-5.1.el9_7.s390x.rpm b1ae84fd82f86f1c6009e8a8143dcfc8f1cc848689b8bfbbd8593dfe7ca6a7a9 python3.11-debug-3.11.13-5.1.el9_7.s390x.rpm e9cd8c963ff8b46cfda4c7f6d8a222f786261f240b1a6b0bb328caa511978365 ALSA-2026:42668 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.1.s390x.rpm af800787a5d967d09edcf8dfe4333a5f5f577676075f8531dfebd07d330a8bc2 ALSA-2026:42887 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477, AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-17-openjdk-demo-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm 9e2a71947ef7ac3e77196577121aee6a4ad37be529dcaf01d1e1e44f6687c7f8 java-17-openjdk-static-libs-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm a5b07cd6927b5a8dab7ded92369014b29ffcc8d804bcb6d56be73488fb370cf3 java-17-openjdk-jmods-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm b2ad813073bd2df4efa10fe2c77915be8093de86691fcf817e59af4d81d1ebae java-17-openjdk-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm be7ea36067efd4198e44f2449ebb372fd35a442d1053946d9c74ee8ebd878f45 java-17-openjdk-devel-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm bff19692b3cb04d5ba4d0807e1cd5d4d0b1716cc83669956318d10fa24e87b36 java-17-openjdk-src-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm e81caae7a0e5bb6db40961fbdf10ab82aa08a2b3b16c07d73a2c9739f4b5a822 java-17-openjdk-headless-slowdebug-17.0.20.0.8-1.2.el9.alma.1.s390x.rpm e9b61921614c1fb84bd79d2d472b6c95ab869a2306f1778979b759fef56a17dd ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-21-openjdk-jmods-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm 04d4410d49aefb945d6292c7e918fe5ab3051770568cdeb980f41fd2cd053489 java-21-openjdk-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm 0e4cf087d43c2ac0504787229bf95c26c2ec797af2ad8b56c6906df8a1290c22 java-21-openjdk-demo-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm 4ba32e268c2df1389a4a2b0289ab723764f6a5767ca75908d34d7b09b63ef841 java-21-openjdk-src-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm c101c8dafb17ab057cc7b002958746811e83e3edfe00a95d2cf5e0738495fad9 java-21-openjdk-devel-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm d0277e47a89912a0a4488784370555190f01459ad87bc9d2c7a4f434e9772d3c java-21-openjdk-static-libs-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm dc501136c8cb26f1d351c468c2bf98834f04b39e3563c5cf229c8e2d5612f478 java-21-openjdk-headless-slowdebug-21.0.12.0.8-1.2.el9.alma.2.s390x.rpm fb9a90f15ce79a95f9ced8d10e5a34d87e61873ada8d444aa4993e9f6d9d4a2f ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-25-openjdk-devel-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm 2d4aeb7bfd047754d213165be96a741dd3f9f77b8bea1a21fb142148cb8963d1 java-25-openjdk-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm 355cca316d94e5bea18a1f4dc5fe49472e3b479390bd03e8adf9b31aa73c9f93 java-25-openjdk-demo-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm a284f8b49458c604417ee0872df4473de5cd5fc8759e0dc5b991226aedf0194c java-25-openjdk-headless-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm a672d08a266526f64e176d6b46c31390423c90c201c96814a9bf5dd09c4b41cf java-25-openjdk-static-libs-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm a6c4b5789e3aa3460f44ec84016d4c7f1d68c0c109172b7f09dc6d84fd0e4830 java-25-openjdk-crypto-adapter-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm c69d02e8326a4d35b9677b096dedd6a03f2b011eee15c7155c77c1dbc33d9a9c java-25-openjdk-jmods-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm cea5ce4a4d82f243aa91990da2120d8cee2b23e50a31e19cc96c2a5cf518c661 java-25-openjdk-src-slowdebug-25.0.4.0.7-1.1.el9.alma.1.s390x.rpm faf5879227174572c4c359ba9acec8658d6e872eaf5a2dc45cfc28732e5bf003 ALSA-2026:42952 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nss_hesiod-2.34-274.el9_8.s390x.rpm 12ce09b0af7ef6b9b01211316aa403383076ebdee711fe9cf711792207a82d1f nss_db-2.34-274.el9_8.s390x.rpm 197543e1df874cdc1a049d276c02b552a1d63fe5151edb6318206c13e2b91bdb glibc-static-2.34-274.el9_8.s390x.rpm 41ad9215697ea18a265f72300b127fd413599294cc4094a97f297901c304043b glibc-benchtests-2.34-274.el9_8.s390x.rpm 71954e349ef1e1f3a88bc306045284a1b9a9a380077c910b03f9d4c317862cbe glibc-nss-devel-2.34-274.el9_8.s390x.rpm b36a8c94db234d033c85662a8a24f4f554f1442058fa0a5f0ee9f0c689f84409 ALSA-2026:43307 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-9.8.z] (JIRA:AlmaLinux-183980) * [AlmaLinux-9.8.z]: mlx5: include bug fixes (JIRA:AlmaLinux-188121) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-9.8.z] (JIRA:AlmaLinux-212061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.29.1.el9_8.s390x.rpm 5193b0ef497696d871ebee5c53886d7973afd614202ea79c3adf040c60701596 kernel-cross-headers-5.14.0-687.29.1.el9_8.s390x.rpm bb77cfdf37ce5e1fdd25ef17678fe0b6c7961d2726f96a93e83d3c77ae07bc27 ALSA-2026:4445 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default dotnet-sdk-10.0-source-built-artifacts-10.0.104-1.el9_7.s390x.rpm 43b03c75688f433c18b89804206f6810627925c79ce6b493c7a6099012778d56 ALSA-2026:4447 Copyright 2026 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libvpx-devel-1.9.0-10.el9_7.s390x.rpm 6098cb861c37330eab431fb77f11f4f3c5f6f988b902598c7ee4a40c014a8cec ALSA-2026:4454 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es): * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.125-1.el9_7.s390x.rpm 19c62784255718f237640bace10bacea37dc7fe08c1fe47671bf6483bb618025 ALSA-2026:4456 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default dotnet-sdk-9.0-source-built-artifacts-9.0.115-1.el9_7.s390x.rpm 9d87a3822e40da8d0b6fd8f9b9c33415d1ec276fb8a8ed9f8b93e03fa4246a3c ALSA-2026:45192 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) Bug Fix(es) and Enhancement(s): * scsi device removal may hang from race with error recovery [almalinux-9.8.z] (JIRA:AlmaLinux-187412) * [AlmaLinux9] kvm fixes for 2026-07-21 [almalinux-9.8.z] (JIRA:AlmaLinux-213468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.30.1.el9_8.s390x.rpm a3debd232891e4e0a1c10f564c092948ec0dd2c60d19994a6be8c582fd40b60c kernel-cross-headers-5.14.0-687.30.1.el9_8.s390x.rpm b1fa30c2133abe7e2fd1883f2f014ab05c42ef5e09aa8abd31d25e622626745d ALSA-2026:47040 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797) * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) Bug Fix(es) and Enhancement(s): * general protection fault during exportfs / nfsd4_revoke_states [almalinux-9.8.z] (JIRA:AlmaLinux-188257) * Enable Pretimeout Watchdog Panic Functionality on x86 [almalinux-9.8.z] (JIRA:AlmaLinux-193729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.31.1.el9_8.s390x.rpm 45f13a5700b86d93c8e2fe9accd7863d32719a0aed7a16da4104f4d9a006bf4a kernel-cross-headers-5.14.0-687.31.1.el9_8.s390x.rpm 99138e4b8ecefb94163c6bb7f93566b05b7d5bfc7e0c68d6726cd39e50824cc3 ALSA-2026:47084 