ALBA-2022:8256 Copyright 2023 AlmaLinux OS 0 1 Important

qatzip bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default qatzip-devel-1.0.9-1.el9.x86_64.rpm 7b17a7e37392d7acb8dbe86516efc01f4988702dd6d1d449458ac6e760186844 ALBA-2026:39332 Copyright 2026 AlmaLinux OS 0 1 None

kernel bug fix and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Bug Fix(es) and Enhancement(s): * XFS data corruption using reflink [almalinux-9.8.z] (JIRA:AlmaLinux-193937) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.26.1.el9_8.x86_64.rpm 2309c2d892c19f12254811d59416cdd769b373400f1f421821377ade3fd1ba97 kernel-tools-libs-devel-5.14.0-687.26.1.el9_8.x86_64.rpm a4bcdbe18cd0797b57a5db8c84a54f33f9a959980264a2042c1ac34788d59d84 libperf-5.14.0-687.26.1.el9_8.x86_64.rpm f7744c12d2eb327024df98d3240458c30fbea5593ab0f3db707b921e5bd03972 ALSA-2022:5099 Copyright 2022 AlmaLinux OS 0 1 Important

grub2, mokutil, shim, and shim-unsigned-x64 security update

The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es): * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733) * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695) * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696) * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697) * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734) * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735) * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736) * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default shim-unsigned-x64-15.6-1.el9.alma.x86_64.rpm 13839385d82978bf25d4073b5d66f5c99376795605e37bff69d97726ee095d70 grub2-tools-minimal-2.06-27.el9_0.7.alma.x86_64.rpm 31e6d5091153ade52a4fb7679f3e66015e06230ddffe4e9d44be2be43e661b04 grub2-efi-x64-2.06-27.el9_0.7.alma.x86_64.rpm 3bf5652571ac5dafd7bd7e3220a2943fa4fd6a7e2fbdfd7524a7312b51577de4 grub2-efi-x64-cdboot-2.06-27.el9_0.7.alma.x86_64.rpm 4a0c34f66a589fb6e36e023fb18adab58d4785e1f73306583f303da0cec56502 grub2-tools-efi-2.06-27.el9_0.7.alma.x86_64.rpm 5b00e7ed258bedbfcd25c731d58ce8d2a18699982b929828e83763d7ab34148a grub2-tools-2.06-27.el9_0.7.alma.x86_64.rpm 6c2c0baad753ebee0ac9221386bd4904c9a25883d825294cb358980632ed0ba9 grub2-efi-x64-modules-2.06-27.el9_0.7.alma.noarch.rpm 7c1a39435cb145b6331f3d84a54a2b8bb29606f0240fcdd51c7ef7e400db63d5 grub2-efi-aa64-modules-2.06-27.el9_0.7.alma.noarch.rpm 8741776e12b0fd0ce6b1682017da1f8873880b51e05189756550de434d50a722 grub2-ppc64le-modules-2.06-27.el9_0.7.alma.noarch.rpm ac01bf19abdade8860177a8e290b70d806375c8a2d9ed3ff47b54d1256005f16 grub2-tools-extra-2.06-27.el9_0.7.alma.x86_64.rpm bfdba0600c7a22194f551feb4b4180ffb3c3606d1bd284e35af6c16592944d5a grub2-pc-2.06-27.el9_0.7.alma.x86_64.rpm d5dce45b75bf04e717a88a8e9d17b4ed01f3cb2617730f015a7895ed384ca77c grub2-pc-modules-2.06-27.el9_0.7.alma.noarch.rpm e2370f5a48d28813f385af92662f53c7c47d593d5c735809aaa6b7d8bc329c07 shim-x64-15.6-1.el9.alma.x86_64.rpm eb23ed7b73eef84cdc6988d633a466c94dbcfe74e1ccce14075ce68b2b2ad5e1 grub2-common-2.06-27.el9_0.7.alma.noarch.rpm ec2931fabadf7f9962946fbe110f6ac90a76e684339698e6685369054ebb6cb7 ALSA-2022:5249 Copyright 2022 AlmaLinux OS 0 1 Important

An update for kernel-cross-headers is now available for AlmaLinux 9.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Small table perturb size in the TCP source port generation algorithm can lead to information leak (CVE-2022-1012) * kernel: race condition in perf_event_open leads to privilege escalation (CVE-2022-1729) * kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root (CVE-2022-1966) * kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * make SHA512_arch algos and CRYPTO_USER built-ins (BZ#2072643) * SR-IOV performance > 50% degradation (BZ#2074830) * fix data corruption caused by dm-integrity (BZ#2082187) * SCTP client-side peeloff issues [almalinux-9] (BZ#2084044) * TCP connection fails in a asymmetric routing situation (BZ#2085480) * Fails to boot Multiple RT VMs each with multiple vCPUs (BZ#2086963) * spec: Fix separate tools build (BZ#2090852) * call traces related to eeh_pseries observed and vmcore is not captured, when kdump is triggered (BZ#2092255) * Mark ThunderX NIC driver as unmaintained (BZ#2092638) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default kernel-debug-modules-extra-5.14.0-70.17.1.el9_0.x86_64.rpm 1d0523e5748372ee56447a080eb6c2e8800e60b578ae85a9c462c1c0fb258e26 kernel-headers-5.14.0-70.17.1.el9_0.x86_64.rpm 27fbc6c1aa3f2d1566045ba48e2cd5fc7d151017ca9ca95be7d3bc6f29ae3ab4 kernel-abi-stablelists-5.14.0-70.17.1.el9_0.noarch.rpm 6c1459fb8b333303c7d981e116ccc0720c4f02c49ad9b933a93cdd2a4dc0f103 kernel-tools-libs-5.14.0-70.17.1.el9_0.x86_64.rpm 6c643afc3c35f76c13556a13ffde3a23a0495c569dec28c11708b8f3ac0a167c kernel-debug-5.14.0-70.17.1.el9_0.x86_64.rpm 703cc481d0834409999e329b254650d2fd5e430a2cf46dbc2c704a0ae4810abb kernel-debug-devel-5.14.0-70.17.1.el9_0.x86_64.rpm 7a82cd38ca17dddb85ec3177f597c07ea38c4ac603f895691d66994749ccd7ac kernel-cross-headers-5.14.0-70.17.1.el9_0.x86_64.rpm 7b15545c222e80ac4e1957211f5d6f7f5c5125b342868f8abc8bf27bd69579db kernel-doc-5.14.0-70.17.1.el9_0.noarch.rpm 809a6a2193762c20c65675927231f196c18a5b97e6832f1fe1714467a5b785ca kernel-tools-libs-devel-5.14.0-70.17.1.el9_0.x86_64.rpm 9223c2135eee664d9e6dc47f33e1c9f4aeb8dd5c2287b8c33fa8cc3b23e86187 kernel-devel-5.14.0-70.17.1.el9_0.x86_64.rpm 9514d88db80739811d5f6a3b49752fa2a8378064a2bedd76ab754b9a7c8da5c6 kernel-devel-matched-5.14.0-70.17.1.el9_0.x86_64.rpm 9a00ccaf1e5dc1ce882a360232cc0a6bd52310f1296c4aff5c179f0e5a7c388a bpftool-5.14.0-70.17.1.el9_0.x86_64.rpm ab64e0cd950170da3d2302a6e3975b849ddc5202e3196c73f53f00b09e8ba842 kernel-debug-devel-matched-5.14.0-70.17.1.el9_0.x86_64.rpm adc8071377693720da9822f5577b72cf559db1d81c4d394d9cf5fc6843ca6198 kernel-debug-modules-5.14.0-70.17.1.el9_0.x86_64.rpm af0eddad0fe1df463a92d7353c40d79b0ab394802f28fede8aa114cfce4b2141 kernel-5.14.0-70.17.1.el9_0.x86_64.rpm b4ef1468eebca594833b8b80812485e7b32445b7e23bf6a01bb4e981cd9b4970 kernel-modules-5.14.0-70.17.1.el9_0.x86_64.rpm c44a2bc75845bc5140eecc3e7b62a493f68e35f65084c948f9c767d58c0167a4 perf-5.14.0-70.17.1.el9_0.x86_64.rpm c8463b6384dadbbc65295d295a9898c1e49f69d6f68504d926f53ce2e0ba0fc9 kernel-tools-5.14.0-70.17.1.el9_0.x86_64.rpm d81db30c061a644b1e860f8933e1b108ce7602b3e50cec935a4eaef9f54f3c17 kernel-modules-extra-5.14.0-70.17.1.el9_0.x86_64.rpm de03e4dbe3a865a310109649a2e475b54b00fc6ee3eec2b7ffef78bc4f2c5870 python3-perf-5.14.0-70.17.1.el9_0.x86_64.rpm e7c340de8f300966048a604e4c74b55d3652f9e6cbc5af747c3864fc35bfbf3f kernel-core-5.14.0-70.17.1.el9_0.x86_64.rpm e8273ab41ea0984bd7bda47a9f80193467ab968db9016db7aed91a39e542b22f kernel-debug-core-5.14.0-70.17.1.el9_0.x86_64.rpm fb653bec1defacebf556298589a18dcb899b74639443c621f9b054a480fc7ee3 ALSA-2022:5252 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libarchive-devel is now available for AlmaLinux 9.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: an out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default libarchive-3.5.3-2.el9_0.x86_64.rpm 035f3b90a81b61d846914a6953804d32e09f0c6c3b2978f783c964c0cfe2c164 bsdtar-3.5.3-2.el9_0.x86_64.rpm 042bd93df93412ecaf7c6b59137e7ab45db3f03987046b74f8da2b5375015a9b libarchive-devel-3.5.3-2.el9_0.i686.rpm 33d1567208bd84d8697507947591691b0ab6ae6761160c181847d1c67e5ea845 libarchive-devel-3.5.3-2.el9_0.x86_64.rpm 62d30b0fc078e27e530e051a08cf75a297905e7c495d733de96192fd15dbfb63 ALSA-2022:5257 Copyright 2022 AlmaLinux OS 0 1 Moderate

An update for libinput-devel is now available for AlmaLinux 9.

libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default libinput-1.19.3-2.el9_0.x86_64.rpm 05873e89593917b8f2242fadab3804fa8285c84637059347e092c07651a9788e libinput-utils-1.19.3-2.el9_0.x86_64.rpm 3d72a89e967db7ac7f6afb33b6c30323564340c1384b23727056c5fe36164fef libinput-devel-1.19.3-2.el9_0.i686.rpm 9e4b1db4dbf3c19a785a9dbb287a9f87ff61aa7e56d0bc13718a76c6dc67451b libinput-devel-1.19.3-2.el9_0.x86_64.rpm b23415eda0f663ab67f71042440f204251cc98b0ff88de5e77ea8a0c276b9af2 ALSA-2022:5695 Copyright 2022 AlmaLinux OS 0 1 Important

An update for java-11-openjdk-demo-fastdebug is now available for AlmaLinux 9.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-11-openjdk (11.0.16.0.8). (BZ#2084777) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-11] (BZ#2099915) * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-11] (BZ#2107866) * Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-11] (BZ#2107868) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-11-openjdk-static-libs-11.0.16.0.8-1.el9_0.x86_64.rpm 0a0ac5d894d920db85039530c5c5171d8a825471b99daa664ca4b6a1161eca95 java-11-openjdk-devel-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 1edc3032bac1557c830843a6f713f7bfb240dd2857a85b0ed9e3586d92936973 java-11-openjdk-static-libs-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 216b7d68a9edc3da26b9f13d601a7f259d446a0eafc27a29a85903f521461ae1 java-11-openjdk-src-11.0.16.0.8-1.el9_0.x86_64.rpm 51807029220d508c792ad8c2a969a44771fb4ba57325c856c0e9fa8d7b89f13a java-11-openjdk-devel-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 59ad8ad40fb70c535e9c781fd3c1b8b32e70c4ad40ca83b74b3c68cdc19a39c6 java-11-openjdk-javadoc-zip-11.0.16.0.8-1.el9_0.x86_64.rpm 5d74f97cd8ecb903789a253746d1bbfe6cce2d8f6abe86fea87a190d0c37eff3 java-11-openjdk-src-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 5ea3aa5e146a61a45ba8a4e02ec39864a7af53dc1e21073be70954dff10844ce java-11-openjdk-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 6dd09796238994dc5a10982f41ebb548b327fd6695d3c281f548b392322fc44f java-11-openjdk-headless-11.0.16.0.8-1.el9_0.x86_64.rpm 6f84cca5cea55a43a8e660b3ad77e513e2838f5d57f302dff4e58f66b8bd6dfc java-11-openjdk-jmods-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 6fb596b27d404e76b337679ea82b108033846e659b3dbb7c6e7869ef93358306 java-11-openjdk-src-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm 6ff595e562c28c8fbdbb449d40c5681d1a4e86f711e2a8ec652b99ecc8af7f3f java-11-openjdk-jmods-11.0.16.0.8-1.el9_0.x86_64.rpm 97b466c1c6832e6c5b3f499a776ef1a277c273f1fdf8955153d724091fbe0b97 java-11-openjdk-demo-11.0.16.0.8-1.el9_0.x86_64.rpm 99782822912b6f0a35f04c4801978a57931da12b1c218d34fb590f4c544a1ca4 java-11-openjdk-demo-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm bd33e7ce71d56537cd705d7453d7dc2629bd946be37c860526a16ce504589ce0 java-11-openjdk-demo-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm c1920d798805e0a8b381d0118c9d412684207e4ae3149dc5bb32257f4022a590 java-11-openjdk-headless-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm d3f64b470f1f3392f1ede263864d80cdefb3547bcd028c2bc5bea0c635f9401c java-11-openjdk-devel-11.0.16.0.8-1.el9_0.x86_64.rpm d4259a0116f2b6c30acdd0bd33cab9f73dedb7ff4acf2b1963e5a5d35b63bf6d java-11-openjdk-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm dde5b5fee47221b89c916a242ef62e52fc3e03138e59d84acc599ce5adcfb629 java-11-openjdk-static-libs-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm ddec3e749f4a053eacddc3d492bcb810772c0fc49f32d96d2715edb6827615cb java-11-openjdk-jmods-slowdebug-11.0.16.0.8-1.el9_0.x86_64.rpm e2fab06765c0cf3d20362ce5f2507551bec1bfea3aed6e45cba2738d5b385e14 java-11-openjdk-headless-fastdebug-11.0.16.0.8-1.el9_0.x86_64.rpm e44a0bf1cb43abd8998b5aa09c9d38b1a270ef9eaf688202c7de261149736fe6 java-11-openjdk-javadoc-11.0.16.0.8-1.el9_0.x86_64.rpm e996a4222bba3cf049b7d03f68efa26f74f3c1e8871b2263ea44432f937c92d3 java-11-openjdk-11.0.16.0.8-1.el9_0.x86_64.rpm f11307a1530949034934a777bee1a95a8c6af462c866ade82f1e16eef9cbb349 ALSA-2022:5709 Copyright 2022 AlmaLinux OS 0 1 Important

An update for java-1.8.0-openjdk-demo-fastdebug is now available for AlmaLinux 9.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-1.8.0-openjdk (1.8.0.342.b07). (BZ#2084776) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * rh1991003 patch breaks sun.security.pkcs11.wrapper.PKCS11.getInstance() [almalinux-9, openjdk-8] (BZ#2099916) * SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode [almalinux-9, openjdk-8] (BZ#2107956) * Revert to disabling system security properties and FIPS mode support together [almalinux-9, openjdk-8] (BZ#2107958) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-1.8.0-openjdk-javadoc-1.8.0.342.b07-1.el9_0.noarch.rpm 016c0c76cdcb9e6561492bf3c35a2cedde2695d2d3573cb0ca2a4fa753bf5a75 java-1.8.0-openjdk-headless-slowdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm 03eb47dda75235d9184b13a78115ea50895713518dd504874cba553ed3da1e09 java-1.8.0-openjdk-src-slowdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm 065b9873cf7fa717dd7872a2a9576ee555443be34ec7165793c1f29a4c2a2baf java-1.8.0-openjdk-demo-slowdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm 40c65b0e61fef85904e1761cb165ea5ac59446146ff2e53d8713b45fd694c60e java-1.8.0-openjdk-src-1.8.0.342.b07-1.el9_0.x86_64.rpm 57042bef79ed5d1466c0bdbdc86d3b5637b28c033742ef88b2082aff36cade7e java-1.8.0-openjdk-devel-1.8.0.342.b07-1.el9_0.x86_64.rpm 5a669f6cbe49e6cb57a7ec5ab377ad58f26b77822600f248c1518a80ba4f3a67 java-1.8.0-openjdk-1.8.0.342.b07-1.el9_0.x86_64.rpm 5c83987a8fba96dbc61da960e6c477a6458ed1909e89c51115e2e08e0b593cde java-1.8.0-openjdk-demo-fastdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm 71471cf8f67a038f9399c349deb2c14308f496890df9dd7f62461a102743a43b java-1.8.0-openjdk-headless-1.8.0.342.b07-1.el9_0.x86_64.rpm 8b0de8c6fd05f011810e6a30978bbe6e6c2707a9c6c9845a97f15fe571d298dd java-1.8.0-openjdk-src-fastdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm b595ccc1c91f6bac437b22003afd3663cc176cb97ac8d857df5d58b6ca69079c java-1.8.0-openjdk-headless-fastdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm b63276094dca82dbd6d6465e0e1cda8f207e33481371b50e49e91983c4b30a57 java-1.8.0-openjdk-fastdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm b6c0399c4e239896a604d1f6fc24c46df783d15b2d543603526e184257351cd2 java-1.8.0-openjdk-demo-1.8.0.342.b07-1.el9_0.x86_64.rpm b997a5f1d22ddded7324b2a7a4c048b9cdd873ed1e1891f27e7bfe15868802f9 java-1.8.0-openjdk-slowdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm e63ed2bbf5c80a63948940201d80191130780db4fa911060c537cfafa30be4ba java-1.8.0-openjdk-devel-slowdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm ee028e2b534b83f401da98d42a9b3156ae6ffc3add9841acca4368d385e09059 java-1.8.0-openjdk-javadoc-zip-1.8.0.342.b07-1.el9_0.noarch.rpm eef6d2e8806b1e7e959d8ea2224f3ff6f2aa5e4802e5b61ddcebf3adad114d9b java-1.8.0-openjdk-devel-fastdebug-1.8.0.342.b07-1.el9_0.x86_64.rpm fb470a3cb6ae1707c74840af87e131deb1b402f1f5d9b69431acd17ae56bdb4f ALSA-2022:5736 Copyright 2022 AlmaLinux OS 0 1 Important

java-17-openjdk security, bug fix, and enhancement update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. The following packages have been upgraded to a later upstream version: java-17-openjdk (17.0.4.0.8). (BZ#2084779) Security Fix(es): * OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) (CVE-2022-34169) * OpenJDK: class compilation issue (Hotspot, 8281859) (CVE-2022-21540) * OpenJDK: improper restriction of MethodHandle.invokeBasic() (Hotspot, 8281866) (CVE-2022-21541) * OpenJDK: random exponentials issue (Libraries, 8283875) (CVE-2022-21549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previous AlmaLinux builds of OpenJDK 17 altered the arguments passed to sun.security.pkcs11.wrapper.PKCS11.getInstance() in order to facilitate FIPS support. This build adds an additional form of the method, retaining the original arguments, so that applications which depend on this internal method continue to function with AlmaLinux builds of OpenJDK. (BZ#2099919) * With previous AlmaLinux builds of OpenJDK 17, Mac key generation and import would fail due to the lack of the CKA_SIGN attribute on the key. This attribute is now added as part of the NSS FIPS configuration. (BZ#2105395) * With the release of AlmaLinux, a change was made so that disabling OpenJDK FIPS mode required the use of both the -Djava.security.disableSystemPropertiesFile=true and -Dcom.AlmaLinux.fips=false options, with the intention that FIPS mode could be controlled independently of system security properties. This change has now been reverted and only -Djava.security.disableSystemPropertiesFile=true is required to disable FIPS mode, as in AlmaLinux. (BZ#2107941) * Previous AlmaLinux builds of OpenJDK 17 running in FIPS mode with a SecurityManager would fail due to a lack of module access permissions. This has now been corrected. (BZ#2107943) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-17-openjdk-demo-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 101f3f390cc113f5d642b5118f23df065de34152aaa942791f8462b9f52fccc7 java-17-openjdk-static-libs-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 15a8b71d1bf811bace6fc9aed7c14e18b9533a9e0d88a7632a4d7a03e471278f java-17-openjdk-javadoc-zip-17.0.4.0.8-2.el9_0.x86_64.rpm 320a0d68bd774dc16efb48cd72de6beb75125503b7d4ae23a2e84a4037ccf822 java-17-openjdk-src-17.0.4.0.8-2.el9_0.x86_64.rpm 34c2871d89cf7a0cfec5b2b7d128a70719626b234ac0b28d3766a58f264b22b9 java-17-openjdk-static-libs-17.0.4.0.8-2.el9_0.x86_64.rpm 376ef3d90fb0291a22d9845b5baea7056f8bf9f3de7b46c8f4f4dc9c5f9990fd java-17-openjdk-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 4c1fb8aaa3ac31029f829b39eb4fa2b5a2ec70ff2fdfccaf10762332b963460c java-17-openjdk-devel-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 4df4258714ff01ffadac8984fd9e892d8549454d8019ae9b54f73e8507623d92 java-17-openjdk-17.0.4.0.8-2.el9_0.x86_64.rpm 66be22c00c90bc7d5575e415b1645139e333c779c3bde4eec037d07aed270eb8 java-17-openjdk-devel-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 865e3bbaf6577283d3e84fa6ddb0b25c53c3dff1f64225231bb8868aa403c74c java-17-openjdk-headless-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 86eeea01d5b5ec2ecd4a2369297c41f220cb4a5febe034de06e7c2457a5bbcd7 java-17-openjdk-jmods-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm 91bf49a7fd407907c0f56b96828d36a962693f03615d40a49d2fb8202565a433 java-17-openjdk-demo-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm ad524443ba127992d594c15cd45325dff880d576eb5f6536733953a0acb37aa6 java-17-openjdk-jmods-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm bc544038eac58b66207338c3c6074c34010edd21a3c2c2ab843f30089b329849 java-17-openjdk-headless-17.0.4.0.8-2.el9_0.x86_64.rpm c154fcd7f04b808d16a84ed3fac6cf2f7086a2621f763402b67b56e41674fb23 java-17-openjdk-static-libs-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm c7e9e880c3223cef0726f4f4cfd66a74b067556e199a5e24f8df5a4b59c232a7 java-17-openjdk-devel-17.0.4.0.8-2.el9_0.x86_64.rpm c8a11c51f725abeb88afb7ad25cdc0b5a94f688734a927fc3d706c09b00cf153 java-17-openjdk-headless-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm cf6013977e106cbfe8aa376c84df50ec17f99b84f314bb90e20c1b027332b60a java-17-openjdk-jmods-17.0.4.0.8-2.el9_0.x86_64.rpm d5c1918f5b7de92562702360d5faf4262f00f05bb2f910f4f0ffe3ff33cfd33f java-17-openjdk-demo-17.0.4.0.8-2.el9_0.x86_64.rpm e8772af86ba92a5193921864d3d0c138983b775c53253223b5bb45713957b457 java-17-openjdk-src-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm ece98c00b87ce8501fdbd93fc9d56aa1df531c4e158172b39c7a1e7ebf1d3eb3 java-17-openjdk-fastdebug-17.0.4.0.8-2.el9_0.x86_64.rpm f56a226a725496954b3ffb73885ada579dbda4b49fd065460c10872ed31ab24c java-17-openjdk-javadoc-17.0.4.0.8-2.el9_0.x86_64.rpm f82aa5b6f9b3ad402c6bdef7493b661539959f69b6d0188e55f9251226858aba java-17-openjdk-src-slowdebug-17.0.4.0.8-2.el9_0.x86_64.rpm f8b4201c30f3a65fb55c1f04fddb291f6e3b1961592d74d8dd9b742a5d3e0e06 ALSA-2022:5948 Copyright 2022 AlmaLinux OS 0 1 Moderate