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.1.s390x.rpm 55cb471da1ea0ac73764cc8a1c7644f7e95c2f15b3cdff60562367da2ea6f065 ALSA-2026:47178 Copyright 2026 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default yelp-devel-40.3-3.el9_8.1.s390x.rpm e50173cb4c62436492e33fe8de4d2defe87c14440bacf4b734f8c4f646b92413 ALSA-2026:47179 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.s390x.rpm 08e86c8aad6b2fb95a93cd4f7b173ef0ba3d6a403663f895eba830e4798851b4 ALSA-2026:4759 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.41.1.el9_7.s390x.rpm 2b7822b4f24498c7b4368da51ecb1a9a01724f1a6533f77ce0adb327f1a2bca2 kernel-cross-headers-5.14.0-611.41.1.el9_7.s390x.rpm a35f4c1670d94aabb2c6b2ace1b699fb508ab129db4964d0fede8541c80a6718 ALSA-2026:4828 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default mysql-devel-8.0.45-1.el9_7.s390x.rpm 66edf83d788c75ef7a527c00d03ae9451b1ccc6a7a2afdcab8c5477d8149de73 mysql-test-8.0.45-1.el9_7.s390x.rpm eb3075cc4cdf24893fff7751cc1ea3ff4b860d661ec5ae3ff4978ac750bcbafc ALSA-2026:4898 Copyright 2026 AlmaLinux OS 0 1 Important

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) * capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default capstone-devel-4.0.2-11.el9_7.s390x.rpm 5a7f969bfc17f1b57e369c516318fd7b0673d62967c8b3ce627fb04722594fd7 python3-capstone-4.0.2-11.el9_7.s390x.rpm 7461b252ce7fb7239b481af663bff8d5d54b78b762051b46ff80fb174098bcdc capstone-java-4.0.2-11.el9_7.noarch.rpm 9148e1b91a4f21330bcfcfec0fb3809e12ac0bc48c9f877a686b6afcc9e1e6bf ALSA-2026:49212 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () * kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.33.1.el9_8.s390x.rpm 232f01f89e9005a3db6639b269ebefcc97063ae1ef1c22d7594a65ea2c981d42 libperf-5.14.0-687.33.1.el9_8.s390x.rpm 32d7035d82655ba008aaf62483d1cbc62baec11bcd81aa5b3769c44d12577ba4 ALSA-2026:49870 Copyright 2026 AlmaLinux OS 0 1 Low

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) Bug Fix(es) and Enhancement(s): * Possible regression with FM350GL [almalinux-9.8.z] (JIRA:AlmaLinux-184273) * AlmaLinux9: Fix downstream-only regression from 532af53c [almalinux-9.8.z] (JIRA:AlmaLinux-192430) * gfs2: xfstests generic/363 failure [almalinux-9.8.z] (JIRA:AlmaLinux-214021) * AlmaLinux 9: Backport b95e0e792822 [almalinux-9.8.z] (JIRA:AlmaLinux-216471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.34.1.el9_8.s390x.rpm 5a3086115c9a9a35b9ff5a8997a9240fd9f46a8b6b480dd4ce657962940d124d libperf-5.14.0-687.34.1.el9_8.s390x.rpm f557a1ab3e2090d49d93edfe4c52c62ca517bc859f01731b6eceb1bc72b5215e ALSA-2026:50108 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default ldns-devel-1.7.1-12.el9_8.1.s390x.rpm 347bf4cff8e112fc8cc42a3ce829082ac71536bd22d927b1723769527a48eba6 ldns-doc-1.7.1-12.el9_8.1.noarch.rpm 7e158362aea06b2f4ea4f6ac69774898ce998bc5ff610ff22df26aa72729f57c perl-ldns-1.7.1-12.el9_8.1.s390x.rpm b12528c4ba3daf7a51c86a609e17f68d9c0acd9b520350233bcfa39c4018d2b7 ldns-utils-1.7.1-12.el9_8.1.s390x.rpm f19472d1e8955a3859958a39ee025c0da1fde8f0d87f767359fa66a138a9e704 python3-ldns-1.7.1-12.el9_8.1.s390x.rpm fc3c36c6ffbe8124380dc9c2bae876623213c0642c25bb6fe989aa74b214e2bb ALSA-2026:50141 Copyright 2026 AlmaLinux OS 0 1 Important

sg3_utils security, bug fix, and enhancement update

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets. Security Fix(es): * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): * sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default sg3_utils-devel-1.47-10.el9_8.1.s390x.rpm d497cd8703c24dd28795393cbc51ddc5568d37c43f22775d034af91b9dd4e53b ALSA-2026:51035 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-9.8.z] (JIRA:AlmaLinux-186331) * [AlmaLinux 9.4] Kernel memory reclaim bug [almalinux-9.8.z] (JIRA:AlmaLinux-211058) * Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [almalinux-9.8.z] (JIRA:AlmaLinux-215575) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.36.1.el9_8.s390x.rpm 5c8262fc4488fb69dea2cfef51df13f95cec2326b0f13dfacebbe1b73b69c986 kernel-cross-headers-5.14.0-687.36.1.el9_8.s390x.rpm 6b54675b695368eefb1ab78867ad6136424d64c07d144da4f7b81b25be31e169 ALSA-2026:52395 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation (CVE-2026-6479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default postgresql-test-13.23-5.el9_8.s390x.rpm 3a2f959738302d6dfcf0e38eeb437dae34bfcf1a3132588b67a9a9551c3a32c5 postgresql-private-devel-13.23-5.el9_8.s390x.rpm 69bc67fb59b6d24b5f11529381f2d7fdb2b08d2f9e15b315ca0f379e50f6cd24 postgresql-static-13.23-5.el9_8.s390x.rpm 8064b866a680a968b57ca7ffec887b33d364f5cfa180d7f74a514e813bbae129 postgresql-docs-13.23-5.el9_8.s390x.rpm 82e67b1c2831d29b91537535f9d08b5ebe2ad61734749a82947d9767b0722919 postgresql-server-devel-13.23-5.el9_8.s390x.rpm aa019769b11a8cf018d4267216ca1adfbd95c756fdc8eb928ebda1c8f107f8f4 postgresql-upgrade-devel-13.23-5.el9_8.s390x.rpm d06a48e7e9ceb161919dba430e5ed677412a0b5c54662703113899a818eb8263 postgresql-test-rpm-macros-13.23-5.el9_8.noarch.rpm d732c71a16cd11972ca9f56da5ba1df03a091f44c271942eb352f1e41e040b86 ALSA-2026:53329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-9.8.z] (JIRA:AlmaLinux-213036) * AlmaLinux9.4 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-9.8.z] (JIRA:AlmaLinux-215578) * AlmaLinux9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-9.8.z] (JIRA:AlmaLinux-215580) * cifs: periodic IO errors when rename races with lease break (JIRA:AlmaLinux-192999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.38.1.el9_8.s390x.rpm 47b0e2963381dd455cc690ac37b9a0bf61bac554ee4a79809b57e2af07f2d825 kernel-cross-headers-5.14.0-687.38.1.el9_8.s390x.rpm cd104a66a7d20ce955556d0f88556b5bed219eda924dae2aa5d607afce050d9b ALSA-2026:54268 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-idle-3.9.25-7.el9_8.3.s390x.rpm 83ae65573aab125709827cafd7e183ce1c0a13e623e251716f42c9fdb9f46705 python3-debug-3.9.25-7.el9_8.3.s390x.rpm aedf603124ca67944cbd49210fda825eb35df40bf53502cc72e9f8cee581b6e6 python3-test-3.9.25-7.el9_8.3.s390x.rpm e650fb1110aca749beb734f552615be73b9c46cf817fb8f1874e2f5eb825d5c2 ALSA-2026:54443 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-9.8.z] (JIRA:AlmaLinux-214434) * Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [almalinux-9.8.z] (JIRA:AlmaLinux-220787) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.39.1.el9_8.s390x.rpm 0d3c9f634cf8dccf0fb64cc18182577a2c73caaa886222aa4d0a0361d140ffcd libperf-5.14.0-687.39.1.el9_8.s390x.rpm 54bf0e1bb81cf55c8a27f9132af36ff874d1227cfb607ab57350fa6ca8df5016 ALSA-2026:54487 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.5.s390x.rpm 5c39d4d1318c4ecb0394f683c129fee31e318d391f10e297aff356684d98c79e libwinpr-devel-2.11.7-7.el9_8.5.s390x.rpm ca1ec0fc4f188d011dc9f24f61954d059908778709145a1999a5979b06361fa7 ALSA-2026:54510 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.8.noarch.rpm 707e97caec593d461f991261508fa9381c00491912300c14df52d4d4823da370 bind-devel-9.16.23-40.el9_8.8.s390x.rpm d9fc6998f482366df2af1205340ff36b2b5eeaf7420e738db650eba18a9123f9 ALSA-2026:54574 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-9.8.z] (JIRA:AlmaLinux-235471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.130-1.el9_8.s390x.rpm c1efef6e9954ade95502d15ae92abcb592b873689bd36070135ad64ef727763a ALSA-2026:54662 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libnghttp2-devel-1.43.0-6.el9_8.2.s390x.rpm 040f10ac5bd6dba132a449d83b77a3a4e8e4edeb3b8dc76daad57a8333a8de99 nghttp2-1.43.0-6.el9_8.2.s390x.rpm 19ddd39e6ff706449df71365379c7109bb024f98b6b6614110c939d715684b6f ALSA-2026:55423 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-9.el9_8.s390x.rpm 2254887eb83738ad2895f0ed0aa9f41d445c73d326b5e082a03a29f824dc0893 ALSA-2026:55440 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.9.s390x.rpm 23f0583775fea0d41ef5204a41dae5b9bfb47778b832feb6fb07b62d61b9340e ALSA-2026:55442 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.8.noarch.rpm 25810d7d4702c335e76c9bab862566f0691f40c2f421619204196cd55e0e2ec6 bind9.18-devel-9.18.29-14.el9_8.8.s390x.rpm 3062a3ea364e48e48e75a77f3098f199a13c54614b2de0f4d8df83116f16ef9e ALSA-2026:55447 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.3.s390x.rpm c8f68b4265542d1c2c473325c7adba0e22702d2683834176191dca7d72ef31b3 ALSA-2026:55781 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-17-openjdk-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm 303c28c5eb0d591a260924a4266fcd25cf9f23ad614a24cc4a5ff26a09bd7d40 java-17-openjdk-static-libs-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm 3bdf4255f9ff3ac65169af12d14e58eb89cd267f9c6442b6e317f873abec2ce8 java-17-openjdk-src-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm 4e51e526211b003d29dbf88bb8b8ca991d802d716c43c003534da009bb0395aa java-17-openjdk-jmods-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm 824937f0e5b1d5250ba14182eaaa5a971ead8792cab372b994839c3eee866dcf java-17-openjdk-demo-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm c6fface1688fe38e6d5f521a7cabf05dc0581759b61c0bcd94db7d955e93c8bb java-17-openjdk-devel-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm e916c8484e3c2eaef975304a9a7bc15c3cdc868372cb7d7e698be91f38cd8d24 java-17-openjdk-headless-slowdebug-17.0.20.1.1-1.2.el9.alma.1.s390x.rpm fdc82784cdf9876df39d02d0283114d2b5700bd1d3c23fe1faec9990ef3ac756 ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 2b3f9ab3c8889995f26fe068151859dc35dca037fa21d1adff0951012e0723f7 java-21-openjdk-src-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 34a46d95bfdc2ef7126d8b90b781a07bf7926f6d42e5b2ffe7c4a1c5274d5c71 java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 573a339128f9786aa401ad6f881b78a1632cef93e14125e553683ab071e67e37 java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 7d8f18489e880af8a85c92ad945adc994f450cccb7e1d5b54345090245613aa5 java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 8091a191aab9ab0a8396e38a0cb336944a40eee6674d73c441cd0f296db9caa0 java-21-openjdk-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm 86281f0cdf1db9549e4b1a08a5a30c3369e45f3e2b750560dec45ba1bf13c56d java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.2.el9.alma.1.s390x.rpm c8f0f79e5973ec302408506c309669dc29e89fb9d54fac0e6adb049057500d4b ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default java-25-openjdk-devel-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm 484192ccf1fa96021c02ef112b310dfcedb672182b2fc57a43ce3fd8a4c09efb java-25-openjdk-static-libs-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm 484c3f2f918fb1d6b7718f78911ae69f89d52607103438594b90949a326552b9 java-25-openjdk-headless-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm 64a3d0e8572d5018dbbc80a2c7f6a4a46a4c52a215c8014e4fe82a6088e4d78f java-25-openjdk-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm 7ba1b2c6d165082aac1d194cba44bd14b0986915f6b821b63c6b2849bbf718c3 java-25-openjdk-jmods-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm 7dc044cd39bab42c4816c918d78fc06af75559bcdf1e0b744f64c9e58f9c9462 java-25-openjdk-crypto-adapter-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm ab77ad977789d7ba868acc72411989c066ac4e237df47b2f20d95551654582eb java-25-openjdk-src-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm caf9c2438b93eb57fac38f96f93dc2a058cd4173f21845a4e80c1f8e4b01e538 java-25-openjdk-demo-slowdebug-25.0.4.1.1-1.1.el9.alma.1.s390x.rpm f4de8dd66ef5c298223a628ea157292350a0606bb7ca00978b02dc53a5a940ca ALSA-2026:55841 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.4.s390x.rpm 48af32bd087c4108cdd9e76ef54b90022a10677a9bc01cfda83f7f49d954044b ALSA-2026:55856 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-9.8.z] (JIRA:AlmaLinux-235476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.120-1.el9_8.s390x.rpm 2bbd824f88f502cf309e8c7880f7953682bc98a38b83695c4bf7072a2003db1b ALSA-2026:55857 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-9.8.z] (JIRA:AlmaLinux-235481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.111-1.el9_8.s390x.rpm 27acf9724321d47122e869afe3d4d56864d3c7ccb34cb98ceb29a43c33d2f6f7 ALSA-2026:55865 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.4.s390x.rpm 1ad9246c6ea61a4b69076d843f4b1fb367984a171663a50f7a331ab0cc48629f ALSA-2026:5599 Copyright 2026 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.1.alma.1.s390x.rpm c5dfc0007e17384e0b75b7bca72ab327dc38a28b93e2f62f3925e72e14d20ca5 ALSA-2026:5603 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default opencryptoki-devel-3.25.0-4.el9_7.2.s390x.rpm 7a4420af7a3a89f2c9c6c194794220f112bc75cc32baee585d4e0dd17acce936 ALSA-2026:57252 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:AlmaLinux-181065) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-9.8.z] (JIRA:AlmaLinux-224549) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-9.8.z] (JIRA:AlmaLinux-235811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.41.1.el9_8.s390x.rpm 0bbe607b4acdacae2dee3030caa85a84bdda5f83c3ae0a0c4a43cf657caabda3 libperf-5.14.0-687.41.1.el9_8.s390x.rpm 713693d9b124a5ae261c5b915c652f86e12a25802960621ab8ed60575ef88e8e ALSA-2026:58560 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default cups-filters-devel-1.28.7-27.el9_8.s390x.rpm 6890aace08633dee71bcd63af8f804ab37c1d51aaac211d09a86dbaf09507c81 ALSA-2026:58572 Copyright 2026 AlmaLinux OS 0 1 Moderate