galera, mariadb, and mysql-selinux security, bug fix, and enhancement update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default mariadb-pam-10.5.16-2.el9_0.x86_64.rpm 136e4fd832277e80c1e7a941195d3df0eb6b11ea53ed30a7e484408ed3556cb2 mariadb-server-galera-10.5.16-2.el9_0.x86_64.rpm 137dff8beac08b5669ab9d4d184af99684efc0ff55d7e2dbe091c19414e3beda mariadb-backup-10.5.16-2.el9_0.x86_64.rpm 1a36782312cfff6d745e4d75882c89cca2d91fdbbab632a17c27b402ae6f1cf9 mariadb-server-utils-10.5.16-2.el9_0.x86_64.rpm 252c7194b3af99775ed881be5b0ba4cb856e1880a903bdbcd057ea30c1c1f537 mariadb-10.5.16-2.el9_0.x86_64.rpm 3c5e5f10bfd0ca6b1ce1e93e253a573afb3b6f64c26e456742f32da45cf07747 mariadb-gssapi-server-10.5.16-2.el9_0.x86_64.rpm 43296b1cc02b13b87b4b07f95a0713e03fc6104f15cde2ec2d306983f1c281cd mariadb-oqgraph-engine-10.5.16-2.el9_0.x86_64.rpm 49b2b2fa616f9c71a95155b73877559000a75155a6b5a239a0be16c56ba308e2 mariadb-embedded-10.5.16-2.el9_0.x86_64.rpm 538edca513f598c80b2b76c6e3b039a1acfd615b82f1da2b1db6038c9c327e2b mariadb-errmsg-10.5.16-2.el9_0.x86_64.rpm 6606496ebdbcd441d472fea4d8693bdb003b9153e165ea18ee710bf3226040ad mariadb-test-10.5.16-2.el9_0.x86_64.rpm 7ccd64432f350c45d01ede492e4d3abf7ee3d94f52c52d7b76efd94d28690a39 mariadb-devel-10.5.16-2.el9_0.x86_64.rpm 7fe611ae97bd95b391d569ed68f1159848b7253653059b79fb1e1a7dc89d3c1c mariadb-common-10.5.16-2.el9_0.x86_64.rpm b97941f1930c4dae49f4327a6827497cf718253bc0bb8ec04191d89a193b4f3a mariadb-embedded-devel-10.5.16-2.el9_0.x86_64.rpm bbc665ce6563a480a408856b934a5ccb283023bdfd241fe41930eb71fb81dd87 mariadb-server-10.5.16-2.el9_0.x86_64.rpm d6070bd1aa3d306cfe83babc5422d8625d907b14b14d03457a95f10c236de682 ALSA-2022:6003 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * information leak in scsi_ioctl() (CVE-2022-0494) * use-after-free in tc_new_tfilter() in net/sched/cls_api.c (CVE-2022-1055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Power9 - LPAR fails to boot in shared processing mode and call traces are seen [Hash] (BZ#2092248) * Hard lockups are observed while running stress-ng and LPAR hangs (BZ#2092253) * FIPS module identification via name and version (BZ#2093384) * gfs2: File corruption with large writes when memory is tight (BZ#2097306) * i/o on initiator stuck when network is disrupted (4.18.0-372.9.1.el8.x86_64) (BZ#2098251) * AlmaLinux 9.1 doesn't support 3rd SATA (BZ#2099740) * Guest call trace when reboot after postcopy migration with high stress workload (BZ#2100903) * Oops or general protection fault with RIP decode_attr_security_label at decode_getfattr_attrs (BZ#2101854) * Oops as BUG: unable to handle page fault as free of uninitialized nfs4_label on nfs referral lookup (BZ#2101858) * lpar crash with Oops: Kernel access of bad area, sig: 11 [#1] when changing mtu of a bond interface (P10/ ibmvnic/ Haleakala) (BZ#2103085) * OS doesn't boot when vmd and interrupt remapping are enabled (BZ#2109974) Enhancement(s): * iommu/vt-d: Make DMAR_UNITS_SUPPORTED a config setting (BZ#2105326) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default kernel-tools-5.14.0-70.22.1.el9_0.x86_64.rpm 058da6c60d99668ca9527e389ca31f3e5a0b6807572ca6879bbad1bfcc001dc8 kernel-debug-modules-extra-5.14.0-70.22.1.el9_0.x86_64.rpm 0a6bb3033994c42eccd2caaf2c1a0f9fa12978dfa654d09eb1b23c166b35fe87 kernel-doc-5.14.0-70.22.1.el9_0.noarch.rpm 232d05e4af484d9fb62fcffcdb7b23f898a654e8107f29507eaa1d61344427aa kernel-headers-5.14.0-70.22.1.el9_0.x86_64.rpm 269d4b5744b79c31b7840d2662d69a65a07a3daf267d9e0f1d78127bb1ce5e94 kernel-modules-5.14.0-70.22.1.el9_0.x86_64.rpm 356fb4b60399817af9c27541a786c894d72b63a4820600a5d0d5e2625dd19f57 kernel-core-5.14.0-70.22.1.el9_0.x86_64.rpm 44567301c8fcf8e9ff544612b55189e40b93e92ef0344e1ff007ca480ae93864 perf-5.14.0-70.22.1.el9_0.x86_64.rpm 4bee781763a63ad8fbf0177146fed24798d1be7ddc07664f383b203a7992104d kernel-5.14.0-70.22.1.el9_0.x86_64.rpm 4de9ce495488ecba67d20954cdf93a280b38cf90a70f2135dbdaa74f9c43bcd0 kernel-debug-5.14.0-70.22.1.el9_0.x86_64.rpm 4e7323439496dadf60ad2e6ecb8c9169550d549a6423e9be52462c2b6c05c288 kernel-debug-devel-matched-5.14.0-70.22.1.el9_0.x86_64.rpm 5af007256bad23fe247a27a40f5b3d1824837394ac911433ada995c34085278b kernel-cross-headers-5.14.0-70.22.1.el9_0.x86_64.rpm 73b9566ab8a940449df3028f7b07810ef23869261984f0958abfa24241956c27 kernel-tools-libs-devel-5.14.0-70.22.1.el9_0.x86_64.rpm a1cd31b9b9d2e80b48a123147a5474ad6c37d35e4c07406760de2018d831a5b0 kernel-modules-extra-5.14.0-70.22.1.el9_0.x86_64.rpm a33fd0e3f5e8642b1cddea8a2b17203e095b0cede69e7907d8fba3cb59b13857 kernel-abi-stablelists-5.14.0-70.22.1.el9_0.noarch.rpm a7507bb31645b36cd5120e3dee6c9f7928ea50fa4707527e8af610752ebdea2e kernel-devel-matched-5.14.0-70.22.1.el9_0.x86_64.rpm af922ec743dc3cc02cdb496b8c79ac7f28b3c2f52beb5fe85db20b1108c05d81 bpftool-5.14.0-70.22.1.el9_0.x86_64.rpm c7076c508dd6569376b95d3329534c443790fdc930bc18cf57d4cf53de0dfc42 kernel-debug-modules-5.14.0-70.22.1.el9_0.x86_64.rpm dcc4d30f300c4a37153afbe9329e3fece612a9905c9bb08f2fe3f6dfe4fb1e06 kernel-devel-5.14.0-70.22.1.el9_0.x86_64.rpm e44c1505fffc7a260189e267d52aad51e93662b9de13219fb9e0f48222789c2a kernel-tools-libs-5.14.0-70.22.1.el9_0.x86_64.rpm e741c79fd6389fc2c5197dd515fb3eb3c70b80ba46b6e80914c1e28753b97869 python3-perf-5.14.0-70.22.1.el9_0.x86_64.rpm e93ddf4c67372f75be67711e4c71ebe3fd48ccf112d3b35301d712d76fbe4c19 kernel-debug-devel-5.14.0-70.22.1.el9_0.x86_64.rpm ec6b30715ddebf429655aefd6f4d8254e11babda8aeb89f1eb2786a266b94f73 kernel-debug-core-5.14.0-70.22.1.el9_0.x86_64.rpm f7b5b4cf5bae143246da2725de4892ee360ede281d2c94b38490d64a26b6f054 ALSA-2022:6043 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.108 and .NET Runtime 6.0.8. Security Fix(es): * dotnet: External Entity Injection during XML signature verification (CVE-2022-34716) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default aspnetcore-targeting-pack-6.0-6.0.8-1.el9_0.x86_64.rpm 02bb816d2a7e001386b180b65ea007d708badf3981a74ecf4bd75649807fdfe6 dotnet-sdk-6.0-source-built-artifacts-6.0.108-1.el9_0.x86_64.rpm 3c62319b33b397a6cdbaa4febac1fc42eded579be1e8af5c2e722fc6f4a250cb dotnet-targeting-pack-6.0-6.0.8-1.el9_0.x86_64.rpm 4830636c80ca508e2a5da09308070322900c405a95b7aafd9dadc54c3882a7db dotnet-hostfxr-6.0-6.0.8-1.el9_0.x86_64.rpm 497ea4ef0946e9109ac1878337b61733aec4d16a427f69a6b8a61c0dc84d4ba6 dotnet-runtime-6.0-6.0.8-1.el9_0.x86_64.rpm 9b56d7f89668f19f1fb804fc96ace6b6c119ea4b0d953308125458a0f01cc65e netstandard-targeting-pack-2.1-6.0.108-1.el9_0.x86_64.rpm a0f61341b0c2062b19d03fff21514d86a90768ea2c28e27263f33a0065b3c60f aspnetcore-runtime-6.0-6.0.8-1.el9_0.x86_64.rpm b47040ff6ea742fc0c866ccc087b40c2d5b48edb0d64247d3f4f9bec92f42c40 dotnet-templates-6.0-6.0.108-1.el9_0.x86_64.rpm d18b9f7922fdd0c4a14e7c01a284ca82c0068f3266238c112da059493de2573e dotnet-sdk-6.0-6.0.108-1.el9_0.x86_64.rpm dcdcfdd0709b8b7b97001623e68738275ce478bf7307dd637c25b7354fec1ae9 dotnet-host-6.0.8-1.el9_0.x86_64.rpm e01bee46ab6aed570a01c2990592df3ced90d35445ddd0969d429a4b3e04810d dotnet-apphost-pack-6.0-6.0.8-1.el9_0.x86_64.rpm e3bbe2ac7e2e760894eeb8909ee6548195cac05b85d4aa96888f9bb362e9e3f4 ALSA-2022:6521 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.109 and Runtime 6.0.9. Security Fix(es): * dotnet: DenialOfService - ASP.NET Core MVC vulnerable to stack overflow via ModelStateDictionary recursion. (CVE-2022-38013) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.109-1.el9_0.x86_64.rpm 7e26d1f080cc74fc68f2c911f570c59d156b47c4581deedb084980fafa340908 ALSA-2022:6585 Copyright 2022 AlmaLinux OS 0 1 Moderate

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428) Security Fix(es): * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default ruby-doc-3.0.4-160.el9_0.noarch.rpm c5aa94f05bb1afcbd2618a66cc942c7ed10a4ef69aae59317f0d3d7ee3173120 ALSA-2022:6590 Copyright 2022 AlmaLinux OS 0 1 Moderate

mysql security, bug fix, and enhancement update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.30). (BZ#2122589) Security Fix(es): * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21412, CVE-2022-21414, CVE-2022-21435, CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459, CVE-2022-21462, CVE-2022-21478, CVE-2022-21479) * mysql: Server: DML unspecified vulnerability (CPU Apr 2022) (CVE-2022-21413) * mysql: Server: Replication unspecified vulnerability (CPU Apr 2022) (CVE-2022-21415) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21423) * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21425, CVE-2022-21444) * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427) * mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21454) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022) (CVE-2022-21455) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21457) * mysql: Server: Logging unspecified vulnerability (CPU Apr 2022) (CVE-2022-21460) * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21509, CVE-2022-21525, CVE-2022-21526, CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553, CVE-2022-21556, CVE-2022-21569) * mysql: Server: Options unspecified vulnerability (CPU Jul 2022) (CVE-2022-21515) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21517, CVE-2022-21537, CVE-2022-21539) * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21522, CVE-2022-21534) * mysql: Server: Federated unspecified vulnerability (CPU Jul 2022) (CVE-2022-21547) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022) (CVE-2022-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Default logrotate set to wrong log file (BZ#2122592) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default mysql-devel-8.0.30-3.el9_0.x86_64.rpm 1ca69cc71f3ed72847b82590cbd2b370b08150cc8269edb2b945ec92c9ca3554 mysql-libs-8.0.30-3.el9_0.x86_64.rpm 3e0fa9eb2ec644c856122188be7f59a97668b54fdea3ed3f97d4047e11a631c5 mysql-test-8.0.30-3.el9_0.x86_64.rpm 9c9860aca00a04825b2bfca641ed4d912b81258c477a6d7fce191934831a2406 ALSA-2022:6610 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: heap overflow in nft_set_elem_init() (CVE-2022-34918) * kernel: vulnerability of buffer overflow in nft_set_desc_concat_parse() (CVE-2022-2078) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * RDMA/mlx5: Fix number of allocated XLT entries (BZ#2092270) * mlx5, Setup hanged when run test-route-nexthop-object.sh (BZ#2092535) * many call traces from unchecked MSR access error: WRMSR to 0x199 in amazon i4.32xlarge instance (BZ#2099417) * X86/platform/UV: Kernel Support Fixes for UV5 platform (BZ#2107732) * block layer: fixes for md sync slow and softlockup at blk_mq_sched_dispatch_requests [9.0.0.z] (BZ#2111395) * Fixes for NVMe/TCP dereferences an invalid, non-canonical pointer, kernel panic (BZ#2117755) * Adding missing nvme fix to AlmaLinux-9.1 (BZ#2117756) * nvme/tcp mistakenly uses blk_mq_tag_to_rq(nvme_tcp_tagset(queue) (BZ#2118698) * Important ice bug fixes (BZ#2119290) * Power 9/ppc64le Incorrect Socket(s) & "Core(s) per socket" reported by lscpu command. (BZ#2121719) Enhancement(s): * lscpu does not show all of the support AMX flags (amx_int8, amx_bf16) (BZ#2108203) * ice: Driver Update (BZ#2108204) * iavf: Driver Update (BZ#2119477) * i40e: Driver Update (BZ#2119479) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default kernel-tools-libs-devel-5.14.0-70.26.1.el9_0.x86_64.rpm 1e9a9da8ea974dae5baeb0cec788df7218446abac7ab9f62acf5cba078ac1995 kernel-cross-headers-5.14.0-70.26.1.el9_0.x86_64.rpm c5d42e0fb4a4b340f2a42f208c292e4fa85bb244f3c9d15263c098a48c4baa80 ALSA-2022:6763 Copyright 2022 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080) * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177) * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default bind-devel-9.16.23-1.el9_0.1.i686.rpm a1f06c2cbe74517778b3c76672ea3aa6ba0ede096e2ae8f6c5a70af02cec9c86 bind-libs-9.16.23-1.el9_0.1.i686.rpm fd311081e08d5d37bc66f868ac9b2e3971ad1eeffe619dc67c2c73f00d6799e7 ALSA-2022:6913 Copyright 2022 AlmaLinux OS 0 1 Moderate

.NET 6.0 security and bugfix update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.110 and .NET Runtime 6.0.10. Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default dotnet-sdk-6.0-source-built-artifacts-6.0.110-1.el9_0.x86_64.rpm 7b2b4650641ebc11bb44501f6bf0672d00568ff09ca212d91970cc00ba46b0f4 ALSA-2022:6999 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [almalinux-9] (BZ#2132934) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-17-openjdk-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 17bb1f63b78ddeb175116fa8b82271731d769952d4d2ebae055e528a2fc42ab3 java-17-openjdk-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 3b67e851d4330f5b3d8d2973e72fbb0b7d5e4edb37fe26b4315dd68ac45850d0 java-17-openjdk-src-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 3d6c0ce2c0aabe2bc53bb2b37b0c99a0b6742950e80a07eea3c18cc9bb73e170 java-17-openjdk-headless-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 55bf8ea9b7a0e4dd358b09176740ac42b4d929e62ef21ec970c03b9f7ccdf8be java-17-openjdk-jmods-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 7be39c4386f4f27341ba87fbb24ff2bfcd978d2fc4089c95833728d24bf7bb66 java-17-openjdk-headless-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 85e8aaba2fe31d361885dc855b4bf12e79bf00c094696cf902edd0a41217ea3a java-17-openjdk-devel-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 9688fa3a4d3fe75d3403f1c9b360a20890e81874f22b5448d7459716b578d2fe java-17-openjdk-jmods-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm 9ca7348e4689e2e255f8944bb9cb21e7e772b83d53fe95507126083392c289af java-17-openjdk-demo-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm a12c7cf9e98adc04147e5cb17366b1371f55fea580278e9fe36cb2a56230c8fd java-17-openjdk-demo-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm a8d8178f426fb3afa69105b79fcb8a34ce625cb1a20d092c8370ddc7444ca8df java-17-openjdk-static-libs-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm bc89ba1a4569c2e347ec3ef7f99cfe944fe44472637c0fd056e2ed7b46f827ef java-17-openjdk-src-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm e64f00dc3cac711a644ab470e8570dd82e498e78ed84dec73644a4b928a40a19 java-17-openjdk-devel-slowdebug-17.0.5.0.8-2.el9_0.x86_64.rpm f438cf2501bf9a58498bd0451d8665afda334a34541a5f3c585ee24bb63a29b0 java-17-openjdk-static-libs-fastdebug-17.0.5.0.8-2.el9_0.x86_64.rpm fbf438b73c4d55518edbf667075d5b1dd12cb841794f4559c45637a5dbed7b18 ALSA-2022:7007 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-1.8.0-openjdk-demo-fastdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm 45f18aded62f326cee982830769e882b5488eb6f49fa89f3cea8286db5a537ca java-1.8.0-openjdk-headless-slowdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm 709b39936882c43dfce63c4663735f08b6ddff4662ae30fb3b2aa42ea8a4843b java-1.8.0-openjdk-headless-fastdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm 76693d995721730fcfda97f8b4b88b1a760d094ef33477ea986bb58bc58a1d3b java-1.8.0-openjdk-fastdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm 86e0308d0a21c4bc57f51486f31e78ea61260d87ad0f63f6671f4af1b187f459 java-1.8.0-openjdk-demo-slowdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm a097e8a028b72e7f6fdd83d71925c3d9cb00efc565e5ef5056cd37e173f059bd java-1.8.0-openjdk-slowdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm bb7d206f04dc65343f3feb6763b3bdef9e8702ee1880e00685c38b95cf1f7eae java-1.8.0-openjdk-devel-fastdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm c95e302d01ae725e4770a0fbed567991c2b2f42793f1e008db3db0e8fb7e99f9 java-1.8.0-openjdk-src-slowdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm d27d241297bfaec33a1e5c4b67d8f06eafa1d4ae867a74e94ff5cfe769429288 java-1.8.0-openjdk-devel-slowdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm eb8a999bb798fa21663d6cb4fe99652f7f424ba1097dcee4d683c960519bac6e java-1.8.0-openjdk-src-fastdebug-1.8.0.352.b08-2.el9_0.x86_64.rpm fb3c2e316b212399eb0ff62cfa240b60d9d71983d638d5c00d1501741ded1cb9 ALSA-2022:7013 Copyright 2022 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [almalinux-9] (BZ#2131865) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default java-11-openjdk-src-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 26d1dfe63afafcdc2392d282d093eee0ed33f03440308e4e380c7787e53da402 java-11-openjdk-static-libs-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 4116a6557e198ec118368c1baadcbe8ff3188013517436b4f0c338a8dfe41bf4 java-11-openjdk-static-libs-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 511adc4e7ec6c74273b7dd97e7e78c026e453b270387d0a91a31e96e654eb229 java-11-openjdk-headless-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 519850039d86df541b06c47de7ad13deef87c563934c02dd8594a33452d9a4f4 java-11-openjdk-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 66394a338cc22f073b9a267a1d6ce267b2a2fb2b200433e6537e1bf72076d157 java-11-openjdk-demo-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 6998c50df7c1402e9addd6015616bbdd417f67461f3877be6067d0bd23c14f16 java-11-openjdk-jmods-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 6a88010c859548387f6a1b922c3a8184c37bbda0caa7a05f197826282aabb5b1 java-11-openjdk-headless-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 7d5d32442bf600bbcf89592bfe73ed3dad4bb7f2e23a9022dbcd8c969880842b java-11-openjdk-src-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 81a016dd393a7b41df2b841746ef353bc00c5ee4aeb1f417aa10d4f6ab779006 java-11-openjdk-devel-slowdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 8c81b37ee9d5b8360c470a3974b91ec3dc13458152292c38ff0ec73b989f4cf3 java-11-openjdk-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 95ecbcf09460bb9dea032b8ffb68a5e480dffc0cf9b7898ecaf2465dbdf2aceb java-11-openjdk-jmods-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm 9fa1a0fa8a1f7f97ab416e6017f93619baf557bdf4c3dcc02844907abe997091 java-11-openjdk-demo-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm e4458590b5caabf0f5300865a206ac890f904af34c9dad504c9ece2c853b0054 java-11-openjdk-devel-fastdebug-11.0.17.0.8-2.el9_0.x86_64.rpm f479215bb9319130418f06b1087275da0bce134d61acacabd953cc0b86abb7b7 ALSA-2022:7090 Copyright 2022 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execution (CVE-2022-3515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default libksba-devel-1.5.1-5.el9_0.i686.rpm 13e3d66cfc47875db53c255850fa6964e1a78ad506ef8cac44d7a45562a38fbb libksba-devel-1.5.1-5.el9_0.x86_64.rpm a0062ca0363fde88f0ad08e33ad89b3d3bbf83ec161a27b400bff9e446f981c1 ALSA-2022:7185 Copyright 2022 AlmaLinux OS 0 1 Important