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-5.el9_8.s390x.rpm 1b12960caf9b059e048a1ddd7b1c3badc74b242b30ec5822f1d3348add38f64d ALSA-2026:58901 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.14-freethreading-devel-3.14.7-2.el9_8.s390x.rpm 39e3b188f05c0bb255eab8107783cc79b9427afd1d254365509a413e995d25d4 python3.14-test-3.14.7-2.el9_8.s390x.rpm 4fb2fc1d37883ce74472126b0d7cdb0faf21dd746c47cf235cd27cbe9996f44a python3.14-idle-3.14.7-2.el9_8.s390x.rpm 74299f46848eae5a6dc17ecb6968cbf2581c663bdebbfa0f3ae0bad0b0b54a4c python3.14-freethreading-debug-3.14.7-2.el9_8.s390x.rpm a729aa42c1ba68eebb6737be79e4f058007b11b38c3243277bb144b64e8ee445 python3.14-freethreading-tkinter-3.14.7-2.el9_8.s390x.rpm b6512171b950d3f116343a6ec653d05d75d7b6638dd22e10975e88df87f32e80 python3.14-debug-3.14.7-2.el9_8.s390x.rpm c2b031d7aae722bad1bdfc4aedb8dd27710cb0eff9561aa1ea85080287047fb3 python3.14-freethreading-idle-3.14.7-2.el9_8.s390x.rpm c588b63285e78eedf45c072839713ab62280a9b21f0ada580ebe2f11ac726d97 python3.14-freethreading-3.14.7-2.el9_8.s390x.rpm daaf17b482b186e181bcf8175e2611f256a93d7b185c5b8d57c172e55d39c43c python3.14-freethreading-test-3.14.7-2.el9_8.s390x.rpm eb84f4be15992a377a008bc268f755e7860b462d8ae7b44eb8f8fa507313bd5f python3.14-freethreading-libs-3.14.7-2.el9_8.s390x.rpm fe6dc358fa247824e68da7f98c6e2da980444dce6683c7760ca95f6f9e82eadf ALSA-2026:59009 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.12-test-3.12.14-1.el9_8.s390x.rpm 143eec4310ae5fb06003839be4b5a1454184f6dbee49423f33f7db5da78ea147 python3.12-debug-3.12.14-1.el9_8.s390x.rpm 540a9e4eda1a67ff395971e2ae3c0c78e45682ed46fa5b0a67d6e747592bdd8c python3.12-idle-3.12.14-1.el9_8.s390x.rpm b61bf6e24d8803c76321bfa19e4352239eeaca941b278b8425774a731fc3c507 ALSA-2026:59362 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.5.alma.1.s390x.rpm 885693e73f9d27e677b1be33644f34ac208f751252f75c4c78757d4346bd4efd ALSA-2026:59723 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-166118) * ss core dumped when there is an SCTP session [almalinux-9.8.z] (JIRA:AlmaLinux-212398) * [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [almalinux-9.8.z] (JIRA:AlmaLinux-245333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.42.1.el9_8.s390x.rpm 528264a636f9d244eeaf2de87caf34dccca2a0d0745be4ccc2dd3d4ded70a350 libperf-5.14.0-687.42.1.el9_8.s390x.rpm feb2865111c99758c9faf53bb39d9964fed72fa4e3bf9c04cacaab673ff856b0 ALSA-2026:6004 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.3.s390x.rpm 1b2bd13403668adff4dd40c2cf37443461e6dfde4ca49581eea9659abedd633c libwinpr-devel-2.11.7-1.el9_7.3.s390x.rpm 7bacd67b75ee0fc5c605b211cd8e4b943d2ca3ca581904a9a45d854300444132 ALSA-2026:61316 Copyright 2026 AlmaLinux OS 0 1 Important

xmlrpc-c security update

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML. Security Fix(es): * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xmlrpc-c-client++-1.51.0-17.el9_8.s390x.rpm 6d16fae2d44c897e2e91b72d6539dbd4d9d1fe30109a75d9600dcf0dc0579027 xmlrpc-c-c++-1.51.0-17.el9_8.s390x.rpm f285618b0b7016e4c803b1e45f13ae14bcca47c7b029c8e8a1e14575b2329402 xmlrpc-c-devel-1.51.0-17.el9_8.s390x.rpm f30b84b551d7de8aa6bb08866f11e689e348a3e9fed644c5177b5ecce352870d ALSA-2026:61379 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.6.s390x.rpm 25087f5db890105d27d0e56be5d29f800bb3d9d7b249195b9cf1df3ed4bcd994 freerdp-devel-2.11.7-7.el9_8.6.s390x.rpm b2f246a41918707ecab920424ae855d287f12285c6492b5d55be56894ab25ef8 ALSA-2026:6153 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096) * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144) * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171) * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.45.1.el9_7.s390x.rpm 66fa92e79c18c21d8259ea816619526a6e8ab70dd0b9062e94ed6fe46979e347 libperf-5.14.0-611.45.1.el9_7.s390x.rpm 79d2d258ec3c27cf9cec14139f69bf21ec75f3c417ddd4b65275203863ca86ce ALSA-2026:6285 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.12-debug-3.12.12-4.el9_7.2.s390x.rpm 2c7b196299d8d50232c7e387fb91133c76750f6101aa7b8631efadc0cea2d429 python3.12-test-3.12.12-4.el9_7.2.s390x.rpm 9a25a4b97d357daa32e171f9617cc4d4fcf931eeec5a5f30acd0ef345fad8deb python3.12-idle-3.12.12-4.el9_7.2.s390x.rpm ad5862ac702f1c8b20c4d5567658124c0525cec8cca9383eb4e72e6679f68c0d ALSA-2026:6286 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3.11-debug-3.11.13-5.2.el9_7.s390x.rpm 4a7e05992079c005c44283aa71b6208e58b56c63070e972a2c42340cf1c579fc python3.11-test-3.11.13-5.2.el9_7.s390x.rpm 8509f1ff424797a12885817b9e94ed11ebfb21edf8cb506c46b037bc90814057 python3.11-idle-3.11.13-5.2.el9_7.s390x.rpm 8533cb0ad638a46a7b6a9bdc4ceadef50d9aeedd830223e09195e49c872e5ec4 ALSA-2026:6300 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.s390x.rpm 4010b32349e3648d7e56b3fe21ad9e6c0688171ed115df4ff514413173f6c523 ALSA-2026:63129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9] TPM becomes completely unresponsive and requires a full reboot to clear [almalinux-9.8.z] (JIRA:AlmaLinux-213940) * RT scheduler livelock caused by missing backport of 94894c9c477e [almalinux-9.8.z] (JIRA:AlmaLinux-240634) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.44.1.el9_8.s390x.rpm 5db4a6896a65d2aabf1d2963e0245064864bc5af5011f7b0e6b672356369eaf0 libperf-5.14.0-687.44.1.el9_8.s390x.rpm b900014d25a481a11655998ad09873e26a5ef64da7f888aa91418223f79facdb ALSA-2026:6340 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852) * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732) * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676) * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491) * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948) * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684) * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681) * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683) * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679) * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675) * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.5.s390x.rpm 1516763456f0ecc37bb0232ebaba45ff4892d0a3cf50be0c4565b23d893e2ffb freerdp-devel-2.11.7-1.el9_7.5.s390x.rpm 9cb155f4923b017f748f3605c499c21554371246619952607198842aeaa93e35 ALSA-2026:64784 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-10.el9_8.s390x.rpm 1ad23c88cd5436d6d09ebb447f8746bf4d383e81671ec0746421e261f3b5cee0 ALSA-2026:64800 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.10.s390x.rpm 79634e108a595f2ddfb4c7b0c4d08824ee9df5a78cde8d16a011f189b4cb742c ALSA-2026:64808 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319) * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.45.1.el9_8.s390x.rpm 3056fe7d94edd6b087eade5fcd87b4ba86103c54787d7da0e7ee15dd4d883c1e libperf-5.14.0-687.45.1.el9_8.s390x.rpm c263b3d9c16435d3b62673445bff3baa4896dfde7c731ec981cacb88eb8abf82 ALSA-2026:6570 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.47.1.el9_7.s390x.rpm bb7d0edc75e2686721c19f23d647ecc027c3769ac1d0ed7181a8a18ad26fb370 libperf-5.14.0-611.47.1.el9_7.s390x.rpm c36b7be1e62782de0a6bcafc679394d8f233a0ab482687165e296c6ec937f099 ALSA-2026:65993 