device-mapper-multipath security update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket (CVE-2022-41974) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default device-mapper-multipath-devel-0.8.7-7.el9_0.1.i686.rpm b81696b534aa5d30779e1c394beaf1c75e326ba741f98bc976d11a71c8ca1399 device-mapper-multipath-devel-0.8.7-7.el9_0.1.x86_64.rpm fadd1f39f9c0f314c08e64c2c7c5b250cbb4fa4ea1995f8ad54a93c912107312 ALSA-2022:7314 Copyright 2022 AlmaLinux OS 0 1 Moderate

zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default zlib-static-1.2.11-32.el9_0.i686.rpm c7202a1a273d793ad8db472ee0599e85af120ca68d2c4261bcd73f9324f673ba ALSA-2022:7318 Copyright 2022 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585) * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653) * execve exit tracepoint not called (BZ#2106661) * Matrox black screen on VGA output on some systems. (BZ#2112017) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129) * watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857) * Update cifs to 5.16 (BZ#2127858) * Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859) * vfio zero page mappings fail after 2M instances (BZ#2128791) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970) Enhancement(s): * Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default kernel-cross-headers-5.14.0-70.30.1.el9_0.x86_64.rpm 4e3e237a5af9aaa4cbf6e0823e45ad3d56980c0da06d10ca4a45c123626ce354 kernel-tools-libs-devel-5.14.0-70.30.1.el9_0.x86_64.rpm 945a67910041758efa7d6aefea0984da9cb0fc70830367ba896daed8006c7b82 ALSA-2022:7323 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default python3-3.9.10-3.el9_0.i686.rpm 012fd363ce5ab08e8c4068f9c6692753e55adfdd04f9425b9f7f9b9e97f6926c python3-debug-3.9.10-3.el9_0.x86_64.rpm 26ad1a1a453c9068d43a5cb5138be69c2bc2f2b035388c9fad393432622bfafd python3-tkinter-3.9.10-3.el9_0.i686.rpm a8150865a7ca3c0c9813d63ff1744ad80339ca3aa40d71705b497476053486e4 python3-idle-3.9.10-3.el9_0.x86_64.rpm bb9d4cb2eb3652dae84d04ac776b577f3edb8aac16929c004893560c9efafc42 python3-test-3.9.10-3.el9_0.i686.rpm cf70e58f66526e6f8497a47e64e9a92b45b3a38015a6f58a97d70a00b3191f4e ALSA-2022:7329 Copyright 2022 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling (CVE-2022-33099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_default lua-devel-5.4.2-4.el9_0.3.i686.rpm 29bac95beacb598bc22956361a08fddd592ccbb762a5269d1b33f1761fc228b6 lua-5.4.2-4.el9_0.3.i686.rpm 2cb593b6b0e23cfa2597288f810679512f2042b411bb0be3516b73df1a07f9d2 lua-devel-5.4.2-4.el9_0.3.x86_64.rpm 551c67dde9f2371efc4ccd82e9d94cb8bcf1aebf923b59898a3353302311d9f0 ALSA-2022:7958 Copyright 2022 AlmaLinux OS 0 1 Low

libguestfs security, bug fix, and enhancement update

The libguestfs packages contain a library used for accessing and modifying virtual machine disk images. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libguestfs-devel-1.48.4-2.el9.alma.x86_64.rpm 218702eff6eb980b43ac7e4ad9c34f1e351511baa8fa80d09f068020e0842e6e php-libguestfs-1.48.4-2.el9.alma.x86_64.rpm 3f04489abb9b377fc3361fea47ae500ea1fe288790af5bf085dd90eb720073f3 libguestfs-gobject-1.48.4-2.el9.alma.x86_64.rpm 432528a87e8c1ca7a33a5d4590aea5f39dbe2890f6e2fef20f9133e48f1739f5 ruby-libguestfs-1.48.4-2.el9.alma.x86_64.rpm 7c7c099c99064bfadad4e8f1a3b63dbc3ce2d47b0bfe4db28d2da4434a083f6b ocaml-libguestfs-1.48.4-2.el9.alma.x86_64.rpm 894f5f863ef4da4581afa37b0baad8d7917d26a94e4fa0ca1c9641609545a3c4 lua-guestfs-1.48.4-2.el9.alma.x86_64.rpm 9bb09a409ea512019985d89942d90a80069093795450d9be808de9c507cbdf3f libguestfs-gobject-devel-1.48.4-2.el9.alma.x86_64.rpm ad1ce19812ff4b24d31a3ce1be425e4dae15bf92e7eee565a82d284acd62c6c2 libguestfs-man-pages-uk-1.48.4-2.el9.alma.noarch.rpm af4f710b4de913c305b93516d4b72c70a6d6bea6926c1d220a9b862364554647 libguestfs-man-pages-ja-1.48.4-2.el9.alma.noarch.rpm c70d6eb341fe0eca9d22773d7e0310f3848bfed5973fc92f46cd0df16dcb3cdf ocaml-libguestfs-devel-1.48.4-2.el9.alma.x86_64.rpm c8b6b8a3ded110fb3f002d228ef454d58d480fa5c9fe88865977f296e08d6e31 ALSA-2022:7968 Copyright 2022 AlmaLinux OS 0 1 Low

virt-v2v security, bug fix, and enhancement update

The virt-v2v package provides a tool for converting virtual machines to use the KVM (Kernel-based Virtual Machine) hypervisor or AlmaLinux Enterprise Virtualization. The tool modifies both the virtual machine image and its associated libvirt metadata. Also, virt-v2v can configure a guest to use VirtIO drivers if possible. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default virt-v2v-man-pages-uk-2.0.7-6.el9.noarch.rpm 765822b74ebf5a5e299e89344f54a8fee110a23b271382bd5736af4db785da60 virt-v2v-man-pages-ja-2.0.7-6.el9.noarch.rpm ba8c2eb4dafa62b803aeb49fea414268cc654858de82a33226914ece9aa02b47 ALSA-2022:7970 Copyright 2022 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default protobuf-compiler-3.14.0-13.el9.x86_64.rpm 4d7e1812ec56bb3a7e9f99ea8bd499bd119481049a25ec1a7149c050e69a5652 protobuf-devel-3.14.0-13.el9.x86_64.rpm 5f0908547d7f65f35cb17ae6ccdc436f8c04d5515d50f99253f07ef4dce4de30 protobuf-lite-devel-3.14.0-13.el9.x86_64.rpm 7c2c5b61683aec850821892004ea11eed619f991d5e60307d0634280240372d2 protobuf-devel-3.14.0-13.el9.i686.rpm b9ef1efd290645b81054348bbcaf5c7a7b287134b1b287b33fb30265539a8097 protobuf-compiler-3.14.0-13.el9.i686.rpm c9044ed20aba39ce2fa8bc0fe3dc7013c0ad4f6a2a015536ebeafb0604ab8da3 protobuf-lite-devel-3.14.0-13.el9.i686.rpm e670dea42b9d50f9aa4f4f54892a18fd77510a42ab6e6742a3796d75a4ecb833 ALSA-2022:7979 Copyright 2022 AlmaLinux OS 0 1 Low

speex security update

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fix(es): * speex: divide by zero in read_samples() via crafted WAV file (CVE-2020-23903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default speex-devel-1.2.0-11.el9.x86_64.rpm 0b96eafa14f58bd71cf5621ade749c865b1a1c648459e6f71100e10016ebea2b speex-devel-1.2.0-11.el9.i686.rpm 311d0ea2141b77756830b858b96c4682e15f17150cc450c5d8377cfe647867e9 ALSA-2022:8003 Copyright 2022 AlmaLinux OS 0 1 Low

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313) Security Fix(es): * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libvirt-lock-sanlock-8.5.0-7.el9_1.x86_64.rpm ad7941fb7fc41c02eebf6498130eb1595ae01a1ff5d03a9af530b7fde87c5156 libvirt-docs-8.5.0-7.el9_1.x86_64.rpm c801caab69c008381158dfd25f6d0549d134909a115125d7f3595d96b8dfe22f libvirt-devel-8.5.0-7.el9_1.x86_64.rpm d9b6f8ede6261e04f1d1a060b34ac8052ac06d1ae6dc84a875e973561421d1b2 ALSA-2022:8022 Copyright 2022 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework. Security Fix(es): * qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default qt5-devel-5.15.3-1.el9.noarch.rpm 9ebc6c52b9d1433612ea6bf67d160c769264f1496832e938e054352bab4405f7 ALSA-2022:8062 Copyright 2022 AlmaLinux OS 0 1 Moderate

unbound security, bug fix, and enhancement update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2087120) Security Fix(es): * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30698) * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default unbound-devel-1.16.2-2.el9.i686.rpm 6469e0f04451e671f3a4712c51b66d430dd48492de66063384e25caa2101f8c0 unbound-devel-1.16.2-2.el9.x86_64.rpm 9c682e9f670e4531a57296d171cc7f71dc16a4c004024e8e8bf55de0524245db ALSA-2022:8068 Copyright 2022 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220) * bind: DoS from specifically crafted TCP packets (CVE-2022-0396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default bind-libs-9.16.23-5.el9_1.i686.rpm 5423a96058a552b7b158d344f1fd370074b3b359126362eaf2c9e01901bf8f89 bind-doc-9.16.23-5.el9_1.noarch.rpm 7f2b5ebe8235b3d3a50a33d977b33607b5f6be05132c0d35d411e1b8c0c17f3e bind-devel-9.16.23-5.el9_1.x86_64.rpm c1daf8fca6a4f995cbe94cb16c06dc3107ec99da37787c428cd25a23ffd14c90 bind-devel-9.16.23-5.el9_1.i686.rpm ce86520567bf2b95820457961d317b69c16808cdbe67d5c03e77d901302d817f ALSA-2022:8078 Copyright 2022 AlmaLinux OS 0 1 Moderate

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default flac-devel-1.3.3-10.el9.i686.rpm 3d811d1a00887b8f69c364372e16a92bbecc9147f6f0c5d06a87b206f7d425ef flac-devel-1.3.3-10.el9.x86_64.rpm 68ded407ba7e41f5f9db4d03cb9d1551878984f411495b59a95083b213555ef2 flac-1.3.3-10.el9.x86_64.rpm af4023ff55b5d17cbab86073466b5e55b298dc36985d29e210ffb69afab1c8c0 ALSA-2022:8139 Copyright 2022 AlmaLinux OS 0 1 Low

wavpack security update

WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default wavpack-devel-5.4.0-5.el9.x86_64.rpm 2f5da3c013be2fd03dcff683a6fa603e6c71b3e083818a77a627d2b5cab50510 wavpack-devel-5.4.0-5.el9.i686.rpm 837ebdd3e2fe7110e8591394a90fbfef03ff3882c2f5d5423c8c7fe8ec26cbc3 ALSA-2022:8151 Copyright 2022 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: A logic error in the Hints::Hints function can cause denial of service (CVE-2022-27337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default poppler-qt5-devel-21.01.0-13.el9.x86_64.rpm 0486ca30df27615ad5938fa70abf90454c72d1eac72a16cf2888732fdb8c0011 poppler-cpp-devel-21.01.0-13.el9.x86_64.rpm 07e92db1624813e052c054fcf49d8733b338833ef1cf00f09cac00b07642aa4f poppler-devel-21.01.0-13.el9.i686.rpm 0e9d2445aa31029e5d2147972b96f7519f0e3f4f3806cf5373eac18fddf417be poppler-qt5-devel-21.01.0-13.el9.i686.rpm 478d1f28a026ce0492f3a5c686c4e9595e2a58e7c390c0bf4707adc2b330e1f5 poppler-cpp-devel-21.01.0-13.el9.i686.rpm e46ea35e34207870257563fe1215d36fb28908516a41a6a7b841707433ccf7c9 poppler-devel-21.01.0-13.el9.x86_64.rpm e7f7c5b91652cdbaa8aaafa1f429db479d57bc3583fb392ef1eb95a3e1b2d0a0 poppler-glib-devel-21.01.0-13.el9.i686.rpm f0355cb5705c4d90a0434696cf684e6daac3013517330380a6e48eaa94f05d57 poppler-glib-devel-21.01.0-13.el9.x86_64.rpm f06b462229c12bbe8cfce31960e1982b5313d1fe4e546f1d5320706534671586 ALSA-2022:8194 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: Denial of Service via crafted TIFF file (CVE-2022-0561) * libtiff: Null source pointer lead to Denial of Service via crafted TIFF file (CVE-2022-0562) * libtiff: reachable assertion (CVE-2022-0865) * libtiff: Out-of-bounds Read error in tiffcp (CVE-2022-0924) * libtiff: stack-buffer-overflow in tiffcp.c in main() (CVE-2022-1355) * libtiff: out-of-bounds read in _TIFFmemcpy() in tif_unix.c (CVE-2022-22844) * libtiff: heap buffer overflow in extractImageSection (CVE-2022-0891) * tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c (CVE-2022-0908) * tiff: Divide By Zero error in tiffcrop (CVE-2022-0909) * libtiff: heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c (CVE-2022-1354) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libtiff-tools-4.4.0-2.el9.x86_64.rpm 27dd7628ffa2b60d97f526b0c16027e2f2b76b638c8cad04fd53e59580b49066 ALSA-2022:8207 Copyright 2022 AlmaLinux OS 0 1 Low

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer (CVE-2022-1122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default openjpeg2-tools-2.4.0-7.el9.x86_64.rpm 339d256a9e736504619f7188f0eee4de5f18f8799c12f88b0ef7b5d4ec3b5be6 openjpeg2-devel-2.4.0-7.el9.i686.rpm bde369049403e6c840e0e3c8fd6437497e0809700b967ce5f227906905ceed79 openjpeg2-devel-2.4.0-7.el9.x86_64.rpm d622b0123aacd8e5dc0ab8d47dacccd1b75801532f777a62176fe856a134730e openjpeg2-tools-2.4.0-7.el9.i686.rpm ffb2181263f52ac958a76cae8597d7ff46a25d07b0e7bacffce52dc73d423dd7 ALSA-2022:8208 Copyright 2022 AlmaLinux OS 0 1 Moderate

dovecot security and enhancement update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default dovecot-devel-2.3.16-7.el9.x86_64.rpm 68df5df9ceb5456d94fb9e16dd1184e4846d4c39480239d60e7bc33eff5f8d85 dovecot-devel-2.3.16-7.el9.i686.rpm 7e444373600e6ee56102cadc9d808e48d27ecc20567b8143edcb0f86cbe553c7 dovecot-2.3.16-7.el9.i686.rpm dc844cf27548a01b45e3baacab6be0578a79e98ec2a03d9599317b982f1b2b02 ALSA-2022:8221 Copyright 2022 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default xorg-x11-server-source-1.20.11-11.el9.noarch.rpm 4e2b11caa9b1ede84bff1d50b6074841cd4ea148cfa780ae8267b2a485e75219 xorg-x11-server-devel-1.20.11-11.el9.x86_64.rpm 79b7ee5896b9fc33678081fccf443e55bff397884d0ca55bb97def91a5bc2714 xorg-x11-server-devel-1.20.11-11.el9.i686.rpm 8d48a1870c9d394a95685310c5241274e1366f7b4263f70b6066e6691a70c52b ALSA-2022:8252 Copyright 2022 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default yajl-devel-2.1.0-21.el9.x86_64.rpm 04a9fc3f025fe48b8e9ef7e4b1722557f7811bce2029bd7cedc3510ce41cfcc5 ALSA-2022:8267 Copyright 2022 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * off-path attacker may inject data or terminate victim's TCP session (CVE-2020-36516) * use-after-free vulnerability in function sco_sock_sendmsg() (CVE-2021-3640) * smb2_ioctl_query_info NULL pointer dereference (CVE-2022-0168) * NULL pointer dereference in udf_expand_file_adinicbdue() during writeback (CVE-2022-0617) * swiotlb information leak with DMA_FROM_DEVICE (CVE-2022-0854) * uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM (CVE-2022-1016) * race condition in snd_pcm_hw_free leading to use-after-free (CVE-2022-1048) * use-after-free and memory errors in ext4 when mounting and operating on a corrupted image (CVE-2022-1184) * concurrency use-after-free between drm_setmaster_ioctl and drm_mode_getresources (CVE-2022-1280) * kernel info leak issue in pfkey_register (CVE-2022-1353) * use-after-free in ath9k_htc_probe_device() could cause an escalation of privileges (CVE-2022-1679) * NULL pointer dereference in x86_emulate_insn may lead to DoS (CVE-2022-1852) * fanotify misuses fd_install() which could lead to use-after-free (CVE-2022-1998) * nf_tables cross-table potential use-after-free may lead to local privilege escalation (CVE-2022-2586) * integer underflow leads to out-of-bounds write in reserve_sfa_size() (CVE-2022-2639) * slab-out-of-bounds access in packet_recvmsg() (CVE-2022-20368) * incomplete clean-up of multi-core shared buffers (aka SBDR) (CVE-2022-21123) * incomplete clean-up of microarchitectural fill buffers (aka SBDS) (CVE-2022-21125) * incomplete clean-up in specific special register write operations (aka DRPW) (CVE-2022-21166) * possible to use the debugger to write zero into a location of choice (CVE-2022-21499) * AMD: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-23816, CVE-2022-29900) * AMD: Branch Type Confusion (non-retbleed) (CVE-2022-23825) * Intel: Post-barrier Return Stack Buffer Predictions (CVE-2022-26373) * double free in ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c (CVE-2022-28390) * use after free in SUNRPC subsystem (CVE-2022-28893) * use-after-free due to improper update of reference count in net/sched/cls_u32.c (CVE-2022-29581) * Intel: RetBleed Arbitrary Speculative Code Execution with Return Instructions (CVE-2022-29901) * DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c (CVE-2022-36946) * nf_tables disallow binding to already bound chain (CVE-2022-39190) * nfs_atomic_open() returns uninitialized data instead of ENOTDIR (CVE-2022-24448) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.6.1.el9_1.x86_64.rpm 53d538ff8a009f4d16620a85fe70d01db18172972c5f6929874dc8230e3f71fe kernel-cross-headers-5.14.0-162.6.1.el9_1.x86_64.rpm b0145c460c30b0b81a99a2022662b7b22bf9f375d681cc8ef84a3757dd32ba29 ALSA-2022:8317 Copyright 2022 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.16.4). (BZ#2077487) Security Fix(es): * samba: server memory information leak via SMB1 (CVE-2022-32742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default samba-test-libs-4.16.4-101.el9.x86_64.rpm 04c8387de005966c548e5999d121f4db4ff110b56e2d66145a5db5daaf14274e samba-test-4.16.4-101.el9.x86_64.rpm 2136dc683d20353e362d243fd9ae1e2d4fc71768fc08ececf12c49484c30e89e samba-devel-4.16.4-101.el9.x86_64.rpm 34e2927479fa5c4b9a0ef23520e068290099a8c096be15cbeba335d89b430747 libsmbclient-devel-4.16.4-101.el9.x86_64.rpm 4582b8d4da6486fdca440b102a82012ea778c208eb540ddd4a85b51ccd8f394f samba-devel-4.16.4-101.el9.i686.rpm 5754392b323b1c754b302d3e84695f3ab3004f07d1355a7c01f5a04799ca6c16 libwbclient-devel-4.16.4-101.el9.x86_64.rpm 89adde7d8d81f9fe13a55f6f3b40f93295fce6c5f0d25cba262297a46d080882 libsmbclient-devel-4.16.4-101.el9.i686.rpm 99c6b1303ac2894e794d22535fe4ecc64472fc3349a096b9fa4453d1c9eff312 libwbclient-devel-4.16.4-101.el9.i686.rpm 9fec51859bd3be7df91edaa4a2b27388fb5466f9048f3d5cd2121f953c393b3d samba-pidl-4.16.4-101.el9.noarch.rpm ce4265a141b1855237a79ba6d86e8df379190f78d7ff3073272640f269cc5889 ALSA-2022:8318 Copyright 2022 AlmaLinux OS 0 1 Moderate

libldb security, bug fix, and enhancement update

The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490) Security Fix(es): * samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libldb-devel-2.5.2-1.el9.x86_64.rpm 36762194bf74dd975fde569d096013964d957caee6c3a8e905dc65252713f83c libldb-devel-2.5.2-1.el9.i686.rpm bfa154a852391d4be5647a5ff257e3b4b536797503e4a65c9b6f71a71ddfbede ALSA-2022:8353 Copyright 2022 AlmaLinux OS 0 1 Moderate