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.1.s390x.rpm 7971fb952243c88471e89d7d8c1efa593c168b10bc29642560431416adef4d3b ALSA-2026:66180 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) Bug Fix(es) and Enhancement(s): * KSM to deduplicate only zero pages [almalinux-9.8.z] (JIRA:AlmaLinux-249161) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.46.1.el9_8.s390x.rpm 0db789c57ec74a1fbb46a5caf9582d30b35905bf69da1cc4bb606bad4921fceb libperf-5.14.0-687.46.1.el9_8.s390x.rpm 8ea78a23b4fec1b700d7b26c574d1d546909385bb70ba165e40d1679198c15b7 ALSA-2026:6628 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default fontforge-20201107-8.el9_7.s390x.rpm 338efe0bdcaf6883073acdd91e00a7be18c08191ed9e54326de1a996a552fafd ALSA-2026:66347 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.7.s390x.rpm 54886e61d6e9b14ca44c5bacc45740ce2fc9db5354145b054d9fc8bfae21f1a3 freerdp-devel-2.11.7-7.el9_8.7.s390x.rpm fcd7026904c78e04b1689b1eb80cb75d06d0bbdabb4e25356828974078c4a5f7 ALSA-2026:66542 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.6.alma.1.s390x.rpm f4caa1a4aaad55f46512b58e3def667124d8c3d1264e020f9de9d4227b9f6627 ALSA-2026:67150 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402) * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376) * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) Bug Fix(es) and Enhancement(s): * gfs2: Various xfstests fixes [almalinux-9.8.z] (JIRA:AlmaLinux-178219) * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-9.8.z] (JIRA:AlmaLinux-193025) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-9.8.z] (JIRA:AlmaLinux-193050) * Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [almalinux-9.8.z] (JIRA:AlmaLinux-224489) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.47.1.el9_8.s390x.rpm 4602d49546726bef108fca41582bdec82a592afe724968c4b8f173ded40b2e1b libperf-5.14.0-687.47.1.el9_8.s390x.rpm e010427558301d3d50011faac3c4a6f8d23ccef7bec0d5099c1f30bdd6d242ba ALSA-2026:67470 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * gfs2: bufdata leaks [almalinux-9.8.z] (JIRA:AlmaLinux-178223) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.48.1.el9_8.s390x.rpm 7e55a0209dfeffb95786c47cd6ca984f4176288677b68926d7f87588efde1094 kernel-cross-headers-5.14.0-687.48.1.el9_8.s390x.rpm ebd219b9a4cbf36a0c9c1d63a0fa12676f6633284e4d0175aeb74b2ef3c5ea00 ALSA-2026:67524 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-9.8.z] (JIRA:AlmaLinux-252247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.131-1.el9_8.s390x.rpm d6cb1f9f49f223a2e889543659056326cf73419ecfdbbee1ce5a4efe89e421de ALSA-2026:67613 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-9.8.z] (JIRA:AlmaLinux-252319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.112-1.el9_8.s390x.rpm fbc0520acd39d7218697f6a9fea93ccdb5ee9b6ad88cc1dbbb43dbccc904dc5b ALSA-2026:67614 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-9.8.z] (JIRA:AlmaLinux-252278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.121-1.el9_8.s390x.rpm b47edb106cf8119263d1682ee24aac85d7c626cd3b7e3ee7f227c430aa433a60 ALSA-2026:6766 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default python3-debug-3.9.25-3.el9_7.2.s390x.rpm 109988550aa2191e0097896f51d526d90efbe014c5677703687066684d87e894 python3-test-3.9.25-3.el9_7.2.s390x.rpm 1af8f582740cce6604cae2e204673db540f4638ec4cd4ea7db756cca5233307a python3-idle-3.9.25-3.el9_7.2.s390x.rpm 90b2b98f1caac4398a4664a5caaea1bf0a94ff4b4fb179663c382b46ae95f757 ALSA-2026:67831 Copyright 2026 AlmaLinux OS 0 1 Important

tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fix(es): * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default tesseract-devel-4.1.1-8.el9_8.s390x.rpm 029afcf39123489d7a627c4e8e67df8e864a2d994547545e7f83a04e6f2fc2ae ALSA-2026:67873 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.2.s390x.rpm 9aa78e04f0188ea7433715e9a937d28983f9d7049e2f735ce8fb3ad27b13d531 ALSA-2026:68292 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.6.s390x.rpm 965d33e709e95f3bcafa287272f10cb1a96fcee80b3bc62bec446219c232e8ee ALSA-2026:68570 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298) * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) Bug Fix(es) and Enhancement(s): * gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540) * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544) * gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986) * [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.49.1.el9_8.s390x.rpm 04368141c424f584c65b9bd1fda6da84588c5a902899edaf9bd40c228e3d8857 kernel-cross-headers-5.14.0-687.49.1.el9_8.s390x.rpm f6b05ce3eb756701f7330730514191d08816a4af512db835e3d3703635daa0d8 ALSA-2026:68786 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fix(es): * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default perl-Net-DNS-Nameserver-1.29-6.el9_8.1.noarch.rpm 3dea2d596bfd0fb0be7ef382f57b66ad15cd1f6ae834a04a8214e6ea75c47492 ALSA-2026:69607 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default postgresql-static-13.23-6.el9_8.s390x.rpm 030e16298e6d9246e5fbe5d566663cd4a9dd0573d69380d38354b2ab13275e17 postgresql-test-rpm-macros-13.23-6.el9_8.noarch.rpm 044ccbdab6973b9c28f68ec9d3f12e3ae4050a40b55a0bf43371a25d1afda6c9 postgresql-docs-13.23-6.el9_8.s390x.rpm 3c3a80e860fa030cb4c35c2b4af81165bd5b6e62c21dbb558e0de4478c567f9d postgresql-upgrade-devel-13.23-6.el9_8.s390x.rpm 4c40e255156e2ec38b7caac4d8cb52dc9733b3da831cf3ca8edb882bc1bb89d2 postgresql-test-13.23-6.el9_8.s390x.rpm 9d85fdfbc941cefb9d90b6aff7cf72ec021e5e2e7778fe36936d3efe01a5f4ac postgresql-private-devel-13.23-6.el9_8.s390x.rpm a3503276a4c07258e5e32a74dfaec40f1f33e99972599cff0b1365ca527f330c postgresql-server-devel-13.23-6.el9_8.s390x.rpm f5bf9f74490dc02a8de5fc8880596fdd1b126ad5a0db14cd717fc4a3ae99bbb8 ALSA-2026:69608 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.4.s390x.rpm 8dbc09e1a46bbcfe61d3c31fc149f5ddf77ef61def10d5272e0bf2d3aca40bea ALSA-2026:7002 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654) * NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) * NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.2.alma.1.s390x.rpm 025f8b5c805b4e3da98aea690280a5ff9b0c2f89aa48712a9e892d9a236d331e ALSA-2026:70459 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-9.8.z] (JIRA:AlmaLinux-254108) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.50.1.el9_8.s390x.rpm 47678fa7a37eb6ec02d2adb0259ffbe2bab96ee7c096dd18101780785fc42d43 libperf-5.14.0-687.50.1.el9_8.s390x.rpm 79d60ea8a55b4355114d86acb564b75365423b1a53f7d0c3bbc6af4bfab35c5c ALSA-2026:70564 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otptoken-import hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238519) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-9.8.z] (JIRA:AlmaLinux-238523) * ipa env: support only simple * wildcard [almalinux-9.8.z] (JIRA:AlmaLinux-238527) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-9.8.z] (JIRA:AlmaLinux-238674) * ipa-migrate: require Replication Administrator privilege [almalinux-9.8.z] (JIRA:AlmaLinux-238677) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-9.8.z] (JIRA:AlmaLinux-240767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-ipatests-4.13.4-1.el9_8.noarch.rpm 06db0bac21c10e74e426e3f9d48fdfa4abcb65e373a0087a66db13989f728e6f ALSA-2026:71487 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.8.s390x.rpm 2ea650453930d89a621d7f1b79dddfd8d66e8f3065616a1d81c1a5f12141ea50 ALSA-2026:71700 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) Bug Fix(es) and Enhancement(s): * MADVISE i/o size in AlmaLinux 9 additionally limited by read_ahead_kb - Was addressed in AlmaLinux8 via AlmaLinux-22476 [almalinux-9.8.z] (JIRA:AlmaLinux-260938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.52.1.el9_8.s390x.rpm 249d9df46136bf134443b979254499375128f960e8457f1b7df960fa51e8b82b kernel-cross-headers-5.14.0-687.52.1.el9_8.s390x.rpm e26e2f33484cc9f583b8f2f409bdcd970064925f93c8bb26caf121285ad60591 ALSA-2026:72286 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) Bug Fix(es) and Enhancement(s): * ruby %check fails in Konflux: Rinda multicast tests need network device [almalinux-9.8.z] (JIRA:AlmaLinux-255606) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default ruby-doc-3.0.7-168.el9_8.noarch.rpm 562cb5d5786d01eedf9f00b70da58fe188ff6ae20423a3bb01536606f5fbb0f4 ALSA-2026:72623 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875) * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-9.8.z] (JIRA:AlmaLinux-188656) * crypto: xxhash64 should not be fips approved [almalinux-9.8.z] (JIRA:AlmaLinux-256437) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.53.1.el9_8.s390x.rpm b74bbbc74e87d39535a39b5f539232e963368eabc0bcf858607a47bb91c6ead2 libperf-5.14.0-687.53.1.el9_8.s390x.rpm e30b63de5ff6d88887cc1178ddeafdd826b47c1883161a97a5e2b0f903075ba9 ALSA-2026:74424 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z] (JIRA:AlmaLinux-224986) * Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libvirt-devel-11.10.0-12.7.el9_8.alma.1.s390x.rpm 53a164b0aae47d574729ff6ace20133bdf57ea7f48e17affead84987ed5a58b5 libvirt-docs-11.10.0-12.7.el9_8.alma.1.s390x.rpm 5bf773342934de3e6515117943b0c09ecbc195891df4abb309c6c2310dc61c99 libvirt-daemon-plugin-sanlock-11.10.0-12.7.el9_8.alma.1.s390x.rpm 925ef1ff4765de01752c0fa02212179ba16d126d3feaa090e2f8c494ae76358f ALSA-2026:74438 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) Bug Fix(es) and Enhancement(s): * Backport of protocol attribute to IP addresses (IFA_PROTO) [almalinux-9.8.z] (JIRA:AlmaLinux-169936) * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [almalinux-9.8.z] (JIRA:AlmaLinux-269060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.54.1.el9_8.s390x.rpm 0dec3c97f41a2a8791dccd5a98d198ee92c6a40240fef096063e09f5c0b70ce4 kernel-cross-headers-5.14.0-687.54.1.el9_8.s390x.rpm 9322ef99af2632d7b94e17be399fef3694d2785703f8308a3600e70275ae72a9 ALSA-2026:74441 Copyright 2026 AlmaLinux OS 0 1 Important

libpcap security update

The libpcap packages provide a portable framework for low-level network monitoring. The libpcap library provides network statistics collection, security monitoring, and network debugging. Security Fix(es): * libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access (CVE-2026-0799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libpcap-devel-1.10.0-4.el9_8.1.s390x.rpm 6535734b20363377cd2bb843bdae7196292ef8c4c5f1a931c310a109fae88a86 ALSA-2026:74457 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libgs-devel-9.54.0-19.el9_8.1.s390x.rpm d9a897604cf6c8462ba25e040378e7026e9e8dbdab57bacf15003d963a02a971 ALSA-2026:75578 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.10.noarch.rpm 2a584dd14b6d4796d03568e01402b558f4448f3a260c0fbe0f2da4f13e48ce62 bind9.18-devel-9.18.29-14.el9_8.10.s390x.rpm b822fd03c2ab0680ac648962ecf0534bfebefedae40e37b8fe8293d11cd5a799 ALSA-2026:75673 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default mariadb-connector-c-test-3.2.6-2.el9_8.s390x.rpm 0c97f11668eee2176c846b8a3ae59af479541eaa052b68645da7c880a1e9a2f9 mariadb-connector-c-doc-3.2.6-2.el9_8.noarch.rpm 671566d6bd00c1f50a91d7ed5d66397998ffbca21276a0e5a09e5b890c0c0190 ALSA-2026:75767 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.10.s390x.rpm 1180ec8697069b14add812fc1b04dc3cb82a75bcc898a7c603777c5e87bd01ec bind-doc-9.16.23-40.el9_8.10.noarch.rpm f8068bdfd6137ff02e78373df63feaebce8470dee4eb13f7308fcf3766182e8c ALSA-2026:7668 Copyright 2026 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default nghttp2-1.43.0-6.el9_7.1.s390x.rpm 139feab65922c4563d74a3dbe4aadb02554e379b4e24065d24b8d5bf7ccd5734 libnghttp2-devel-1.43.0-6.el9_7.1.s390x.rpm adcb607821d50668699925d5fe9e0424c2842a002e5338c0f1ba1f353abe0933 ALSA-2026:76733 Copyright 2026 AlmaLinux OS 0 1 Important

rust-rpm-sequoia security update

An implementation of the RPM PGP interface using Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default rpm-sequoia-devel-1.10.2.1-1.el9_8.s390x.rpm 5675f7229240464e1314a4123f0034bedefaa864e01f8aad4341b2b47b26b12a ALSA-2026:76755 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.8.s390x.rpm 9df5f87df47a75ac8aa6a354dbd97975ec678adbc500f67d7439cad7c74b43b9 libwinpr-devel-2.11.7-7.el9_8.8.s390x.rpm a8d03922a46c54afc4a1007731979151c5861b46f98796cabf26057deacd263c ALSA-2026:77017 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.12-idle-3.12.15-1.el9_8.s390x.rpm 187efd1f2511ae0af8ebbd7f30cf5472c438fdce0bff9f078ed8e98b9fbd02bb python3.12-test-3.12.15-1.el9_8.s390x.rpm 57d5e5b1dd19f02572d785c58cc4b5667977bcd488d8d5e2267a8863518f4bda python3.12-debug-3.12.15-1.el9_8.s390x.rpm 6ba2b99422b9cdf2599894b52440984e9134a0b943113e2fd97f68eb8da9aeba ALSA-2026:77021 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3.14-freethreading-test-3.14.8-1.el9_8.s390x.rpm 2fc7714f3085495ca5df5213ae4876baab3ab31ccaf128f05686a6bb968dc11b python3.14-freethreading-3.14.8-1.el9_8.s390x.rpm 437fbe37fb958869a54f11f6b37417c0a517aa7941a1a44e905c3ff7b3119315 python3.14-freethreading-debug-3.14.8-1.el9_8.s390x.rpm 5b8237a449352c05c73b7e55e793e6cc81e93e077225a32b191895448aaed717 python3.14-idle-3.14.8-1.el9_8.s390x.rpm 6e88345bb5bd67b36a513e7f6a6283eee2624a5af8ea59c284c1b6d0595e95f4 python3.14-test-3.14.8-1.el9_8.s390x.rpm 9107b78ae1cff31648a09bb508c3f3a940cb24fcb4ae7f19e400c63e4128eaf7 python3.14-freethreading-libs-3.14.8-1.el9_8.s390x.rpm 9a7f5e4faf4f1ccacddd75c55c01a3a82063b10d6bec7949c5be7d8c39b1f10c python3.14-freethreading-devel-3.14.8-1.el9_8.s390x.rpm be4499889d98e600153e25370d2be2f4b7b67e5c21fbdfa02335e4f3b906ca07 python3.14-freethreading-idle-3.14.8-1.el9_8.s390x.rpm