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.14). (BZ#2128249) Security Fix(es): * python: mailcap: findmatch() function does not sanitize the second argument (CVE-2015-20107) * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default python3-idle-3.9.14-1.el9.x86_64.rpm 088685586a28e97445592a4c515bce72725c1426e6c3106c85aea19495ee2955 python3-debug-3.9.14-1.el9.x86_64.rpm 340bc1c5bf899e68ae57575ff6226d87703a712a16f8221a0a4742528ea7b81b python3-tkinter-3.9.14-1.el9.i686.rpm 5e9372788ff38165e6f7442f3b15706ec38156222e113288f26231388300b289 python3-test-3.9.14-1.el9.i686.rpm 80e21a684cc91a84bd1e4aa3f464e6b18223886ed8c04743f737a775f7119382 python3-idle-3.9.14-1.el9.i686.rpm 846502e51fb6cda12612227c07c0dcea9a4de48fae92032f08b82fc4706fa330 python3-test-3.9.14-1.el9.x86_64.rpm 96c47755a892effc9a5a078d29d3fe667ccf333f129f59919fb88dcc3278cfbc python3-debug-3.9.14-1.el9.i686.rpm d249c342058afd71dd9cc6e4e0f7c950ac60b855c450b0347d9b459d3575a9bf python3-3.9.14-1.el9.i686.rpm fa86b057dafc18fd4d0f804c018337ec552c45dbc5d90114ddc320c5af98670d ALSA-2022:8400 Copyright 2022 AlmaLinux OS 0 1 Moderate

libtirpc security update

The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Security Fix(es): * libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libtirpc-devel-1.3.3-0.el9.i686.rpm 86be8cac6c01a917ccd45dbad8baf8e605de2317c94c5961ae40ab38bc4e6bf2 libtirpc-devel-1.3.3-0.el9.x86_64.rpm ded3578d3f34e2841e4dc6f60ce725d635f9fc90fb917e493812d94244f7db8f ALSA-2022:8415 Copyright 2022 AlmaLinux OS 0 1 Low

mingw-gcc security and bug fix update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * gcc: uncontrolled recursion in libiberty/rust-demangle.c (CVE-2021-46195) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default mingw64-gcc-12.0.1-11.2.el9.x86_64.rpm 1b9c94459108cacd28ce48c072f90adea3ffc482646cd67e46dd0904152fc859 mingw64-gcc-c++-12.0.1-11.2.el9.x86_64.rpm 5c3f350137b310a98d459d7de4159addb4cb1e7174a05022b09bd081177e286d mingw64-libgcc-12.0.1-11.2.el9.x86_64.rpm 6a9a794cc3553c80651700a527fabadc3609305b459cf1aa20d5530572e4d35e mingw32-gcc-c++-12.0.1-11.2.el9.x86_64.rpm 6c417f55fd5f04f76da1b83c2617e18536880b0fe83b28e3bdcc45d1334a00a7 mingw32-cpp-12.0.1-11.2.el9.x86_64.rpm 7659d8f583e50c4cc97bbb4d691b9ed1ab9438b6e4dcf76eb579950df6495761 mingw32-libgcc-12.0.1-11.2.el9.x86_64.rpm a66c6d8486333ff2b6e4ea5aeeb929fc6dc356da06cd25800ec5ed9c68d644f4 mingw64-cpp-12.0.1-11.2.el9.x86_64.rpm b7b73be62ae964164a2d511d98c242b37d9681ce91bccf3db0091ac79edbfc76 mingw32-gcc-12.0.1-11.2.el9.x86_64.rpm f22e26f5e0397b4252214ade0788fa7bbdd9c245422039865e3f13c749d78f06 ALSA-2022:8418 Copyright 2022 AlmaLinux OS 0 1 Low

mingw-glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink (CVE-2021-28153) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default mingw64-glib2-static-2.70.1-2.el9.noarch.rpm 2a4a4bcfe251967861acf1428a202f7bcc91c1e5d471db23c4062b09e6404c42 mingw32-glib2-2.70.1-2.el9.noarch.rpm 709c36c7389a7b97e3c84a749bd8da65100200683e3f46fd87b23f80a4161d3c mingw64-glib2-2.70.1-2.el9.noarch.rpm bfa6671db6fa8a49379e4c4212660ec1da274d05a9c2a32504f6ae1c50a64d85 mingw32-glib2-static-2.70.1-2.el9.noarch.rpm ed5ee4ae44f51177acaf7bdbc8011c1eeb18a41d4c6b18299d9325beea34890e ALSA-2022:8420 Copyright 2022 AlmaLinux OS 0 1 Important

mingw-zlib security update

The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: A flaw found in zlib when compressing (not decompressing) certain inputs (CVE-2018-25032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default mingw64-zlib-1.2.12-2.el9.noarch.rpm 141ced7558b0c4108b083043b831fb0ff11a3c22718afc296ffe6a3dc29572bd mingw32-zlib-1.2.12-2.el9.noarch.rpm 476423e5702c743ee55dcd06b3fd3c3e50749067a0cd381eea30a758a5b07b06 mingw64-zlib-static-1.2.12-2.el9.noarch.rpm 56bf125aad4c173fe9a92b96ce653c7e04958452feb99f9c58d4cfc252499cbf mingw32-zlib-static-1.2.12-2.el9.noarch.rpm eefea7eb65d51b1bb20332c8d92583e83ed52e135ed333dd69e9ad4a3f6fab4b ALSA-2022:8434 Copyright 2022 AlmaLinux OS 0 1 Moderate

dotnet7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.100 RC 2 and .NET Runtime 7.0.0 RC 2. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.100). (BZ#2134641) Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default dotnet-sdk-7.0-source-built-artifacts-7.0.100-0.5.rc2.el9_1.x86_64.rpm 87cf0f86f002dc577dbaceb3bebed9ea54d0e4ff42595f4b68f02ff7afdc4a32 ALSA-2022:8493 Copyright 2022 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default python3-debug-3.9.14-1.el9_1.1.i686.rpm 09c4ed58013db6e2193dcc7c4067b55c2f4e84e0cda3ea3b98962a174fb3b431 python3-idle-3.9.14-1.el9_1.1.x86_64.rpm 63629e5eea53b2d7e4516740e1f76779740f52535dacf6b812c7930a4040bb63 python3-test-3.9.14-1.el9_1.1.x86_64.rpm 7a6d311a9c50566e6c3e07b6329a8305e2f3da765545e5143fe0a2e1fe687c6f python3-3.9.14-1.el9_1.1.i686.rpm b0a4d1cbc5ee30ec776e3ef21610b49434f3e5797aca98b8c9e0123be9e4866f python3-tkinter-3.9.14-1.el9_1.1.i686.rpm bc37efbffd3998e2ca11ac778f119ab254f22ddc809f4085b82233596c667636 python3-idle-3.9.14-1.el9_1.1.i686.rpm bfca0011a3a3030f421d69eb8140ec5fccac7995351c32bc6aa2a37a28965939 python3-test-3.9.14-1.el9_1.1.i686.rpm da09aac9c0768ce7ee00e89ef179acfdaf650cd80af1a85b3380b31a842db0fa python3-debug-3.9.14-1.el9_1.1.x86_64.rpm fe9f9466c30dba97410c81d0d42d2474a08e3112afe49a215dea152b7e1092c3 ALSA-2022:8643 Copyright 2022 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: Request Forgery Vulnerability (CVE-2022-45060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default varnish-devel-6.6.2-2.el9_1.1.i686.rpm 28bd24d2caa29de715780722052283a27dd03cc6c5220f7387413b131256e3cb varnish-devel-6.6.2-2.el9_1.1.x86_64.rpm 4d2e7f54451a0df9bb9f52bc17378e8eb193fcfccaae36e98e32323c08959026 ALSA-2023:0077 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.113 and .NET Runtime 6.0.13. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.113). (BZ#2154459) Security Fix(es): * dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process (CVE-2023-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default dotnet-sdk-6.0-source-built-artifacts-6.0.113-1.el9_1.x86_64.rpm d0c8d3fdc984b2a4689258dd0b6cef53cd09864c54f156d9abb163a3e8977be0 ALSA-2023:0194 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS database. This update allows more control over database use using two new properties - fips.nssdb.path and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-line arguments to the Java virtual machine (RHBZ#2147476) * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [almalinux-9] (BZ#2153097) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-17-openjdk-devel-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 086566bd34d517c892059f1cc8fa14a15207bb46462719ad459907b2a5de9006 java-17-openjdk-devel-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 0f9a2e06a5c5457c6c3c77ee9b8a28cf3522a99d9835ef625a20093fef893d4b java-17-openjdk-jmods-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 446b0b1c2b93e2f3a33a300f72cd53e8f41dd783c9cb6fc7963f84312f4e94c2 java-17-openjdk-jmods-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 5fa6edb7daf6b3f2ad79a246e4c7f2e516a8e09afda6f6059ab169f70e59c966 java-17-openjdk-demo-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 7d625dcb018a1a28ab545825812ce937fdd8a89a34c9fc7aa918024bb17632d8 java-17-openjdk-demo-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm 93d20ce8f13b00c15e78a553a22b3a7e3d1b2ccfe832ebcc5f9237bbe62314d3 java-17-openjdk-static-libs-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm a2e1ff6354cd4d83868c286507b577f2241c76ed0ae63619570c0fb479e0a23f java-17-openjdk-src-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm abad389bc4b88586ff512abff286d5915394f2f56aae072aad8e4c50f99e414e java-17-openjdk-static-libs-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm ae6eba06aced1ca96d75e7351b837315e62747d1fdd052df0325c9aa95abdcf2 java-17-openjdk-src-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm bc201b115a609629f51e2b6c92ad5e90d8c22bb922ce8eedb221595af6a26de7 java-17-openjdk-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm de604eca09485ec462937f5f6d5009073c1973efc5f8363a22063f382aa670fd java-17-openjdk-headless-slowdebug-17.0.6.0.10-3.el9_1.x86_64.rpm e260357ef1dc8f1f229fc57d4c462a83781b3b4d3d6d7855d94f106561394117 java-17-openjdk-headless-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm f0ffdb3787873461df05e9bd386dfde6dc80d0ca0e855e6bb52930679ec39983 java-17-openjdk-fastdebug-17.0.6.0.10-3.el9_1.x86_64.rpm fccea2b11fe4fed324b4251b941e32efa07b9fb1051b8d8640f7de964504378f ALSA-2023:0202 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [almalinux-9] (BZ#2157798) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-11-openjdk-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 1288f68b03d6287099fb2a551938f812c7b1b1a6b521f1c3baa70f3ae5a0f00d java-11-openjdk-static-libs-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 16b477d2ef88d385019f3c9846ece7ede40e431b6e96abf15ce25968b08cf5bd java-11-openjdk-devel-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 35ba1e99785dbcd2b69efb3e061eaa5d57e1af110013467eb0fb84baeee3ccf4 java-11-openjdk-headless-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 589e04e02897647b0e0bc7ce395d57988e87a2e310d54d3e5a2fe7f2843d02c7 java-11-openjdk-devel-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 638e209a3b55ab995af3b57f102f94a88b992c2e33a989dfb5b5422be6bd087f java-11-openjdk-src-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 7537a9dbc8f0cbfcb4d5bc4e33a0cc9b76b053a52b26be90ce62aa4a9cf1a18b java-11-openjdk-demo-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 79d4b7ab0d83a2f99b914a4f18f70184f6348d2101261cefb3ca904a68bf7a04 java-11-openjdk-src-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 91f645baaf3d45cb095f0e382a12b9af6c4a985a77d950749c50b9e9c66706b4 java-11-openjdk-demo-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 9b39627c3bde490d7ec39c6103a6db612eb0130d9c83803afdd6b7ced1468848 java-11-openjdk-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm 9ee27508bdfbd2895014b45d6f99e1b5296eb8e6b9ec3e9f702ddeb0fe528db1 java-11-openjdk-jmods-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm aafdff3c4130ab6f9af26124db509c9f4faba859d8448d07b59540eddfdb01fc java-11-openjdk-headless-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm b7e15d1bd8bdb4e7424d07b7d33d76bf0d042e65048883a67c8d3520df67c788 java-11-openjdk-static-libs-slowdebug-11.0.18.0.10-2.el9_1.x86_64.rpm c56e0ec3ffebd96e6ad2efc0a016e59795caacd46bb6e60da97fec162edd523c java-11-openjdk-jmods-fastdebug-11.0.18.0.10-2.el9_1.x86_64.rpm f02ddf4b44b2fb86e91c6d20cac56c87ebff626466233fc441d700729595ea5d ALSA-2023:0210 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) [almalinux-9] (BZ#2159912) * solr broken due to access denied ("java.io.FilePermission" "/etc/pki/java/cacerts" "read") [almalinux-9, openjdk-8] (BZ#2163594) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-1.8.0-openjdk-slowdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 0a663d090c30d4fa5a76c3ffa44ea8b757f87491c6dfc4cfa133a78b96fbf8f6 java-1.8.0-openjdk-devel-fastdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 1c25eb097ae023bc1454bb22ad379cf2d222cfe667824239502cf003fc28f30e java-1.8.0-openjdk-devel-slowdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 1cf043387907cfd4ed66d0d45d761df52bd64f6258701fa5c291ec661f4964c1 java-1.8.0-openjdk-src-slowdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 23a1b012be2ee484791b1726d7b44c9d2382a67ccc32e8a63cdff799ef278609 java-1.8.0-openjdk-demo-slowdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 36e647855a39857db089cf293385ee050f02fe11170842b515816a2d7f1fc406 java-1.8.0-openjdk-demo-fastdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 38dece283736c41c52719ee1b78a067ee31f5af45a3697393e343201c105034c java-1.8.0-openjdk-fastdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 6a01f8c405270adf842979b6300835372fd99a2e99975ffb81510186b760b6b0 java-1.8.0-openjdk-headless-slowdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm 82867b561927691630b901cf686e2bd1b415537bb05bc02401a37a2a1ed05bf6 java-1.8.0-openjdk-headless-fastdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm afeb08d9d0e2ec6453a4bed75a53a107698b36dcc78a9cd1705c7148b4102cbd java-1.8.0-openjdk-src-fastdebug-1.8.0.362.b09-2.el9_1.x86_64.rpm b182f3eac09b8a068aad9db3ebd847981f56b9f9485d7eb9868d56864aa88aa6 ALSA-2023:0302 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058) * libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519) * libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953) * libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520) * libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libtiff-tools-4.4.0-5.el9_1.x86_64.rpm f3d5c153243cc2cce4d45acc7c98215ca9c39685bf9f1368545ab1b3bb75c854 ALSA-2023:0304 Copyright 2023 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Macro URL arbitrary script execution (CVE-2022-3140) * libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation (CVE-2022-26305) * libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password (CVE-2022-26306) * libreoffice: Weak Master Keys (CVE-2022-26307) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libreoffice-sdk-7.1.8.1-8.el9_1.alma.x86_64.rpm 77b3a8c2f9e215017682e6aafcd5188ddc962b49ef01b0916451c709a301e8d6 libreoffice-sdk-doc-7.1.8.1-8.el9_1.alma.x86_64.rpm f2a7cca1f70b1447614f739912d2adbf5154c745f7eb395bee99041b25fa236d ALSA-2023:0334 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964) * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139) * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945) * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077) * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel 9.2: Important iavf bug fixes (BZ#2127884) * vfio zero page mappings fail after 2M instances (BZ#2128514) * nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359) * ice: Driver Update to 5.19 (BZ#2132070) * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588) * drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619) * updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914) * DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213) * No signal showed in the VGA monitor when installing AlmaLinux9 in the legacy bios mode (BZ#2140153) * Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168) * ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976) * fatal error: error in backend: Branch target out of insn range (BZ#2144902) * AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217) * Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910) * Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605) * DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.12.1.el9_1.x86_64.rpm 7d603f60ba4f1123706e4e5fd2037d896a168b5682dfcc17f9705fb5dcf26fbd kernel-cross-headers-5.14.0-162.12.1.el9_1.x86_64.rpm cb10a35d39acd3568b6128b750a7bc9908ab672e826b17a318c19d361c849648 ALSA-2023:0340 Copyright 2023 AlmaLinux OS 0 1 Moderate

bash security update

The bash packages provide Bash (Bourne-again shell), which is the default shell for AlmaLinux. Security Fix(es): * bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default bash-devel-5.1.8-6.el9_1.x86_64.rpm 0ed71e9c9890c62a2bcc6d52ca15530f252b4bbcbc8167248327fd34f3a567eb ALSA-2023:0626 Copyright 2023 AlmaLinux OS 0 1 Important

libksba security update

KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow to code executiona (CVE-2022-47629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libksba-devel-1.5.1-6.el9_1.i686.rpm 8b44913ee8b77dec9b76047e6ac6f99a3e716a259ff6963dbeedef79b9e8e3c8 libksba-devel-1.5.1-6.el9_1.x86_64.rpm e5ddf9853ddfbd214379b528a8c1a2c99c8215bb98a8628fc6707c614b850315 ALSA-2023:0951 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564) * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379) * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179) * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux 9.0: LTP Test failure and crash at fork14 on Sapphire Rapids Platinum 8280+ (BZ#2133083) * AlmaLinux 9.1 Extending NMI watchdog's timer during LPM (BZ#2140085) * AMDSERVER 9.1: amdpstate driver incorrectly designed to load as default for Genoa (BZ#2151274) * qla2xxx NVMe-FC: WARNING: CPU: 0 PID: 124072 at drivers/scsi/qla2xxx/qla_init.c:70 qla2xxx_rel_done_warning+0x25/0x30 [qla2xxx] (BZ#2152178) * Regression: Kernel panic on Lenovo T480 with AH40 USB-C docking station (BZ#2153277) * Scheduler Update (almalinux9.2) (BZ#2153792) * AlmaLinux9.1, Nx_Gzip: nr_total_credits is not decremented when processing units are reduced by dlpar in shared mode. (FW1030 / DLPAR) (BZ#2154305) * MSFT, MANA, NET Patch AlmaLinux-9: Fix race on per-CQ variable napi_iperf panic fix (BZ#2155145) * Azure vPCI AlmaLinux-9 add the support of multi-MSI (BZ#2155459) * Azure AlmaLinux-9: VM Deployment Failures Patch Request (BZ#2155930) * The 'date' command shows wrong time in nested KVM s390x guest (BZ#2158815) * AlmaLinux-9.2: Update NVMe driver to sync with upstream v6.0 (BZ#2161344) * CEE cephfs: AlmaLinux9 cephfs client crashing with RIP: 0010:netfs_rreq_unlock+0xef/0x380 [netfs] (BZ#2161418) * block layer: update with upstream v6.0 (BZ#2162535) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.18.1.el9_1.x86_64.rpm 3489e24bfa83267ba936f56be1b953ea57533cbde1d6c0f8888c38ae815ac0a3 kernel-cross-headers-5.14.0-162.18.1.el9_1.x86_64.rpm e41bbd782777ea0e17e9559aa20b45827e0c9a7be3370b93e9d88fd12f016413 ALSA-2023:0953 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default python3-idle-3.9.14-1.el9_1.2.i686.rpm 4f564c337125e53bc7204c23a863fa5b18512c61d942ac2d0c506054b9a1a8bc python3-idle-3.9.14-1.el9_1.2.x86_64.rpm 6220968075935bcdac5e0ece2f1efd9df72c748cfb4a46333f644cf7cc537bf4 python3-tkinter-3.9.14-1.el9_1.2.i686.rpm 7e2cace8f433882c101d30861292f273f50028047afee9adbeb9bc4bde9b4f62 python3-debug-3.9.14-1.el9_1.2.x86_64.rpm 8a241ac564bf8b4fd915abcf85f301534c798c7c6c254568a499fe4a20c772f9 python3-test-3.9.14-1.el9_1.2.x86_64.rpm 91e78b33b21d201f9106da5094c64aa9b656b3dd9d374bc3bff70a031b6dd79c python3-3.9.14-1.el9_1.2.i686.rpm a9035d9928f14dbd927aba9ecce5b182439d0095aada6ebfebc12c8a258c1868 python3-debug-3.9.14-1.el9_1.2.i686.rpm d010b8844244f4405383465c5b3b8e2a146facf5b026f7d56570265c72ee7fd6 python3-test-3.9.14-1.el9_1.2.i686.rpm e36f69a8d750bf07740a8cb0e1b0a787110782b9cdf0f96e07ce6379a7c72f24 ALSA-2023:0957 Copyright 2023 AlmaLinux OS 0 1 Moderate

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: use after free allows Sandbox Escape (CVE-2021-44964) * lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default lua-devel-5.4.4-2.el9_1.i686.rpm 59c49c501957b55292a6d36e4541189f75730ade61f0747176d2972b707cac1f lua-devel-5.4.4-2.el9_1.x86_64.rpm 650ef0544090a272d132c3b1e538610a07381af7d509543bc058b3fd255a7731 lua-5.4.4-2.el9_1.i686.rpm e83d2a7d88cad76ecc06783ae71567d141942b00ae9ae766cf42b8a37a904064 ALSA-2023:1068 Copyright 2023 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap buffer overflow in get_word_rgb_row() in rdppm.c (CVE-2021-46822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default turbojpeg-2.0.90-6.el9_1.x86_64.rpm 063d6cbd9b2435bfb4804ba5564caa99ef961ecd94018dc3af4ff4b92cc90b31 turbojpeg-devel-2.0.90-6.el9_1.x86_64.rpm 86cae21adbc61616e33b3606a08d475b4d786bdfe1773f7770452cd80223eec8 turbojpeg-devel-2.0.90-6.el9_1.i686.rpm 9108cdb631c859d1ab3f2dcdc7de02ba2d6526bc7d339de9f734aefb01dd067a turbojpeg-2.0.90-6.el9_1.i686.rpm da41c53ecdd915eff87bb895b777affe39fd2a35487137aa855093992587a969 ALSA-2023:1470 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * AlmaLinux9.0 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127880) * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on the system. (BZ#2143766) * AlmaLinux9.0 - boot: Add secure boot trailer (BZ#2151528) * kernel-rt-debug: WARNING: possible circular locking dependency detected (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160614) * Support cpuset.sched_load_balance by changing default CPUset directory structure (BZ#2161105) * AlmaLinux9.0 - s390/kexec: fix ipl report address for kdump (BZ#2166903) * libgpiod doesn't seem to work with Interphase gpiochip (BZ#2166956) * Azure AlmaLinux9 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170227) Enhancement(s): * IBM 9.2 FEAT: Upgrade the QETH driver to latest from upstream, e.g. kernel 6.0 (BZ#2166304) * Intel 9.2 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168382) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default kernel-tools-libs-devel-5.14.0-162.22.2.el9_1.x86_64.rpm 39212458f4db01f76b5933f199c21fecfe4a12b259587de839c453443a8d5e49 kernel-cross-headers-5.14.0-162.22.2.el9_1.x86_64.rpm bba043ca89647e6d0afde199f5dac2d0b004c907ea31b451e06668740be08fb9 ALSA-2023:1693 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Extension scripts replace objects not belonging to the extension. (CVE-2022-2625) * postgresql: Client memory disclosure when connecting with Kerberos to modified server (CVE-2022-41862) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default postgresql-server-devel-13.10-1.el9_1.x86_64.rpm 07f549330e0412d67b052f9f7bfa8b4970b6c8b79f66efe6a3195be13e53e103 postgresql-private-devel-13.10-1.el9_1.x86_64.rpm 106ec6cf215587f89e0b8816a5f0d7b49d70330dd99bf15192da4a10955aba3d postgresql-upgrade-devel-13.10-1.el9_1.x86_64.rpm bc84112f40d8aec48fd25f054b07e7059c242a4208eeb789b7754c71ca2443e7 postgresql-static-13.10-1.el9_1.x86_64.rpm d9fd6943f89bc7c5fe007ee10594dcae8af972144f6e106a68f23e7f04c6f52c postgresql-test-13.10-1.el9_1.x86_64.rpm e3bc6ff98a01ddd428311c659355e91971dbfbce3e63a7b37c54a2afe34a76d0 postgresql-docs-13.10-1.el9_1.x86_64.rpm f496d72df45ac1374392de22108e8b662bdd4e04f4642190d2b3e7381d34f93a ALSA-2023:1703 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Update intel_idle for Eaglestream/Sapphire Rapids support (BZ#2168361) * AlmaLinux9: An application stopped on robust futex used via pthread_mutex_lock() (BZ#2168836) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default kernel-cross-headers-5.14.0-162.23.1.el9_1.x86_64.rpm a52a08603ce037460fb11caf8263d28dd7a6991184cffb0324fbbb2be9777332 kernel-tools-libs-devel-5.14.0-162.23.1.el9_1.x86_64.rpm c012a19a756eddb9cd2ec20ca653cb0e20cd3e85b8475fca5c1624a09017ad3e ALSA-2023:1879 Copyright 2023 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the list of cryptographic services and algorithms available is limited to those that are FIPS compliant. It was found that this filtering was too strict and was also excluding service attributes. These attributes are now made available in FIPS mode, as they are in non-FIPS mode. (RHBZ#2186804) * Previously, the XML signature provider was unable to operate in FIPS mode. Following recent enhancements to FIPS mode support, the XML signature provider can now be supported. It is now enabled in FIPS mode. (RHBZ#2186811) * The PKCS#11 provider used by FIPS mode can be supported by different PKCS#11 tokens. It was found that some PKCS#11 tokens may not be initialised fully before use, leading to an exception being thrown by the provider. With this release, this exception is now expected and handled by the FIPS support code. (RHBZ#2186807) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-17-openjdk-static-libs-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 08c2ad309176d51d119f33508952e6dd5255489516868f26054dc7a293bd5e8a java-17-openjdk-devel-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 0bbcaddd97862de69b097fea9e8cc5f1b5d0e9a45dde1a9d47107f16aaf3b92e java-17-openjdk-headless-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 16a05a0b8b5545b55ef83fcf1535638b1281dbb240ab551cb1509c52c6ece691 java-17-openjdk-jmods-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 360e7f4a1f8e550d215a140fa3fa6a7a4d08d12a729cf4a13d4cec6aa37f5662 java-17-openjdk-demo-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 497eb152b1ff8e8ebe77db0cee928ce70aa440b0744bda4b26cd85396ab7fcf8 java-17-openjdk-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 7ef7b209c1a7c4c21be9d7e322199a90263614b3d4d88985828a8b662592d616 java-17-openjdk-src-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 827b17f84096f6c40fc9a9677551821266ad697212c2b87568fe8060738865b0 java-17-openjdk-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm 84aa154a51aae1505484625bfc22552b6ad596ac7ad11cef67e1b91c15ee9925 java-17-openjdk-src-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm cb4ffd44870f412a9e33a8fd100bde1fe975be961e1439035749f79af89d188d java-17-openjdk-headless-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm d73d4973cebd11b5ecd7271697763cb4e4f889e734be9a6d34b38986afe2487b java-17-openjdk-static-libs-slowdebug-17.0.7.0.7-1.el9_1.x86_64.rpm da0535ac447bfbef3c2caa5ff1bc6cb74e2b8db99061b748c0271fbd990f9438 java-17-openjdk-jmods-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm dac62b0160731a784d2de59cf1438edf30716a2480dc9eeee0dfc852f07e2fe2 java-17-openjdk-demo-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm df31f37a6583ee504ad6a9ba98ce82850b219798b9392f6f20919925bde403e5 java-17-openjdk-devel-fastdebug-17.0.7.0.7-1.el9_1.x86_64.rpm f96914d642951b79401ba8b4bb36c92a6781004b3d5637eb6ceefc2c8373675d ALSA-2023:1880 Copyright 2023 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-11-openjdk-demo-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 3e5c22decfcfc5ec2f150d1628c65e5392a329a5c4d6691e20cc46cdc4e78df1 java-11-openjdk-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 5a4bb6b53a0248dc371e5c2d5d2dab0def3f57905e5257092bac5e61d1a114ab java-11-openjdk-jmods-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 5f1a84b41b4721e67038a382df0db7100e4f4d6979d8d86986c110eee76dc80b java-11-openjdk-headless-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 61411d0a5ec1a276138d2df77800c1d87f3cb8e94d3d878687ba1864082e3c12 java-11-openjdk-headless-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 6aa22137e7e13b2b074f29c6ba51f3644546b1334dc2be949c6881e562c4684a java-11-openjdk-src-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 74207a3db5f67bb8b1e6be527ce5707faeb88d8c5519f03d011a1d4879a61250 java-11-openjdk-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm 885f93d0f7eab722dc67068db982881b222c633e05ead2bc41e67edcc8936a4a java-11-openjdk-jmods-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm af33c58248c123877cf1915f38152713eaad48ba6e611affcae1fc8be41633c7 java-11-openjdk-demo-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm afbea1be952d7114c19d8a5575aec67b8539358cbb9e658e99513d691a84a9ca java-11-openjdk-static-libs-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm b118b11ded953b651e1e8c071f7aa9325d522fd35cd7c9ef83db575bb66f93cc java-11-openjdk-src-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm d4da4b08e953776e8e1f9da484a1c0bdb41ee205301c3d34bb4eed5422e3ab52 java-11-openjdk-static-libs-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm d82cb69d448b58c078a0faa8cc29f28dde3ceba508a2fda1998deedf459b93dc java-11-openjdk-devel-slowdebug-11.0.19.0.7-1.el9_1.x86_64.rpm ece1c00931e5daba02bc573e6f153cf187c26019909b6661b4b04e0dad984914 java-11-openjdk-devel-fastdebug-11.0.19.0.7-1.el9_1.x86_64.rpm f29f0ac9dbde3d1049f724f7d51c41364f3bf9b059759656696d8d68bcb67ed5 ALSA-2023:1909 Copyright 2023 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The RSAPSSSignature implementation works with RSA keys via the SunRSASign provider. However, it did not fully check that the RSA key could be used by the provider before attempting to do so, leading to the possibility of errors being returned with custom security providers. The implementation now validates RSA keys and will allow other providers to handle such keys where it cannot. (RHBZ#2188024) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default java-1.8.0-openjdk-headless-fastdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 1a4d4d0f286fcdc114073fe32a5b5c672c72efbddc3eee4e4b3456d5bf272e1f java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 2106689c8d33707585191054bb52573bad4990ce5b02e1f8077c5de5aa3eddcb java-1.8.0-openjdk-src-fastdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 3063db5bc3f05b54c9520382f53af41636bae9186b4dab9b948ad9b29d44578c java-1.8.0-openjdk-demo-fastdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 5c1424ca1e8c315c4c735d9c22313cf2d7aff89e699ab7d5f21a61fcd5a418d2 java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 8a11833976c70b271c15e85620c7b68334ae9b5caa6be0120412f16d83f844c1 java-1.8.0-openjdk-fastdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm 9add13bf30c9e7c80f6b05d01a3b735ef8fa56bc7792b9f657ccc4dc552b75cd java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm c2430cd2938554bcf8634edf0b06ecdd1b52056bf76a7fb622bb112c5cbc9b2d java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm c5ba5c1ae4558db432eb1be03e77802f954485e3a7a416227e2002e2c228601e java-1.8.0-openjdk-devel-fastdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm cb5b9dded3a134c9a3fc3edca805b3190aec57ada0215d361c762c2a29efefa4 java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-1.el9_1.x86_64.rpm cf3bfdd70a61895bb560c750d5c78474c57bca4937af84398d299f76807e2849 ALSA-2023:2127 Copyright 2023 AlmaLinux OS 0 1 Important

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_1_default libsmbclient-devel-4.16.4-103.el9_1.i686.rpm 2dd6368e756575cec0d11a8ea2b04f283101f74442c1e5fe35f289b5d584b6f7 samba-test-4.16.4-103.el9_1.x86_64.rpm 3d299d92ff0416f8eb1cf004654fd176b68fe012cf23ecb83ad906c342c114cc libsmbclient-devel-4.16.4-103.el9_1.x86_64.rpm 66e8e498140958973a4b59b1fa62021af811bdffa48f4a28136a776f4746f128 samba-devel-4.16.4-103.el9_1.i686.rpm 78f0790e99ccdff8dffe74b3d46c62f50d8252310f78d07567928e96814879a1 libwbclient-devel-4.16.4-103.el9_1.x86_64.rpm 7c94dea19580f1a1ebf51cbf1316e258949adca5813a3c28e67cb0764170b54b samba-test-libs-4.16.4-103.el9_1.x86_64.rpm 988c525f0bdf67a41f47e4c6dda3b8453d03134f5fe01394b2429788b2cd64d8 samba-devel-4.16.4-103.el9_1.x86_64.rpm 9c7f2d87f56b417b0f5dc4a326527b6195b69f9ce978a9a8575590932c2bb080 libwbclient-devel-4.16.4-103.el9_1.i686.rpm bb5800af94a0d80686eec5eaae561be3baa0934439c0bf7f2062faedb7b185f3 samba-pidl-4.16.4-103.el9_1.noarch.rpm c48c0aef3685e93ad6b4c179b446ee741ca10c2e8490e8c61364eac2f8b8440b ALSA-2023:2165 Copyright 2023 AlmaLinux OS 0 1 Important

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) * edk2: integer underflow in SmmEntryPoint function leads to potential SMM privilege escalation (CVE-2021-38578) * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304) * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450) * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default edk2-aarch64-20221207gitfff6d81270b5-9.el9_2.noarch.rpm 0b2d96153f15aff5bc6a6e70c2e538b306294b495568c511f44b5a312c3d86a2 edk2-tools-20221207gitfff6d81270b5-9.el9_2.x86_64.rpm 37644e8ed6ae4de2928a660bcc79f3f27ed90a1f090d14b834da655e3c867d68 edk2-tools-doc-20221207gitfff6d81270b5-9.el9_2.noarch.rpm 88fdd6252e0556b1732a5dcd546d6e5d581e2f2f0156472f6779bd95e8b8ca10 ALSA-2023:2166 Copyright 2023 AlmaLinux OS 0 1 Moderate

freeradius security and bug fix update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: Information leakage in EAP-PWD (CVE-2022-41859) * freeradius: Crash on unknown option in EAP-SIM (CVE-2022-41860) * freeradius: Crash on invalid abinary data (CVE-2022-41861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default freeradius-sqlite-3.0.21-37.el9.x86_64.rpm 094819b8ecbbba27f28393ab81dc70dd53a15770c564cd6d9b75b7e2eb5de15f freeradius-perl-3.0.21-37.el9.x86_64.rpm 1c0957fcbd95f577de31aa77e38f53bd4f867fefc81bc585fb67111ca14429ac freeradius-rest-3.0.21-37.el9.x86_64.rpm 9d21cc708a3749beefed81504315706811b2242719b1438313e48f6157318faf freeradius-unixODBC-3.0.21-37.el9.x86_64.rpm ad4a618d7300660273287b564c5a15d75ad15b13637e4df26d71ed96874ef23d freeradius-postgresql-3.0.21-37.el9.x86_64.rpm ea35166baa61221d747e3799f6ff7cb133ba6d60bff3c5d92abc298f8452cc58 freeradius-mysql-3.0.21-37.el9.x86_64.rpm ed06e88e61fc82cf06f86579c64321406e1be65d89b8ed44136e2ec3f97edbb9 ALSA-2023:2248 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c (CVE-2022-3550) * xorg-x11-server: XkbGetKbdByName use-after-free (CVE-2022-4283) * xorg-x11-server: XTestSwapFakeInput stack overflow (CVE-2022-46340) * xorg-x11-server: XIPassiveUngrab out-of-bounds access (CVE-2022-46341) * xorg-x11-server: XvdiSelectVideoNotify use-after-free (CVE-2022-46342) * xorg-x11-server: ScreenSaverSetAttributes use-after-free (CVE-2022-46343) * xorg-x11-server: XIChangeProperty out-of-bounds access (CVE-2022-46344) * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494) * xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c (CVE-2022-3551) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default xorg-x11-server-source-1.20.11-17.el9.noarch.rpm 3b231953962ef28c2c50afd8c6fc428361b8e1316ccbe683f1cfb5c063cd4d87 xorg-x11-server-devel-1.20.11-17.el9.x86_64.rpm 750e58df12f99631adda93e8905517b3fbbdf1ad9dc54111c86dc956c44a94b8 xorg-x11-server-devel-1.20.11-17.el9.i686.rpm 8efbbca3e69261d8ff1ad002572e424ec186b8569e07ee2a061c0422d3fb74b9 ALSA-2023:2259 Copyright 2023 AlmaLinux OS 0 1 Moderate

poppler security and bug fix update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: integer overflow in JBIG2 decoder using malformed files (CVE-2022-38784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default poppler-qt5-devel-21.01.0-14.el9.i686.rpm 24f0396da4c594a657ce9cfe52055f79bda423992222a0bb273e8d8c02820cc4 poppler-qt5-devel-21.01.0-14.el9.x86_64.rpm 263a7519c77a6991bac676c4630d9b6dd7111c09bc1ec777ea632678980faa36 poppler-devel-21.01.0-14.el9.x86_64.rpm 30b85581e59f39b64e0c5c5e8ac2bb939039fc4a8ebe89ba589aa54a61f6beef poppler-cpp-devel-21.01.0-14.el9.i686.rpm 5566bdf45ed5295c8f2708c0a45fa0428530c18599f636397def17da4bc3af31 poppler-cpp-devel-21.01.0-14.el9.x86_64.rpm 75f37e2deebaf3c896324ad7f0718747b04fff497b0d7ea855e0985657bef46d poppler-devel-21.01.0-14.el9.i686.rpm 8a6cf6ad958feebc9e24bbda2d33379cb486da64eca54a84343f70afd1fea5e3 poppler-glib-devel-21.01.0-14.el9.i686.rpm cd7b1c7afb924747a4c76312b4ee222b52b617bfff6b352201f767effbfbe5e2 poppler-glib-devel-21.01.0-14.el9.x86_64.rpm f49b7c8f9d083413aee4af31243a0d2ed56e35e871bd84f9ecf9fd429be6b0fd ALSA-2023:2261 Copyright 2023 AlmaLinux OS 0 1 Moderate