be59a88277c96dd39979dd6beaae8cc8a17cbd8f0d96f294dfa99adf90753b4e python3.14-debug-3.14.8-1.el9_8.s390x.rpm e1b2c787adabe97d7d15faea4207e147233d8b2e923228ec2a3bee8ab95d759f python3.14-freethreading-tkinter-3.14.8-1.el9_8.s390x.rpm f0319b2a29249e58df40f34511a601fb306e7f9f9447367223cee03237cb5511 ALSA-2026:77689 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) Bug Fix(es) and Enhancement(s): * "iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors" broke rx-vlan-offload on almalinux-9.7 [almalinux-9.8.z] (JIRA:AlmaLinux-169480) * [GNR-D] missing interfaces tspll_cfg (JIRA:AlmaLinux-183201) * AlmaLinux9.8z KVM guest panicked in vmmouse driver (JIRA:AlmaLinux-186577) * Add Epson RX8111 support to AlmaLinux9.9 [almalinux-9.8.z] (JIRA:AlmaLinux-212014) * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [almalinux-9.8.z] (JIRA:AlmaLinux-256279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.56.1.el9_8.s390x.rpm b8da318e1914a3e176e758e4f74c63ef3cf0e2026791537cbb90d54e9231c8c2 libperf-5.14.0-687.56.1.el9_8.s390x.rpm bdc3fdde8acc4301e6c4b7ce16094efdd2c363b244538723d147ce0c29273995 ALSA-2026:7915 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default bind9.18-devel-9.18.29-5.el9_7.4.s390x.rpm 691a49d3a0500ffd0de9e111261494ae5bb4ef1205b8549e8dddd541a8fe4be2 bind9.18-doc-9.18.29-5.el9_7.4.noarch.rpm 9e325df1d0aa41c0f14eb50dcf97f2fe6e998789cba551763a254703171afd2c ALSA-2026:79281 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt; UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) Bug Fix(es) and Enhancement(s): * glibc: Stop shipping glibc32-debuginfo package (in debug channels) [almalinux-9] (JIRA:AlmaLinux-219516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default nss_db-2.34-283.el9_8.s390x.rpm 1bef167a169c48066c19772826fe111dbfe7a3a0783d907a94550605e44ecdb7 glibc-nss-devel-2.34-283.el9_8.s390x.rpm 47e63fc83419355f797ad044f494b38c02934b31760e2320ae8f3c749ae88f34 glibc-static-2.34-283.el9_8.s390x.rpm 6510c65f6a70cc26bb2bb501e5d579982a692a2627e0f58fbbb83f2055efa605 nss_hesiod-2.34-283.el9_8.s390x.rpm 9c88f9992feb944ed0463bc5a5312e79bc536d8add4b1f0914979feeff4ae9d8 glibc-benchtests-2.34-283.el9_8.s390x.rpm fad6c9001f18f17dbfec6743086cd73ffba0b578c029801a77ea2531ac4e899a ALSA-2026:80497 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.4.s390x.rpm 5398116c91f9ef200712f3dbf9edcbc2630b1397423cbc2df074c7aa023b2b20 ALSA-2026:8075 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default bind-doc-9.16.23-34.el9_7.2.noarch.rpm 6230f544cc78b94f7f849f02776a9ee03d0d629a65ae19a135fca406798a0a1d bind-devel-9.16.23-34.el9_7.2.s390x.rpm d0a7b161d73b79e5a975392b3231b32cd81fcf3038cc95f9e0f8ea96132cd782 ALSA-2026:80825 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.8.s390x.rpm 5c552a702f80f6b89b167038ea87b916ffc236891bfa1635f976006312cd7d26 ALSA-2026:81532 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default pcre2-tools-10.40-7.el9_8.s390x.rpm 033c4a80545e1afa4e44099bae5435758bd5f6955dd7093b79c6d7b126de85e7 ALSA-2026:82015 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.4.s390x.rpm 4a2c1b7e5c57f253054a1b813ca262b619c8a9d81e948d6076823042b4b315f3 xorg-x11-server-source-1.20.11-34.el9_8.4.noarch.rpm ad0c1b502f04032297357cb36967d764515c70d09ede769ca1d12ab3e5bcff25 ALSA-2026:82094 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default librabbitmq-devel-0.11.0-7.el9_8.1.s390x.rpm 95662d0dc5a7dd24a4c3d5994dde7f44474e0262941febd13a85559dc233f8e9 ALSA-2026:83156 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.58.1.el9_8.s390x.rpm 023b3c905c7aca42484155a5709f6a010b1c51c5d2b37ce8654364f413516dce libperf-5.14.0-687.58.1.el9_8.s390x.rpm 764f9a6f624b4b9fc72c7ef3c32257e1b07175b778e9ff1181c358960a67512a ALSA-2026:83546 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default wireshark-devel-3.4.10-9.el9_8.5.s390x.rpm 51b6b05d94f27a38f2a453eb253766ce115d9996010eec115665a35236b3e00b ALSA-2026:83553 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libgs-devel-9.54.0-19.el9_8.3.s390x.rpm 35ca0a9b3104e3c99cfd484ecae695bb04a9ac09b177f81abaa49d55641e2b51 ALSA-2026:8457 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984) * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.6.s390x.rpm 4fb55e15ff17e6e1889b71b09f7fbd80008fa6b1a3bb74bb3898febd3fd4d1cd freerdp-devel-2.11.7-1.el9_7.6.s390x.rpm 5a8db40b30e86512c2afc3bab39598d9d7829e87de8830bd254088165e20ced6 ALSA-2026:84574 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.5.s390x.rpm 05b424f46f66937c456769201228137288a741bba63b9dc4dca5d7084bb725f0 xorg-x11-server-source-1.20.11-34.el9_8.5.noarch.rpm 2773c8f10cf5cdb9a9e0fab413643f95230344eabc2607e96c6fba7b65410a67 ALSA-2026:8469 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_7.s390x.rpm b6dc3e8bc87c57d7758dd1c5f259a144d025eacb099c4bf2f5fcb05597174f2a ALSA-2026:85193 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.4.s390x.rpm e3b9d9ccf15614a15d12b21b2ebbce5cf3fd2c565674759d4f9dcd0295183210 ALSA-2026:86033 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.59.1.el9_8.s390x.rpm 5444b08278a028d88606322667c3097009fcd75c113712ae584d8e2f86573661 kernel-cross-headers-5.14.0-687.59.1.el9_8.s390x.rpm fd5631c7738906ab2da51953fe70038ed5ae758ff0dfed708481016693033de8 ALSA-2026:86169 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-9.8.z] (JIRA:AlmaLinux-277793) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8.s390x.rpm 846a6650b47bc3b126b165361a6a299935ff069726950ccdd69b5b2b19eb868d ALSA-2026:86171 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-9.8.z] (JIRA:AlmaLinux-277800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.s390x.rpm 9a8d499378f33d6a92e32f853abb6b850cd772029d911749bd30a354bc34189a ALSA-2026:86193 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-9.8.z] (JIRA:AlmaLinux-277808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.s390x.rpm bf9d8673198f4509d865fa19ae0a7b6e6ae4ffac98a574e77e843331f92a1d7d ALSA-2026:86983 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.5.s390x.rpm 20e1b4842e5ae5d60ac4bef563871b681224f919cb9638b4f423e08c6613f421 ALSA-2026:87082 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.2.s390x.rpm 1a4b7b09a352b08319cb29a1e03eef243c26cce5daf6f6f768addea8a3390bbf ALSA-2026:87805 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) * kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) Bug Fix(es) and Enhancement(s): * RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.60.1.el9_8.s390x.rpm 09954b1db3f768dd3ecd94820f0e68e73aa5ca37c56b08b5ed3e4f29f034f8b7 libperf-5.14.0-687.60.1.el9_8.s390x.rpm e634f5e7a10a18fd283b0c11078ec4d8df9fb5167290b4c0dbd277e77ce5effd ALSA-2026:8859 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default giflib-devel-5.2.1-9.el9_7.1.s390x.rpm 4afae997e8e4585c820a4e9a90ab104ad98389a847566d303cf6cc966b5fd22a