bind security and bug fix update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: processing large delegations may severely degrade resolver performance (CVE-2022-2795) * bind: flooding with UPDATE requests may lead to DoS (CVE-2022-3094) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3736) * bind: sending specific queries to the resolver may cause a DoS (CVE-2022-3924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default bind-libs-9.16.23-11.el9.i686.rpm 230580fc034470985d19e0e60d9476cccaed56bf403ed9284f575f58fd3b174a bind-devel-9.16.23-11.el9.x86_64.rpm 39bd9f30fc275e892b82d67222f978c1ca51fc51d395ca849ed8739f37d6fe35 bind-doc-9.16.23-11.el9.noarch.rpm 89aa2e6a4d42f3636b882c4f0a7b97379335821cf7298757b760024b54a49ca6 bind-devel-9.16.23-11.el9.i686.rpm d09e14c4a6fdfe440f41e6695590d56758bd2fa6c8dc36d436a43387a8d64c85 ALSA-2023:2326 Copyright 2023 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: clients using `/parallel` command line switch might read uninitialized data (CVE-2022-39282) * freerdp: clients using the `/video` command line switch might read uninitialized data (CVE-2022-39283) * freerdp: out of bounds read in zgfx decoder (CVE-2022-39316) * freerdp: undefined behaviour in zgfx decoder (CVE-2022-39317) * freerdp: division by zero in urbdrc channel (CVE-2022-39318) * freerdp: missing length validation in urbdrc channel (CVE-2022-39319) * freerdp: heap buffer overflow in urbdrc channel (CVE-2022-39320) * freerdp: missing path sanitation with `drive` channel (CVE-2022-39347) * freerdp: missing input length validation in `drive` channel (CVE-2022-41877) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default freerdp-devel-2.4.1-5.el9.x86_64.rpm 6b9368e029a55205a9fd36d2418958827510cbda7645885c917ee7bcd8213741 libwinpr-devel-2.4.1-5.el9.x86_64.rpm 7525f31ed8d81d7ef9b92765cd1f9429d5a368e55b0136166251dd63a0744f8b libwinpr-devel-2.4.1-5.el9.i686.rpm e6f7b129cdb533efceddb8023264d482cd3fb2071cb7e037d826a2ef60728d23 freerdp-devel-2.4.1-5.el9.i686.rpm e9efadfe2702412990f2694177906713f819c420b30b309cf3a9c7ff0a9c711b ALSA-2023:2340 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap Buffer overflows in tiffcrop.c (CVE-2022-3570) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix (CVE-2022-3597) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c (CVE-2022-3598) * libtiff: out-of-bounds read in writeSingleSection in tools/tiffcrop.c (CVE-2022-3599) * libtiff: out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c (CVE-2022-3626) * libtiff: out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c (CVE-2022-3627) * libtiff: integer overflow in function TIFFReadRGBATileExt of the file (CVE-2022-3970) * libtiff: out-of-bounds read in tiffcp in tools/tiffcp.c (CVE-2022-4645) * libtiff: heap buffer overflow issues related to TIFFTAG_INKNAMES and related TIFFTAG_NUMBEROFINKS value (CVE-2023-30774) * libtiff: Heap buffer overflow in extractContigSamples32bits, tiffcrop.c (CVE-2023-30775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libtiff-tools-4.4.0-7.el9.x86_64.rpm c53b1fc03d4d95e58f791d7624fee64a57a7b31de7473f176f0db0f93c21777b ALSA-2023:2370 Copyright 2023 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: NRDelegation attack leads to uncontrolled resource consumption (Non-Responsive Delegation Attack) (CVE-2022-3204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default unbound-devel-1.16.2-3.el9.x86_64.rpm 47f2e8eff72c183fc0ecab71825e39db7f0b9b7351f7fed6a6ab251227c91643 unbound-devel-1.16.2-3.el9.i686.rpm deedd4203aedb9f0fd801a386103e2144b82392bc23ce824a48c7b2790d94fc8 ALSA-2023:2373 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security and bug fix update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: f5ethtrailer Infinite loop in legacy style dissector (CVE-2022-3190) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default wireshark-devel-3.4.10-4.el9.i686.rpm 24fe51c718a14b22807a84270f373f18288d3fff5009b754c06d89e08a7eec6e wireshark-devel-3.4.10-4.el9.x86_64.rpm a4be5a19db50915eb8ad6b703811b0f9a6c5b18e2f17ee5fcf23492f2fee2d8c ALSA-2023:2458 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c (CVE-2022-42896) * net/ulp: use-after-free in listening ULP sockets (CVE-2023-0461) * cpu: AMD CPUs may transiently execute beyond unconditional direct branch (CVE-2021-26341) * malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory (CVE-2021-33655) * possible race condition in drivers/tty/tty_buffers.c (CVE-2022-1462) * KVM: NULL pointer dereference in kvm_mmu_invpcid_gva (CVE-2022-1789) * use-after-free in free_pipe_info() could lead to privilege escalation (CVE-2022-1882) * KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks (CVE-2022-2196) * netfilter: nf_conntrack_irc message handling issue (CVE-2022-2663) * race condition in xfrm_probe_algs can lead to OOB read/write (CVE-2022-3028) * out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c (CVE-2022-3435) * race condition in hugetlb_no_page() in mm/hugetlb.c (CVE-2022-3522) * memory leak in ipv6_renew_options() (CVE-2022-3524) * data races around icsk->icsk_af_ops in do_ipv6_setsockopt (CVE-2022-3566) * data races around sk->sk_prot (CVE-2022-3567) * memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c (CVE-2022-3619) * denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry (CVE-2022-3623) * use-after-free after failed devlink reload in devlink_param_get (CVE-2022-3625) * USB-accessible buffer overflow in brcmfmac (CVE-2022-3628) * use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c (CVE-2022-3640) * Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed (CVE-2022-3707) * mptcp: NULL pointer dereference in subflow traversal at disconnect time (CVE-2022-4128) * l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference (CVE-2022-4129) * igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets (CVE-2022-20141) * lockdown bypass using IMA (CVE-2022-21505) * double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c (CVE-2022-28388) * network backend may cause Linux netfront to use freed SKBs (XSA-405) (CVE-2022-33743) * unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry (CVE-2022-39188) * TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning (CVE-2022-39189) * u8 overflow problem in cfg80211_update_notlisted_nontrans() (CVE-2022-41674) * use-after-free related to leaf anon_vma double reuse (CVE-2022-42703) * use-after-free in bss_ref_get in net/wireless/scan.c (CVE-2022-42720) * BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c (CVE-2022-42721) * Denial of service in beacon protection for P2P-device (CVE-2022-42722) * memory corruption in usbmon driver (CVE-2022-43750) * NULL pointer dereference in traffic control subsystem (CVE-2022-47929) * NULL pointer dereference in rawv6_push_pending_frames (CVE-2023-0394) * use-after-free due to race condition in qdisc_graft() (CVE-2023-0590) * use-after-free caused by invalid pointer hostname in fs/cifs/connect.c (CVE-2023-1195) * denial of service in tipc_conn_close (CVE-2023-1382) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default kernel-cross-headers-5.14.0-284.11.1.el9_2.x86_64.rpm 31fda472d4a3bd13d2c86f876e3a518e06c49c579ce590eed9eb4a70fd62388b kernel-tools-libs-devel-5.14.0-284.11.1.el9_2.x86_64.rpm 8d33201d17701236a2bbfc1d5ada93bda0a502895e8f4671dc2415e8d1a48aac ALSA-2023:2459 Copyright 2023 AlmaLinux OS 0 1 Moderate

device-mapper-multipath security and bug fix update

The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: multipathd: insecure handling of files in /dev/shm leading to symlink attack (CVE-2022-41973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default device-mapper-multipath-devel-0.8.7-20.el9.x86_64.rpm 2d7f402ad2cc0bfe0faeefb4ad28f638c05dfe1a01e224c527d2a98ea40dad77 device-mapper-multipath-devel-0.8.7-20.el9.i686.rpm 9d047a0f6dc7717112ff360675196f972915c3b7a8bc2581800eb14d91a4973e ALSA-2023:2487 Copyright 2023 AlmaLinux OS 0 1 Moderate

fwupd security and bug fix update

The fwupd packages provide a service that allows session software to update device firmware. Security Fix(es): * fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34301) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34302) * shim: 3rd party shim allow secure boot bypass (CVE-2022-34303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default fwupd-devel-1.8.10-2.el9.alma.x86_64.rpm 6a8414c561b9c737649b57ad65230bceca08ba72fd3834f7a15b82af1fb35825 ALSA-2023:2519 Copyright 2023 AlmaLinux OS 0 1 Low

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.17.5). (BZ#2131993) Security Fix(es): * samba: GnuTLS gnutls_rnd() can fail and give predictable random values (CVE-2022-1615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default samba-devel-4.17.5-102.el9.x86_64.rpm 14d493c8b478abce0e4e519da9f25f8eca843f138c4cc01e4a14957172742db6 libwbclient-devel-4.17.5-102.el9.i686.rpm 20111bb65723560f521da68db2b566e8be620c213e260530a4cdc29e6c8db08d samba-pidl-4.17.5-102.el9.noarch.rpm 39aaadaf78a1fa8a0747154fca75e17ac1ed358cd6d47644f2ec50e7303a1e81 samba-test-libs-4.17.5-102.el9.x86_64.rpm 3fd1f6fa9901aab29a3830e3bc9e56a136d57b06599041d2a0294bc20026725c python3-samba-devel-4.17.5-102.el9.i686.rpm 56c75fbc5f4a5f3b797918d18075ffdfde72b92bfc49cd5a80cfa43816229508 samba-devel-4.17.5-102.el9.i686.rpm 76f449a6c212271317c63f3d3796d7de48d45ab98ab44f7017af1fae9d412685 libnetapi-devel-4.17.5-102.el9.x86_64.rpm 7a4ee46e9653514b481741233a7fc829caedcba8bd7252380b34fcfb054e6f63 python3-samba-test-4.17.5-102.el9.x86_64.rpm 822755e8b1b6ace185df25c34f631c2cdd232b088e8d12ecea4cc8926f3a37f8 libsmbclient-devel-4.17.5-102.el9.x86_64.rpm b1c48357c2928dd71b8b759183906f1033e815148e812adada020b519b01ee00 libsmbclient-devel-4.17.5-102.el9.i686.rpm c5e24623c9d9d146fabada9f134901ddfb0c7b86c92d61e10a10101238926249 libnetapi-devel-4.17.5-102.el9.i686.rpm d2f18b1693de2f3306c0c8d7f30f40b8d13dd68a1827b7f7ed389389417c2a41 libwbclient-devel-4.17.5-102.el9.x86_64.rpm f23e313c9984395bc10cc262d0ec4f86a5d82d26cfb90d5005e1405193994824 samba-test-4.17.5-102.el9.x86_64.rpm f8dcb92cf73ed54478ecaa126f99b78fd4546d76f35bd699ff229e48d60e566d python3-samba-devel-4.17.5-102.el9.x86_64.rpm f9360513e128875d82de411a7078f4faf58725f7169753fd399a5b3975eedce5 ALSA-2023:2532 Copyright 2023 AlmaLinux OS 0 1 Low

libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: NULL pointer dereference in archive_write.c (CVE-2022-36227) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libarchive-devel-3.5.3-4.el9.x86_64.rpm 4582efa1d164a7fd8253074f803d2e11758e1f95fbacffd1538de95e47ed7adb libarchive-devel-3.5.3-4.el9.i686.rpm 55bc5c67ac2b1e247fb43a647fa7d95b148942667f9cd86bb18cc8e8906a7ddb ALSA-2023:2582 Copyright 2023 AlmaLinux OS 0 1 Low

lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overread (CVE-2022-28805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default lua-5.4.4-3.el9.i686.rpm 7663106b5c2c824ad1fd4915d4857541a0b630cf6998e325a2b9a515c63c3590 lua-devel-5.4.4-3.el9.x86_64.rpm a1f1de6f100ad37b63ca4d40694677dfb185a7a5b713de25209de1ec11736783 lua-devel-5.4.4-3.el9.i686.rpm d5667c8c99b29f4196516fb3e1a5fc06a4de1927e397ea64024461ba6b84b170 ALSA-2023:2589 Copyright 2023 AlmaLinux OS 0 1 Moderate

autotrace security update

AutoTrace is a program for converting bitmaps to vector graphics. Security Fix(es): * autotrace: heap-buffer overflow via the ReadImage() at input-bmp.c (CVE-2022-32323) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default autotrace-0.31.1-65.el9.x86_64.rpm 9c75312d9b7a3f0039ac83be94ed42c71df2fb9afce8aebaab4c7951c2eaaf97 autotrace-0.31.1-65.el9.i686.rpm b91c7c0e571b4ec62eb3b8bfd3b95c5e8c2ae151b91bfca4871a9c498a59ce32 ALSA-2023:2592 Copyright 2023 AlmaLinux OS 0 1 Moderate

golang-github-cpuguy83-md2man security, bug fix, and enhancement update

go-md2man converts markdown into roff (man pages). Security Fix(es): * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default golang-github-cpuguy83-md2man-2.0.2-4.el9.x86_64.rpm 14f43471dc1c7ba8786e6ee18647e55f4e3f373ac2309299892d6d3092b4ddb4 ALSA-2023:2621 Copyright 2023 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.32). (BZ#2177731, BZ#2177732) Security Fix(es): * mysql: Server: Security: Privileges unspecified vulnerability (CPU Apr 2023) (CVE-2023-21912) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21594) * mysql: Server: Stored Procedure unspecified vulnerability (CPU Oct 2022) (CVE-2022-21599) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21604) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21608) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21611) * mysql: Server: Connection Handling unspecified vulnerability (CPU Oct 2022) (CVE-2022-21617) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21625) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Oct 2022) (CVE-2022-21632) * mysql: Server: Replication unspecified vulnerability (CPU Oct 2022) (CVE-2022-21633) * mysql: InnoDB unspecified vulnerability (CPU Oct 2022) (CVE-2022-21637) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-21640) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39400) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39408) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2022) (CVE-2022-39410) * mysql: Server: DML unspecified vulnerability (CPU Jan 2023) (CVE-2023-21836) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21863) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21864) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21865) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21867) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21868) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21869) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21870) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21871) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21873) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2023) (CVE-2023-21875) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21876) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21877) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21878) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21879) * mysql: InnoDB unspecified vulnerability (CPU Jan 2023) (CVE-2023-21880) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21881) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21883) * mysql: Server: GIS unspecified vulnerability (CPU Jan 2023) (CVE-2023-21887) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21917) * mysql: Server: Thread Pooling unspecified vulnerability (CPU Jan 2023) (CVE-2023-21874) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2023) (CVE-2023-21882) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default mysql-devel-8.0.32-1.el9_2.x86_64.rpm 00cd391e36ba21bb9b05500779ed4e7ccade3190b59bf4346f91ec73ade7bb75 mysql-test-8.0.32-1.el9_2.x86_64.rpm 21ec791e89f373fd2e142e4de674aeb8db3007ae631c5b54e79eb44d7d53405f mysql-libs-8.0.32-1.el9_2.x86_64.rpm 920778bbdec3e371ff179143202cc81b4f50ee6f30ff1cde40c39ac2d2da5e40 ALSA-2023:3423 Copyright 2023 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-filters: remote code execution in cups-filters, beh CUPS backend (CVE-2023-24805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default cups-filters-devel-1.28.7-11.el9_2.1.i686.rpm 4be1669ce9df9b878caa5f58ec501f7d9c4730d8fdab7ab5796d72072462f921 cups-filters-devel-1.28.7-11.el9_2.1.x86_64.rpm 8a8e2472845a9ef7cbcdde4f19d6e60592e5effb97d7e6ce72f5773676635811 ALSA-2023:3581 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.118 and .NET Runtime 6.0.18. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.118). (BZ#2212379) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.118-1.el9_2.x86_64.rpm bf9e44c84461e26e57d7f701fe899ff27829de0dc75187e7194d4d39288aaeb3 ALSA-2023:3585 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3.11-idle-3.11.2-2.el9_2.1.i686.rpm 079d52c539127e43512bf985406cdd90a6b20c6a3736768333786dbb7368cc42 python3.11-test-3.11.2-2.el9_2.1.x86_64.rpm 43f3858f100609e023a7cf4ec81432c93428e1e7279131cfb4a1733cbb0b25be python3.11-debug-3.11.2-2.el9_2.1.x86_64.rpm 58d076b4c9a1fcf13c6bb255fbf4cbc49dd25700e524bb8439770531d631d077 python3.11-test-3.11.2-2.el9_2.1.i686.rpm 79db8869df3bcfe1b5fb204b466b27ca0020e9780a259df346caaaffac494297 python3.11-idle-3.11.2-2.el9_2.1.x86_64.rpm 7ba197cac6f7fd567b804cd1272fda31a1690d4b6f86c1a50dc708215a38d6b5 python3.11-tkinter-3.11.2-2.el9_2.1.i686.rpm 81aac5469c836928c53a8a7cb078c190fa50501c036ba1fde66fbd660fecdf0b python3.11-debug-3.11.2-2.el9_2.1.i686.rpm 91c8bfe77e9f2132db1c1fba7ca29ba1a5beb756165ab7a0eff3159777b3eaaf python3.11-3.11.2-2.el9_2.1.i686.rpm cbefe392c1d2c6654786eeee58d9cf961dccf2d957da6bed89e04515e68b5c92 ALSA-2023:3592 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.107 and .NET Runtime 7.0.7. The following packages have been upgraded to a later upstream version: dotnet7.0 (7.0.107). (BZ#2211877) Security Fix(es): * dotnet: .NET Kestrel: Denial of Service processing X509 Certificates (CVE-2023-29331) * dotnet: vulnerability exists in NuGet where a potential race condition can lead to a symlink attack (CVE-2023-29337) * dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument (CVE-2023-32032) * dotnet: Remote Code Execution - Source generators issue can lead to a crash due to unmanaged heap corruption (CVE-2023-33128) * dotnet: Bypass restrictions when deserializing a DataSet or DataTable from XML (CVE-2023-24936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.107-1.el9_2.x86_64.rpm 22423289ac600750bb6d967e2f12a42649b916331480aa9b23b5ac5b4791117d ALSA-2023:3595 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3-idle-3.9.16-1.el9_2.1.x86_64.rpm 07f7bc6e7fb5a25e0af4b3ed7b9eb4e41412e8243dea98af0d68f570b6f4a4c9 python3-debug-3.9.16-1.el9_2.1.x86_64.rpm 5104639311297475bafb8bd42860ebb65a512a2136e0066c1c385827faaadeaa python3-test-3.9.16-1.el9_2.1.i686.rpm 5273016d281eec03c808f7c5a4c2569e56ef51a09d9aea4c222576e5b4712197 python3-test-3.9.16-1.el9_2.1.x86_64.rpm 637515b3ce3c9bd2c3b6c7ac2d4131e3373283c5a503f5a957e8df35e6d51d98 python3-debug-3.9.16-1.el9_2.1.i686.rpm 85f9f53ad2331b47c0aa07bcfb77cd7d22ce035969a3d19683d255916317bfb6 python3-idle-3.9.16-1.el9_2.1.i686.rpm 99cd8984a7315a7844c8506d265e80232ea1a66f2b608f325034853031438621 python3-tkinter-3.9.16-1.el9_2.1.i686.rpm acccd91e825749cd79e3238f2a7dd2c802f6c8b3be529c846c6d35ee018972e3 python3-3.9.16-1.el9_2.1.i686.rpm c1ba97d4019381c5b71639fa17beac3748bf70b26fa506ded8a81acb0fc92f8b ALSA-2023:3661 Copyright 2023 AlmaLinux OS 0 1 Important

texlive security update

The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems. Security Fix(es): * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default texlive-gnu-freefont-20200406-26.el9_2.noarch.rpm 16c75f425a783945efc0d78b91bf1ea50b85ae1c0a2699dfa7710075d8c68c96 texlive-lib-devel-20200406-26.el9_2.x86_64.rpm 6f142ee564ecac7eda8fe75874d5ccd9a44c9540ff5250e4e767a1ef5ac36669 texlive-lib-devel-20200406-26.el9_2.i686.rpm e36d6facadb5e6725880811987804781b8a601e9c8375e1ccadb6d7223e2ab94 ALSA-2023:3711 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) * libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795) * libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796) * libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0797) * libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798) * libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libtiff-tools-4.4.0-8.el9_2.x86_64.rpm 9c837eef2d8c3b570c870b574fe1c694791c0eb46bc306ba1f13e03263ed3c95 ALSA-2023:3714 Copyright 2023 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454) * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default postgresql-docs-13.11-1.el9_2.x86_64.rpm 42c6455136f82bd10f5ce3c0f6323070402c1e44d15e8ad55610cbdeb3cea2f0 postgresql-test-13.11-1.el9_2.x86_64.rpm 52cff06e41219610bb613959e4468953f71e58f17e151923bde373fd463f1869 postgresql-server-devel-13.11-1.el9_2.x86_64.rpm 537d5cebfee8bbd875e4dedb9b57aac995ffb6791c43b923ef51fcd359d37704 postgresql-private-devel-13.11-1.el9_2.x86_64.rpm b16cdba694589b4bc943442889b8e324f1bba693881d8b0ccf7bd7b3360f3a29 postgresql-upgrade-devel-13.11-1.el9_2.x86_64.rpm e12c27382597d44f8fcc0f840406fa50d8294e63813bc52a261e9d3f030241b0 postgresql-static-13.11-1.el9_2.x86_64.rpm ec13bc13b36f07102c301f6cb45ddf8e00fd37bf46f909b18dc6668dc9cc5943 ALSA-2023:3715 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libvirt-lock-sanlock-9.0.0-10.2.el9_2.x86_64.rpm 1a4c582ce944363119b83bf7716a79905b84a2b07406a56652c1805ed5f6652d libvirt-devel-9.0.0-10.2.el9_2.x86_64.rpm 52abd1e2ad521019e9aad78578ea9b7e471a0db970c497e3a0e343cf9a572964 libvirt-docs-9.0.0-10.2.el9_2.x86_64.rpm 56c54bd008d3ac32dbbd6b78cace5e8072b714f7cc771eca0c07a56ff131efc2 libvirt-client-qemu-9.0.0-10.2.el9_2.x86_64.rpm add1e5c870e9b409b435faf4d004d2ee5b7eec359e77b6e462b5270885b2b47e ALSA-2023:3723 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: use-after-free vulnerability in the perf_group_detach function of the Linux Kernel Performance Events (CVE-2023-2235) * kernel: netfilter: use-after-free in nf_tables when processing batch requests can lead to privilege escalation (CVE-2023-32233) * Kernel: bluetooth: Unauthorized management command execution (CVE-2023-2002) * kernel: OOB access in the Linux kernel's XFS subsystem (CVE-2023-2124) * kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer() (CVE-2023-2194) * kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference (CVE-2023-28466) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel QAT Update - (kernel changes) (BZ#2176846) * RPL-P IOTG/RPL-S IOTG: cpu frequency issues (BZ#2178857) * In FIPS mode, kernel does not transition into error state when RCT or APT health tests fail (BZ#2181727) * Kernel BUG in iwlmvm wifi driver when used Mesh systems (BZ#2186723) * Azure AlmaLinux 9 Backport upstream commit 93827a0a36396f2fd6368a54a020f420c8916e9b [KVM: VMX: Fix crash due to uninitialized current_vmcs] (BZ#2186822) * AlmaLinux 9 blktests nvme/047 lead kernel NULL pointer (BZ#2187536) * Single Node Openshift cluster becomes unreachable after running less than 2 hours (BZ#2187709) * kernel[-rt]: task deadline_test:1778 blocked for more than 622 seconds (BZ#2188655) * fix page end in filemap_get_read_batch (BZ#2189349) * AlmaLinux 9.2 hwpoison: data loss when memory error occurs on hugetlb pagecache (BZ#2192348) * wdat_wdt watchdog timeout triggered unexpectedly (BZ#2192585) * ice: high CPU usage with GNSS or ptp4l (BZ#2203154) * AlmaLinux 9 "smpboot: Scheduler frequency invariance went wobbly, disabling!" on nohz_full CPUs after long run (BZ#2203178) * Dying percpu kworkers cause issues on isolated CPUs [almalinux-9] (BZ#2203229) * FJ9.2 Bug: [REG] NFS infinite loop of COMMIT call and NFS4ERR_DELAY reply. (BZ#2203335) * perf errors - "event syntax error: 'unc_p_delayed_c_state_abort_core5'" b'_ value too big for format, maximum is 255' (BZ#2207471) * AlmaLinux 9: Invalid character detected by rpminspect in Documentation/translations/zh_CN/process/magic-number.rst (BZ#2208242) * cifs: backport small patches to bring us close to 9.1 - backport commit aea02fc40a7f cifs: fix wrong unlock before return from cifs_tree_connect (BZ#2209045) * AlmaLinux 9 x86_64, kdump 2nd kernel will randomly panic on "kvm-08-guest25.hv2" (BZ#2210614) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default kernel-tools-libs-devel-5.14.0-284.18.1.el9_2.x86_64.rpm 9c15c26e5c747275e08e4244f22bf1ada39042bd350824a86fa6e544a6fb5098 ALSA-2023:4057 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet7.0 (SDK 7.0.109, Runtime 7.0.9). (BZ#2219634) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.109-1.el9_2.x86_64.rpm 1831e73c259a43a7a7aedd1cee6809a584d21c95fcbf89a5e892c3d96aeb323a ALSA-2023:4060 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet6.0 (SDK 6.0.120, Runtime 6.0.20). (BZ#2219640) Security Fix(es): * dotnet: race condition in Core SignInManager<TUser> PasswordSignInAsync method (CVE-2023-33170) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.120-1.el9_2.x86_64.rpm 946c41c957a2d047c090dc4f7def9e1d958093c2cae96657f81a5cbbd192d67c ALSA-2023:4099 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default bind-devel-9.16.23-11.el9_2.1.x86_64.rpm 0f93c84642735ab27124c9c2c54d28086b089e718d25aaa5768b48e2d3762b03 bind-doc-9.16.23-11.el9_2.1.noarch.rpm 3626cfa861e4506dc542b852affac40020461c645de4b287336e8be7112c589f bind-libs-9.16.23-11.el9_2.1.i686.rpm 9a53325d2d1d64b6e110ad115864633c1166c21df8132585d27affc94a6ee187 bind-devel-9.16.23-11.el9_2.1.i686.rpm d869f7f4598a7e225e10362e8484ee587400a1adc208893d4b5bf52fb98c2fb4 ALSA-2023:4158 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 11.0.20) [almalinux-9] (BZ#2223100) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-11-openjdk-jmods-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm 1686d9e732f74e77a2c82eea964870284b667ea13c51a4ffe4d7b1bdf5e83f39 java-11-openjdk-devel-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm 2f61f0306f616a934b1e7bce37627f71af1fe0d5fafe76f0cf89eccc76f65367 java-11-openjdk-static-libs-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm 6255d1ed456e1310fbeba4940bdd839cb6115e028605d33f532581ccb663573d java-11-openjdk-devel-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm 6276b2580c06bf8ffcf0f29d61f78cae50290ccaa227bed41cd6cf4772f5269c java-11-openjdk-jmods-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm 649ace8e1275606d46c0d1cbb6214cea964c4c931c25045096c07a547dd05a86 java-11-openjdk-demo-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm 70cc1c84fa2cca91929988b73b76d004f966429fa10bae826498846d3080f372 java-11-openjdk-headless-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm 758001b5aa4fae5abd1736881ba1aae04569d0357a4dd007bbee7e200a0eb0a7 java-11-openjdk-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm 888b2b819d3876894d45ee286f05d4e1ec8a249a4b9a08cdb247acc2d46d0543 java-11-openjdk-headless-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm 92263512bcc0cd1f855324de174d591db8ccc19d2f033108765d9d665834f749 java-11-openjdk-src-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm 93b8bdeb828d3da7494f6fac3a663c55acceb670785d19e69720635ede9d8388 java-11-openjdk-static-libs-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm a4eeac43a7595b5f5dd2f7c9d38af2196c86ea89ba98ef12d7f2cec5fd4722cf java-11-openjdk-demo-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm aca677ac1ede792e216643139f3964e33ff236bc4a57bf6bfdd7eebfe73de16e java-11-openjdk-slowdebug-11.0.20.0.8-2.el9.x86_64.rpm d3b72453f2e7f7b8994e8ae5a8d5a7d559c728422697f2d45610be1c6fe3b35c java-11-openjdk-src-fastdebug-11.0.20.0.8-2.el9.x86_64.rpm fd159d0c915b74233a70ad8de600ce11c4380f1024ab053cf18abe77a55839e1 ALSA-2023:4177 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: ZIP file parsing infinite loop (8302483) (CVE-2023-22036) * OpenJDK: weakness in AES implementation (8308682) (CVE-2023-22041) * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * harfbuzz: OpenJDK: O(n^2) growth via consecutive marks (CVE-2023-25193) * OpenJDK: HTTP client insufficient file name validation (8302475) (CVE-2023-22006) * OpenJDK: modulo operator array indexing issue (8304460) (CVE-2023-22044) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Installing the same java-17-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-17-openjdk-headless package. This prevented the use of the dynamic dump feature, as the checksum in the archive would be different on each system. This is resolved in this release by using the .jsa files generated during the initial build. (RHBZ#2221653) * Prepare for the next quarterly OpenJDK upstream release (2023-07, 17.0.8) [almalinux-9] (BZ#2222852) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-17-openjdk-demo-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm 3cdcc3b5eab9da384b4c9a052e0eabbd617e732adc3ee34400873c264757c64f java-17-openjdk-src-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm 535fd6ebf2acc8d63a3328d096b9ec9753461864ace45d1e11ff0650dd9d9219 java-17-openjdk-demo-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm 56a449b589633fc41f122270831e3d6b64d7c47182d4b608ab770935eab1e4e0 java-17-openjdk-jmods-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm 5acb8d021d9be866fdd68c08fdcf68671df876e07a61994a3fa839ba4f6150ae java-17-openjdk-devel-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm 718529712b2860ed8ee29517685b36f9328e9ccf47aa107f2d36de3f4fe8120a java-17-openjdk-jmods-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm 758b08d791e1960de1b1459bb1059c0c62f74f7ef1984c71683ce38a053873f8 java-17-openjdk-static-libs-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm 83b34f73a331ed77211848f525206b895aca181289044ec1f135cb04e8da5fa5 java-17-openjdk-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm 89949addb248ac5bbb8df8394986c532df85db3ee2663fb38a08e8b1220376ed java-17-openjdk-static-libs-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm 9df31e8cc2adbdc81e8a988445afb59f1df033ab45d0ffbf89c299feee24f014 java-17-openjdk-headless-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm bbdc005d88aef89d02bf7cb5acc3d1e04eafdcc04dc3465333114b695c216e6c java-17-openjdk-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm c8792b9ffd9d7480db8f7deb6a8686ffae115ec6116f914d98d42a90c985fd27 java-17-openjdk-headless-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm cf17f0d74af3eb3e14ef8e25be1ee1569f4ae3a3737943289292763cae1d7702 java-17-openjdk-src-slowdebug-17.0.8.0.7-2.el9.x86_64.rpm eb25c04815980fc517c4b2ab1387342c96ddf30351715348f42f588f477cd304 java-17-openjdk-devel-fastdebug-17.0.8.0.7-2.el9.x86_64.rpm ebcd653e7337913e6f5b3967185090f0a13a46e85e9e63713b770d6ab9c8c7ad ALSA-2023:4178 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) [almalinux-9] (BZ#2220662) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-1.8.0-openjdk-demo-fastdebug-1.8.0.382.b05-2.el9.x86_64.rpm 1cf9ffebe4bd8c796034740e288737810f6dbe0cc3ff7a25bad4a66f66137e5a java-1.8.0-openjdk-devel-fastdebug-1.8.0.382.b05-2.el9.x86_64.rpm 30e8b18bab48911c3a6dadcef13b07cfe93bd1bf6eff92e0a5621b3c2a90cae6 java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-2.el9.x86_64.rpm 3fff3d34bfcc2554b05c264c2786415862d2f668d17c5260ca08a35b7392329b java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-2.el9.x86_64.rpm 7a84c28ec703726a96adba7dfd515ec1cc63781d91700ee0f0f704b70880ecb1 java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-2.el9.x86_64.rpm 7d216b034f7298f60aa38e4dbddb96768c7afe981e7251eb2e681b0e19c8d1d5 java-1.8.0-openjdk-src-fastdebug-1.8.0.382.b05-2.el9.x86_64.rpm 922429e36cc35016b9380408c16115b1a5d48030dbf6917323a585bb8ef3369a java-1.8.0-openjdk-headless-fastdebug-1.8.0.382.b05-2.el9.x86_64.rpm 9a823a1fc797d2bdeeb45d41fb731db2f552900e89bfaa5622c9af6b6deed114 java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-2.el9.x86_64.rpm a212a36eab839ec237d2f83ab80ab67cda33d80ca9071823ea9fac9a54367688 java-1.8.0-openjdk-fastdebug-1.8.0.382.b05-2.el9.x86_64.rpm ca15bc66a6079aa2aa5f196c89ce72074dddfc805189629b045cac090df7e77e java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-2.el9.x86_64.rpm d32ef06e7db2547f7056354e19d6eadbeeeda6a17eb7ffcb5eb22f8321cb7986 ALSA-2023:4325 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security and bug fix update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: SMB2 packet signing is not enforced when "server signing = required" is set (CVE-2023-3347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The trust relationship between this workstation and the primary domain failed (BZ#2223600) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libwbclient-devel-4.17.5-103.el9_2.alma.i686.rpm 31042894e8d45574eb4341dd27ef43f0423680ea157585881ed412817f285d3d libsmbclient-devel-4.17.5-103.el9_2.alma.i686.rpm 31e562eae7340bfdbd3db9b2ad874175f043d7d11290e7dfc3336ef40cd7ccb9 libnetapi-devel-4.17.5-103.el9_2.alma.x86_64.rpm 3f61a86c0f826b0f6bd3ff9e5a503fa633e0238b78f14f09174d5a8676bbb01d python3-samba-devel-4.17.5-103.el9_2.alma.i686.rpm 55fc33baf748fc8349d1a2f961e6d314af22f1528bed16c154f4d95c6514945e python3-samba-devel-4.17.5-103.el9_2.alma.x86_64.rpm 728a9865bba8984ab6ba46086a09efd73f8279a7b98ba3223a05893c9279c02a libwbclient-devel-4.17.5-103.el9_2.alma.x86_64.rpm 96264d1c96712ac386161e262e6a9968d27e8a6169437aa67e5b8cbc2c727c58 samba-pidl-4.17.5-103.el9_2.alma.noarch.rpm a5359420cdecee730be12c0b6671254d313b1999e65343f668df6c6fbf625afc samba-test-4.17.5-103.el9_2.alma.x86_64.rpm b7d9bd029523d7a162b9b028d8d4cd3d29fb205c4ab6313df69ec2d0c65d3fcb samba-test-libs-4.17.5-103.el9_2.alma.x86_64.rpm c42b036c25f3bba9444bb1f38980c5a7297f883386950cf05142467197703d7b libnetapi-devel-4.17.5-103.el9_2.alma.i686.rpm c94fd32498bfb4684b3fb6a2b02171ed895c9bfee0b8139f1c66c5b8377af8a7 python3-samba-test-4.17.5-103.el9_2.alma.x86_64.rpm d319b8b5e87ab49c58bb9a22ccb77cad6a04be71d706960d788d866b4b6a2b13 libsmbclient-devel-4.17.5-103.el9_2.alma.x86_64.rpm d7183bc6027092b830f2cb819463b25595766174b2d9472677540b3bc17d58d2 samba-devel-4.17.5-103.el9_2.alma.i686.rpm d828a687e7673a792de5f1831ef605ce97be05b506ed73daf7ca0049ae93e2cf samba-devel-4.17.5-103.el9_2.alma.x86_64.rpm eb23646a64d041fb7bb695e30f53cf61e97205212fc61f83a855414f7218ddfe ALSA-2023:4377 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090) * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788) * kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869) * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458) * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default kernel-cross-headers-5.14.0-284.25.1.el9_2.x86_64.rpm 00a497136d30a3052c0f8479b6b2e95536eb2e50b06aec6245b960399244a9e5 kernel-tools-libs-devel-5.14.0-284.25.1.el9_2.x86_64.rpm abfd4478b1d3c6482a46f3cb1767ab215ddde463612de71fcd3a870922e7063d ALSA-2023:4642 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.110 and .NET Runtime 7.0.10. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.110-1.el9_2.x86_64.rpm c994e6b57786e108d2889b9c8768a978b0a3d79ab5c764c412a4872362f25b85 ALSA-2023:4644 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.121 and .NET Runtime 6.0.21. Security Fix(es): * dotnet: RCE under dotnet commands (CVE-2023-35390) * dotnet: Kestrel vulnerability to slow read attacks leading to Denial of Service attack (CVE-2023-38180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.121-1.el9_2.x86_64.rpm 4a0cc7e441ea4cd7f4164dbc0c533d10589501512d00b139f02ec6866889aa68 ALSA-2023:5048 Copyright 2023 AlmaLinux OS 0 1 Important

flac security update

FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: Remote Code Execution (RCE) via the bitwriter_grow_ function, by supplying crafted input to the encoder (CVE-2020-22219) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default flac-1.3.3-10.el9_2.1.x86_64.rpm 1a34ff52a57a62960170651fd4f2bcbaea2b2893adfc6a44efcacb3e69e95890 flac-devel-1.3.3-10.el9_2.1.i686.rpm 45034fb7bcb8be17d66fcf390e92312aec1cb6928cee37e0ee763901d6a253dd flac-devel-1.3.3-10.el9_2.1.x86_64.rpm 620333478f2201fac645990897a120418c6c67add18b716ba5578b2a4478672e ALSA-2023:5069 Copyright 2023 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The following packages have been upgraded to a later upstream version: kernel (5.14.0). Security Fix(es): * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390) * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610) * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776) * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004) * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147) * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248) * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001) * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637) * hw: amd: Cross-Process Information Leak (CVE-2023-20593) * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [Intel 9.3 BUG] [SPR][EMR][FHF] ACPI: Fix system hang during S3 wakeup (BZ#2218026) * [Dell 9.2 BUG] Monitor lost after replug WD19TBS to SUT port wiith VGA/DVI to type-C dongle (BZ#2219463) * rtmutex: Incorrect waiter woken when requeueing in rt_mutex_adjust_prio_chain() (BZ#2222121) * AlmaLinux AWS ARM Instability During Microshift e2e tests (BZ#2223310) * AlmaLinux 9.x updates for SEV-SNP guest support (BZ#2224587) * Lock state corruption from nested rtmutex blocking in blk_flush_plug() (BZ#2225623) * bpf_jit_limit hit again - copy_seccomp() fix (BZ#2226945) * libceph: harden msgr2.1 frame segment length checks (BZ#2227070) * Temporary values used for the FIPS integrity test should be zeroized after use (BZ#2227768) * Important iavf bug fixes July 2023 (BZ#2228156) * [i40e/ice] error: Cannot set interface MAC/vlanid to 1e:b7:e2:02:b1:aa/0 for ifname ens4f0 vf 0: Resource temporarily unavailable (BZ#2228158) * lvconvert --splitcache, --uncache operations getting hung (BZ#2228481) * perf: EMR core and uncore PMU support (BZ#2230175) * NVIDIA - Grace: Backport i2c: tegra: Set ACPI node as primary fwnode (BZ#2230483) * NVIDIA - Grace: Backport i2c: tegra: Fix PEC support for SMBUS block read (BZ#2230488) * [Hyper-V][AlmaLinux 9]incomplete fc_transport implementation in storvsc causes null dereference in fc_timed_out() (BZ#2230747) * Kernel config option CONFIG_CRYPTO_STATS should be disabled until it is enhanced (BZ#2231850) * [AlmaLinux 9][Hyper-V]Excessive hv_storvsc driver logging with srb_status SRB_STATUS_INTERNAL_ERROR (0x30) (BZ#2231990) * AlmaLinux-9: WARNING: bad unlock balance detected! (BZ#2232213) * NVIDIA - Grace: Backport drm/ast patch expected for kernel 6.4 (BZ#2232302) * [Lenovo 9.1 bug] AlmaLinux 9 will hang when "echo c > /proc/sysrq-trigger". (BZ#2232700) * [AlmaLinux-9] bz2022169 in /kernel/general/process/reg-suit fails on aarch64 (/proc/[pid]/wchan broken) (BZ#2233928) Enhancement(s): * [Intel 9.3 FEAT] cpufreq: intel_pstate: Enable HWP IO boost for all servers (BZ#2210270) * [Dell 9.3 FEAT] - New MB with AMP Codec Change on Maya Bay (audio driver) (BZ#2218960) * [Lenovo 9.3 FEAT] MDRAID - Update to the latest upstream (BZ#2221170) * [Intel 9.3 FEAT] [EMR] Add EMR support to uncore-frequency driver (BZ#2230169) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default kernel-tools-libs-devel-5.14.0-284.30.1.el9_2.x86_64.rpm ed695fb49cba03d2fe3400056fae96381ab71fde5f2b732bf8473add76487c6e ALSA-2023:5143 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.122 and .NET Runtime 6.0.22. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.122-1.el9_2.x86_64.rpm 36e5da247195b94c46541646934f548a4e0d89f85b6e302471db20f38cd8e977 ALSA-2023:5146 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.111 and .NET Runtime 7.0.11. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.111-1.el9_2.x86_64.rpm e05bae23d6a8a72405f565948e5fe6685edf0bb5066642ab9f8957cb703fbc30 ALSA-2023:5214 Copyright 2023 AlmaLinux OS 0 1 Important

libwebp security update

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libwebp-tools-1.2.0-7.el9_2.x86_64.rpm 6d99785433232a234454bd64d818448193b3df5cd4ce4053ec7fac66283b4419 ALSA-2023:5453 Copyright 2023 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in ld.so leading to privilege escalation (CVE-2023-4911) * glibc: Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) * glibc: potential use-after-free in getaddrinfo() (CVE-2023-4806) * glibc: potential use-after-free in gaih_inet() (CVE-2023-4813) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default glibc-nss-devel-2.34-60.el9_2.7.x86_64.rpm 017f2328aca87d3b301019fb522fe38111c9ff9e0fd4182c864515d4d7dc618f glibc-static-2.34-60.el9_2.7.i686.rpm 072adc50dbd0bb4320f13fa062726c43f110b96f4f75f8e2402d0f6e9a25ebdd nss_db-2.34-60.el9_2.7.i686.rpm 1731599b890bb86c5ae6e6748894335a8b182f865e9482b97c172a44861c8921 glibc-nss-devel-2.34-60.el9_2.7.i686.rpm 3875a9a310eb7b3a41c5f49bb1d32a5aa175e67b4ca034a4bf863c1713746c2f nss_hesiod-2.34-60.el9_2.7.x86_64.rpm 38fd82eb43b6efd244ea48f9e8d096565cc3c035c90f008cbd835030bf8a4de3 nss_hesiod-2.34-60.el9_2.7.i686.rpm 5ed08ab08fcf7e0c68ecf01e4029cc5bf85fce35a734d11dca174629548dcdbe nss_db-2.34-60.el9_2.7.x86_64.rpm 65ba707f704ff37fc1c1ae38ee20a4640e0dcffad8786e0acf59d624ddeb14b5 glibc-static-2.34-60.el9_2.7.x86_64.rpm 9c275b0a96b68360aab54c58fec2368ef1173b571c956fd8181b8f8a9d205f42 glibc-benchtests-2.34-60.el9_2.7.x86_64.rpm aecc5952229a7b75bd6d1932a82c69b29ada135018d585ca825f727652dc1f33 ALSA-2023:5456 Copyright 2023 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3.11-idle-3.11.2-2.el9_2.2.i686.rpm 065e0eaa816a086fe3c778c0d33927eb8a19b35e1e3fab47426996f7a534d1b1 python3.11-debug-3.11.2-2.el9_2.2.x86_64.rpm 2cf98beb3b041e076ee92a7bc3e334411ee67812bdec875a19a7769c11e87cb3 python3.11-debug-3.11.2-2.el9_2.2.i686.rpm 6506a22eac59e3d3fc9c9710e4589823ac967cc212f1f5a04e301def60f917e1 python3.11-3.11.2-2.el9_2.2.i686.rpm 690638feecd17a9a58c8af8ddeaf11fc39afc9d6f3f46c59a0c9da6e2fd6f581 python3.11-test-3.11.2-2.el9_2.2.i686.rpm a0ad0e4b5aef67882bf86e5f14b0a88876c8517b873b85cd278021939e04e4ac python3.11-tkinter-3.11.2-2.el9_2.2.i686.rpm c215fc04096b5af3ca44cd0d66094d6a9146d82ac0607462f08b041b3702e3af python3.11-test-3.11.2-2.el9_2.2.x86_64.rpm da2d4475ef8ddf53293343bc978e8cb139e66d5b1cf06d168128d39131b1d465 python3.11-idle-3.11.2-2.el9_2.2.x86_64.rpm ee00c4640e9cab92f217e7f691e58e09ad2ade0e96986f4a23fb31fe5c2fa29e ALSA-2023:5459 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices (CVE-2023-36664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libgs-devel-9.54.0-10.el9_2.i686.rpm 1b39770e4a87267b203010a71d2ec54e8070157102ff4b380879f341472fc39b ghostscript-tools-fonts-9.54.0-10.el9_2.i686.rpm 2f6fede5b098fdeb427a3cdc431c4990a36affabb0dde9a75d42fbe4c2e1b178 ghostscript-tools-printing-9.54.0-10.el9_2.i686.rpm 3a5ec05c5ec234d0f1d9219f2beadc81e89410449840536240eed922b6b8dd67 ghostscript-9.54.0-10.el9_2.i686.rpm d079accdeee4406a6e31c47e2547f4e03b8d7c7ab9f9fafc6d06eca06f51ed01 libgs-devel-9.54.0-10.el9_2.x86_64.rpm f9703de5043d78a4d3087fcfea1dfabf1d790d4ceb2f1027e322e9554ad187ea ALSA-2023:5462 Copyright 2023 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: TLS handshake bypass (CVE-2023-40217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3-tkinter-3.9.16-1.el9_2.2.i686.rpm 06fadec48bf87e75ecb624987aee83a5d8511fa38db7771a237d0ea67801e426 python3-idle-3.9.16-1.el9_2.2.x86_64.rpm 1366ceefd8e1b546e0c2c97f5d0559c697c54d3549bdc75388bb25de77898701 python3-test-3.9.16-1.el9_2.2.x86_64.rpm 62bba1890831a91b803134999f7c778930f257f9446f7520fcb684bfc64662a5 python3-debug-3.9.16-1.el9_2.2.i686.rpm 6e60cdbc76bee3452523addd9d8f7d685105ef0bb3906f7bd1dc516861b20d49 python3-test-3.9.16-1.el9_2.2.i686.rpm add29ec1dd35396df3d8bf5942b855601cc1f9804c1ede3153dd47e675f610e6 python3-idle-3.9.16-1.el9_2.2.i686.rpm dc161b8184860646b850d35986a61a46397e8a9b727c442cbcea30102438d6ed python3-debug-3.9.16-1.el9_2.2.x86_64.rpm e0785d8758880a7f84a22d09e5f0cafdf96bfbaa5eb5206bf8febd494cb0c99c python3-3.9.16-1.el9_2.2.i686.rpm efef0ecc5add7970dee404f73da71e374f0d446fb16accdaba8a11d18cfcc4c9 ALSA-2023:5539 Copyright 2023 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libvpx-devel-1.9.0-7.el9_2.alma.1.i686.rpm b18fadc95b5f26dbeda74594cf5b89ba7435467914a3d182ee43132134488970 libvpx-devel-1.9.0-7.el9_2.alma.1.x86_64.rpm fcd57fa049feec8b22f53adcdd038ddc6499f4b4a9dd902f28db232f95fee1a5 ALSA-2023:5684 Copyright 2023 AlmaLinux OS 0 1 Important