ALSA-2026:8888 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.1.s390x.rpm 7f5aa48d4f8de305848e8c3b2d04cdfb3bf09d86c347451514893b58897e8738 ALSA-2026:8921 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.49.1.el9_7.s390x.rpm 400c509a324eb1396643d8e411598f77ed0e4e9117d15182fd525673284bc496 kernel-cross-headers-5.14.0-611.49.1.el9_7.s390x.rpm 7158059f6f872f697c2d10e8237459d97c3424296e4e55cb017811c802b6855b ALSA-2026:89742 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default python3-debug-3.9.25-7.el9_8.6.s390x.rpm 2ae4c1789d22c40d09cdd8e5a626b3db7332edd7139369b35a18792e14e8c3cd python3-test-3.9.25-7.el9_8.6.s390x.rpm 34708b53d1bb58b4d55e11aab02277cb5139560cfe47d7d39c25b076c9ac6aed python3-idle-3.9.25-7.el9_8.6.s390x.rpm d48097a2617839da5144daf912cd42f787b6261a3b72a81228f37e588e17634c ALSA-2026:89745 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.12.noarch.rpm 3e440850130266e96cf9744617c8fb9a9598d4aa754fa8c74fd8cad49bb9d04a bind-devel-9.16.23-40.el9_8.12.s390x.rpm b87dc22fd64e3fa7b2c61cf221514607af464501622c28c9bd26f56239095766 ALSA-2026:89746 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default bind9.18-devel-9.18.29-14.el9_8.11.s390x.rpm 7a2440d035cd57f1e2dc2970a08284690870381f0ea1e7407e7ff7f039aebc4a bind9.18-doc-9.18.29-14.el9_8.11.noarch.rpm bd56e931b4a46d62a43b94895cf0e92c0b6d6c79a308a996f478e30cce79e25f ALSA-2026:89753 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security, bug fix, and enhancement update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default freeipmi-devel-1.6.20-1.el9_8.s390x.rpm 5b4e3e6c556c9e380049e2bbab3342fdcc097de9e7c25b998bb054beafa1aad1 ALSA-2026:89850 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.6.s390x.rpm 078b789ec2da239c7a39da64a382a7695bd5a02018f0d46e3eb97cea4e517afa ALSA-2026:90365 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:AlmaLinux-257205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_8_default libperf-5.14.0-687.61.1.el9_8.s390x.rpm 07eea14af56bc2b92d28a48960ebc2ae942b834f8b00794c6afbed1bfc6ec628 kernel-cross-headers-5.14.0-687.61.1.el9_8.s390x.rpm ccfb32c4ba7973c9164bd8779fbd16ad53f4f007c0de7af2ac120df3ed62a598 ALSA-2026:9686 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-17-openjdk-headless-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm 32903155ff3fe58b4d629f940bc6eb2c200c30c51f559294823dcdbb07589e1c java-17-openjdk-jmods-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm 3b0f3d18ba912390b97a1be4b8c836c3373cca0eb15cf2c784a0b6831efeceef java-17-openjdk-static-libs-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm 3d14b4d1c9ca24bc1b2dfae973f35664081d7cf837e6669a26dc5e2dbdb0bf14 java-17-openjdk-src-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm 4739cf6a5b08c89f0c16edda2090ccaf9493b5791683353c65d64ae30d514f78 java-17-openjdk-demo-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm 57842d586de3b166288f8fd992ff73d1a750c953d85b567f9812352123e21d9d java-17-openjdk-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm d57fcc2b479b4a0a35f5014b2ead49932075b0be492621d548c5d425b4d6392e java-17-openjdk-devel-slowdebug-17.0.19.0.10-2.el9.alma.1.s390x.rpm faefc7293807d48323c8a62a8eb84b1ff923bc3bb404d6855ba8f95e04212477 ALSA-2026:9689 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) Bug Fix(es): * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169617, AlmaLinux-169951, AlmaLinux-169952, AlmaLinux-169942, AlmaLinux-169953, AlmaLinux-169945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-21-openjdk-jmods-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm 59a2bc4ea15ab7b791864363cc89891d6706795828ac6e8aae4b8955490791c2 java-21-openjdk-src-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm 62555b876105976acfcadf352623ff558680322d994fb6cb82177d3cc0be7ad3 java-21-openjdk-static-libs-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm 6832de40098fc8b25e96af1d4639943fa6a70e1b5d446cda73678d2591963fdc java-21-openjdk-devel-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm 8957e11e4cdf23b477d2454dc968269b092d9844e1774d289362969e43a1a4fa java-21-openjdk-headless-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm 931f3437187de5b26f08b8112607ca1e7861a3cd7adc49fac95fbf0e917b357a java-21-openjdk-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm b057d6e62a540bd488ebbc81b748a918382e6289e68f1f812806e99fe02c05d0 java-21-openjdk-demo-slowdebug-21.0.11.0.10-2.el9.alma.1.s390x.rpm d9cbd6fd0514cd407a97f64599372fbc29e7970a278af6787c18a50f912bcf7b ALSA-2026:9693 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) Bug Fix(es): * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default java-25-openjdk-crypto-adapter-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm 13ad3ced1e4203586f22dae45c37418bc80a84ff3014d2f93b2af61806b86278 java-25-openjdk-headless-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm 1a57008c783551876fc988604c26434a5c26d229136b92fe2f8365a6408e341c java-25-openjdk-src-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm 44b9688af8371e2786a157d50d44b2f3b4c626452b557718ae767a9ec6f6a3a6 java-25-openjdk-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm 561a79bc47229c42ba568cc1dd99d866307b75a58a6dceca833649ff5de28463 java-25-openjdk-demo-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm 5a04640a87c91f73294ca2a472915796e5d75058308223ba26107ff9bf61a1fb java-25-openjdk-devel-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm c74f3e8df01ee9b10c045ad370ca92552d2ca5311a79aa69b6aec9d5cee270c8 java-25-openjdk-static-libs-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm d3b907be520756f02bb53979e93fad866fe80c4fbbdd9761ffe19721cf1a1d71 java-25-openjdk-jmods-slowdebug-25.0.3.0.9-1.el9.alma.1.s390x.rpm dcfbd561392d1c0bcf0c79c5cd4ca387e15e29093448020495eed4dbd26d9c22 ALSA-2026:A002 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.49.2.el9_7.s390x.rpm 85c1d103e5ea9003715ac012de05dbafdde187c4b46959562e5821ebbf5f443f libperf-5.14.0-611.49.2.el9_7.s390x.rpm 939abfc10ba7c51c13e1d2cd850def00ae3f6e1f35756ff2f565e50049db2b9e ALSA-2026:A005 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default libperf-5.14.0-611.54.3.el9_7.s390x.rpm 9c62b029ee34b7f30e01a04386886199ca96cb792e0c8131d05bfa90ab028456 kernel-cross-headers-5.14.0-611.54.3.el9_7.s390x.rpm ad0f2bbb91ea827df24e2099251e5acbb7cf5435d67950c557ec35cf6664ab26 ALSA-2026:A009 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300) * kernel: ptrace: require CAP_SYS_PTRACE when task has no mm (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-s390x-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.54.6.el9_7.s390x.rpm 75f73be09441e0dfa0a332bb4e610ca2aee6e28f9d52ce944dc7b0d8c014a992 libperf-5.14.0-611.54.6.el9_7.s390x.rpm daf9b8808beef952d43779f3a29b31a43125adf581ac2e7478cff6972dd04488