galera and mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22). Security Fix(es): * mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6 (CVE-2023-5157) * mariadb: use-after-poison in prepare_inplace_add_virtual in handler0alter.cc (CVE-2022-32081) * mariadb: assertion failure at table->get_ref_count() == 0 in dict0dict.cc (CVE-2022-32082) * mariadb: segmentation fault via the component sub_select (CVE-2022-32084) * mariadb: server crash in st_select_lex_unit::exclude_level (CVE-2022-32089) * mariadb: server crash in JOIN_CACHE::free or in copy_fields (CVE-2022-32091) * mariadb: compress_write() fails to release mutex on failure (CVE-2022-38791) * mariadb: NULL pointer dereference in spider_db_mbase::print_warnings() (CVE-2022-47015) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default mariadb-test-10.5.22-1.el9_2.alma.1.x86_64.rpm 5fa09ce7ae1a84dea1f205fbd99ee7964eb8c946a2898d0e7f973dcb72d252ce mariadb-embedded-devel-10.5.22-1.el9_2.alma.1.x86_64.rpm 8a558893fc2ce82f3206099a34dd9ca6508c19525d89806cfddcd9b53d8651ed mariadb-devel-10.5.22-1.el9_2.alma.1.x86_64.rpm 959fa4cfc975d0c07586622f77dedd9ca22c2e5f00e87703ba06269f279d3632 ALSA-2023:5689 Copyright 2023 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default bind-devel-9.16.23-11.el9_2.2.i686.rpm 020d41142c04dcd1eb6ac309e6fd30367f7f013ee722a45497c66a42f93da017 bind-libs-9.16.23-11.el9_2.2.i686.rpm 352e4852616182351296b1d7073bf451b7c1ca259b7dd299716e579782057aa1 bind-doc-9.16.23-11.el9_2.2.noarch.rpm 66efa77c46000b37186909a04710d2643178d4f0246f35f8d0a8c8eddd9829b0 bind-devel-9.16.23-11.el9_2.2.x86_64.rpm eba0c7b4808e4358a6a7367f33a4fef4aec571f67cba1329976966070d738572 ALSA-2023:5708 Copyright 2023 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.123 and Runtime 6.0.23. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.123-1.el9_2.x86_64.rpm f5532a0bcf6b45aefb13fd6764134e3d221b8025cd511a58a27f3321f61da78e ALSA-2023:5711 Copyright 2023 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.x86_64.rpm 08475322b050a377845172a2df463d1a6845df3ca19f3f958448be94e4bde009 ALSA-2023:5733 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433) * OpenJDK: IOR deserialization issue in CORBA (8303384) (CVE-2023-22067) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 8u392, increases it to 16 MB. (AlmaLinux-13593) * The /usr/bin/jfr alternative is now owned by the java-1.8.0-openjdk package (AlmaLinux-13583) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-1.8.0-openjdk-headless-fastdebug-1.8.0.392.b08-3.el9.x86_64.rpm 0f30f18e54965d9d610eb0488a1bbe9715cf08a433986edb1083bde874d4b00c java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-3.el9.x86_64.rpm 19248575400b96ab87eb185310da1a35deca77558f4ce0bdf3f992d274a8eee2 java-1.8.0-openjdk-fastdebug-1.8.0.392.b08-3.el9.x86_64.rpm 1c58de5d095072c9c082e051a7d4693fe76e5305d7b038a483cd713d4bf2d464 java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-3.el9.x86_64.rpm 1e72daaf43ce75a5ab77a85a489c35b0699b625519c12153174314b225b6e734 java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-3.el9.x86_64.rpm 6dab23df177f4201e2235b5f1be0c2f142b2b68a49b3d5d375057093ce549367 java-1.8.0-openjdk-src-fastdebug-1.8.0.392.b08-3.el9.x86_64.rpm 9378a1fc51d384cbfd251ae158361881764614f8df3091703807af51a3d0c874 java-1.8.0-openjdk-demo-fastdebug-1.8.0.392.b08-3.el9.x86_64.rpm 93b84dbce4ea89a262896ff4bc3a48d6170732545488542a48af06211714edad java-1.8.0-openjdk-devel-fastdebug-1.8.0.392.b08-3.el9.x86_64.rpm bc3f9d7497c2dfaeb41ea0dd50323f84fe2808f5c3bcfc88a5b57191024a1f88 java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-3.el9.x86_64.rpm bdcdfa4bd9fa48866ae1f881fb332e1b87463e1b7d7224ba37b239f6f6fc8b18 java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-3.el9.x86_64.rpm eba57e250f26139cdc072a79cedb5f081fc0df3c6857e826f490c92dd1f99b43 ALSA-2023:5744 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-11-openjdk security and bug fix update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 11.0.20 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 11.0.20.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237175) * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 11.0.20 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 11.0.20.1, increases it to 16 MB. * The serviceability agent would print an exception when encountering null addresses while producing thread dumps. These null values are now handled appropriately. (JDK-8243210) * The /usr/bin/jfr alternative is now owned by the java-11-openjdk package (AlmaLinux-13532) * The jcmd tool is now provided by the java-11-openjdk-headless package, rather than java-11-openjdk-devel, to make it more accessible (AlmaLinux-13536) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-11-openjdk-src-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm 0b78781bac56933cbd07c19fcb35443b9339b2b72da8805844fa295ddfc8135b java-11-openjdk-demo-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm 1e94e6d429b383761dbc4d222c42713a5875d29380ab53019fadfe6bcdfe76c2 java-11-openjdk-static-libs-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 25dab356cb81548588ddc1036eb4acd58673fa0178b8b13721559d703b5dfab3 java-11-openjdk-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 395858eebb260d53f65a302de9141f8319a0d54e2011c6baad1650285b0b27f7 java-11-openjdk-headless-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 42722d26029e65a00222d3003e5724b4266aa9e3b88359239e73c6f8594afa3c java-11-openjdk-demo-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 6371bf16e9adf088178f94d2269009b45d90f1a23fb7a77365ad0c8874fd78f2 java-11-openjdk-jmods-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 6b6945350926e7aa6d528b89c2d1936a0613fdeab73aac2fdf022450fb930fdc java-11-openjdk-devel-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 8ab1e9b2c029409e697ecf49e4ab976c127650e090377f0b1f455509a53a84a8 java-11-openjdk-src-fastdebug-11.0.21.0.9-2.el9.x86_64.rpm 994de63eba39d3cb00f8740e428a985f3fac481735f84eb8f604f24743384a21 java-11-openjdk-headless-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm a72021fb62c3bbe00a6af11dbaa59747afe3892fcb1026e5b80be0099dd6af59 java-11-openjdk-jmods-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm b205d34da3d943781508fce7d73d1baf5acf8bd21f2ef1d524f5927f5cf7901e java-11-openjdk-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm b7f73729ee6fb6286b29503e5d2f40c8f228b8c387e6056868e228a89a4d2c12 java-11-openjdk-devel-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm e8dd21f05321038ec255509bb131b365a3722ee8134d87e946ec662c3fbbd810 java-11-openjdk-static-libs-slowdebug-11.0.21.0.9-2.el9.x86_64.rpm f453c11bd2f3f3708093ca4a403ba95e454ba46ca365b1cfdceebc7cb2a3dc66 ALSA-2023:5749 Copyright 2023 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 7.0 to SDK 7.0.112 and Runtime 7.0.12. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.112-1.el9_2.x86_64.rpm a58b9746c07431d367dd1133e4c13c07572f3fdcc92d5c04bc93d69a9a9cdd1e ALSA-2023:5753 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 17.0.8 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 17.0.9, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. (RHBZ#2237185) * The /usr/bin/jfr alternative is now owned by the java-17-openjdk package (AlmaLinux-13648) * The jcmd tool is now provided by the java-17-openjdk-headless package, rather than java-17-openjdk-devel, to make it more accessible (AlmaLinux-13651) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-17-openjdk-static-libs-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm 108f689b72a86e868e8ab20787a8fad9b3aed3e21ab66d9938ecaa6dddfb9b20 java-17-openjdk-devel-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm 147a60edcc182f14f02f58e82a3a37ff714b07f79cae341f5ed1938585f621d5 java-17-openjdk-headless-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm 1cbf819724a841dbe2b938e01b7701137f67a4fb21bd0a58314bd2b703ac7346 java-17-openjdk-static-libs-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm 2eb7dc86b464502082ec4e34b4ebeb9b6c3f459fea5d4a3797e642a6016e859a java-17-openjdk-jmods-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm 322ec3d23625224ed6dd5e99eb5de0a54d800c88137ab5d0b695a38f65a20d4f java-17-openjdk-src-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm 36d0b6ae0ac8c0d9d9c561e81d8d5f14eb2a374dbf911c5736868a455669693e java-17-openjdk-headless-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm 46723a63a43e187eda78ceafcfd5f30029b003630537bebd6bbf910e2e992f6b java-17-openjdk-devel-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm 7b7322f34a12e69ea40798a8544af20b8ea0342106c2e43b9f5267e806d1924a java-17-openjdk-demo-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm 8aeb53827a236ff89aa48a240f8a5f783b77c6615b7033cbb9b66930c53dce4c java-17-openjdk-jmods-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm 8b30295303dda03b537bf56f4530c3b85f45eb61fa14020d5e6fac8ed24dbae3 java-17-openjdk-src-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm a282e3519d2e46f9204a84cbe1871d9f71133b89c1bc3e567fd48a49d0ac5131 java-17-openjdk-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm b714bde63b99d951cfc54cd9dbd3dc5ad737d066a78146770d6177b14f4cd218 java-17-openjdk-slowdebug-17.0.9.0.9-2.el9.x86_64.rpm f0de7ae5ef517325e860f5b7aab55aec0200d04ccdd38c78db96a075a9fe33df java-17-openjdk-demo-fastdebug-17.0.9.0.9-2.el9.x86_64.rpm f9332001ce7c57f62d0d54961bf22bbe5af48ba0a63ab1c9caf3c6df0451b023 ALSA-2023:5838 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default nghttp2-1.43.0-5.el9_2.1.x86_64.rpm 3d07b2ab8d2e4a449dc542a9826fc1ce03855272392e9dfb084512e77c7ae24f libnghttp2-devel-1.43.0-5.el9_2.1.x86_64.rpm 8204feaa82213c138b7567ccebe28e185786a5a1b79869fc5c159cfaf3c1368e libnghttp2-devel-1.43.0-5.el9_2.1.i686.rpm 8b5d87b4d2e966a99c10098707a8bcecddc50e7eaaa737a1a1670ec6e939031f ALSA-2023:5924 Copyright 2023 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default varnish-devel-6.6.2-3.el9_2.1.i686.rpm 2d4dd60359da52773b3648ed7b225e5e025d08526b53bccf76014b8d2c81c00e varnish-devel-6.6.2-3.el9_2.1.x86_64.rpm 8f2d19affb8edefa3c982380ed47db3946930832356ed485880e683af9fb0da5 ALSA-2023:6242 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.124 and .NET Runtime 6.0.24. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-6.0-source-built-artifacts-6.0.124-1.el9_2.x86_64.rpm 25053eaa49c1489e6582b3888b9d4a5c9d96d581cbdbad423fff1181aa2636f7 ALSA-2023:6246 Copyright 2023 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.113 and .NET Runtime 7.0.13. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default dotnet-sdk-7.0-source-built-artifacts-7.0.113-1.el9_2.x86_64.rpm 253f3ee00e5ce314ba8691261200c02ab2235b535c28b3524fc8d6c496bab808 ALSA-2023:6265 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default ghostscript-9.54.0-11.el9_2.i686.rpm 3ff4fdfb3bd66d3e70b237cad1330d835ab23ff217e106bc502083db370f3490 libgs-devel-9.54.0-11.el9_2.i686.rpm 5cc6166b58b47d646cb33879139360a885e03d4cf49045abed11c896f1e98183 libgs-devel-9.54.0-11.el9_2.x86_64.rpm 8d0f5125ec32707654600dc3469cc63b25b64ab89adb060b14ce706feae7d2e1 ghostscript-tools-printing-9.54.0-11.el9_2.i686.rpm a72af05b19408edc6a9b453afd7f875d42ef3ad79760023b5db2f1db0d011345 ghostscript-tools-fonts-9.54.0-11.el9_2.i686.rpm e5cf1fc0f2c98634ca57a778f64bb74a58a775a91dced9659f5e48d3a2b31a54 ALSA-2023:6330 Copyright 2023 AlmaLinux OS 0 1 Moderate

edk2 security, bug fix, and enhancement update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() (CVE-2019-14560) * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default edk2-tools-20230524-3.el9.x86_64.rpm 38e89f2d60bbf87a1c484630afcba547a9696ec989f65651e8350df3357168ab edk2-aarch64-20230524-3.el9.noarch.rpm 7f420a2e6902aa83721973936da687385ce3f9a318f79cec650eaf58da03c9ed edk2-tools-doc-20230524-3.el9.noarch.rpm bc4917712bdd37c686a2e9927839c2ca2f3285b9325d99e9fe4bb9eb8a68f06b edk2-ovmf-20230524-3.el9.noarch.rpm cf00362ca3ecc9d6ce43ec1f21168c8524b96b2675854692c3afd7bf709e0918 ALSA-2023:6340 Copyright 2023 AlmaLinux OS 0 1 Moderate

xorg-x11-server security and bug fix update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default xorg-x11-server-devel-1.20.11-19.el9.i686.rpm 73943a520bcf5ee943cb6351387dbd5cfe5fbd0225c434a84a9db64497ee0d50 xorg-x11-server-source-1.20.11-19.el9.noarch.rpm ed9468d65a98be100088d86f19083f24832179b05fca80ab20b7058d4b20ea55 xorg-x11-server-devel-1.20.11-19.el9.x86_64.rpm fecce6570f68d599268ff344e429d761df59dee6eb251d25fb24b7e73ccb88e8 ALSA-2023:6343 Copyright 2023 AlmaLinux OS 0 1 Moderate

LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: stack buffer overflow in LibRaw_buffer_datastream::gets() in src/libraw_datastream.cpp (CVE-2021-32142) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default LibRaw-devel-0.20.2-6.el9.x86_64.rpm 18d505d957997165a79bd24b39f8a783c67de0093521f026a0cdad46790e041b LibRaw-devel-0.20.2-6.el9.i686.rpm 44f944a19b80f1aa4f822601cd6b29fb5f50f1b112808c9bae0039bdc69df544 ALSA-2023:6369 Copyright 2023 AlmaLinux OS 0 1 Moderate

qt5 security and bug fix update

Qt is a software toolkit for developing applications. Security Fix(es): * qt: buffer over-read via a crafted reply from a DNS server (CVE-2023-33285) * qt: allows remote attacker to bypass security restrictions caused by flaw in certificate validation (CVE-2023-34410) * qtbase: buffer overflow in QXmlStreamReader (CVE-2023-37369) * qtbase: infinite loops in QXmlStreamReader (CVE-2023-38197) * qt: Uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default qt5-devel-5.15.9-1.el9.noarch.rpm 14df93938a3e6baf085f3edb3deec26a56cf6eff403e27dbc124e5a0fdca69d5 qt5-qtbase-static-5.15.9-7.el9.x86_64.rpm 45be7c9359fce7c2eba25a4d392f0261bfd3fe561563e593152407c710e238cc qt5-qtbase-static-5.15.9-7.el9.i686.rpm 591b079d56c46ac6afc8c67ddff04165ca7c9c30b59f6909e9ad9d1b13e86278 ALSA-2023:6409 Copyright 2023 AlmaLinux OS 0 1 Moderate

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (9.5.0). (BZ#2175785) Security Fix(es): * libvirt: improper locking in virStoragePoolObjListSearch may lead to denial of service (CVE-2023-3750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libvirt-client-qemu-9.5.0-7.el9_3.alma.1.x86_64.rpm 27222619302dda2db6f095377493eaec501b13d8ed6309473ab417903b0c1d82 libvirt-devel-9.5.0-7.el9_3.alma.1.x86_64.rpm 3717e7ade18ed771f7bc6b9ac6dc0595cf8aca543b3e41e73ebbcff1046af6ad libvirt-docs-9.5.0-7.el9_3.alma.1.x86_64.rpm 5f4aac126efb9ba9b235990148c1d671882e4e14da8b2c7ff08014352671df01 libvirt-daemon-plugin-sanlock-9.5.0-7.el9_3.alma.1.x86_64.rpm f0d401b6491a838d4a0fe1706f7e5b489df9989aac67bd8cc4f883526be7eb10 ALSA-2023:6431 Copyright 2023 AlmaLinux OS 0 1 Moderate

libfastjson security update

The libfastjson library provides essential JavaScript Object Notation (JSON) handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fix(es): * json-c, libfastjson: integer overflow and out-of-bounds write via a large JSON file (CVE-2020-12762) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libfastjson-devel-0.99.9-5.el9.x86_64.rpm a053f1f38e7a7d3eebae90524cc49012e9454c86c444787ca17644fe1a9bf45a ALSA-2023:6469 Copyright 2023 AlmaLinux OS 0 1 Moderate

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: RTPS dissector crash (CVE-2023-0666) * wireshark: IEEE C37.118 Synchrophasor dissector crash (CVE-2023-0668) * wireshark: Candump log file parser crash (CVE-2023-2855) * wireshark: VMS TCPIPtrace file parser crash (CVE-2023-2856) * wireshark: NetScaler file parser crash (CVE-2023-2858) * wireshark: XRA dissector infinite loop (CVE-2023-2952) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default wireshark-devel-3.4.10-6.el9.x86_64.rpm 6658c182f61601208350f4cb51b26f52c81f32181f244ff624fd95542b5c8aed wireshark-devel-3.4.10-6.el9.i686.rpm e275ce6f25351d09d5e388ae94f760fb082195e69a3ccb8e67297bb9b047013d ALSA-2023:6482 Copyright 2023 AlmaLinux OS 0 1 Moderate

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c/librabbitmq: Insecure credentials submission (CVE-2023-35789) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default librabbitmq-devel-0.11.0-7.el9.i686.rpm 308ca302f3750c8f431ed366f565ec9d35497fdb93d4f2d35a2662056cf0334a librabbitmq-devel-0.11.0-7.el9.x86_64.rpm 483d5fc7a6fe26d9919e5b5a7c90ee1ee29b0eb9a05a39965fd8b047d03efb95 ALSA-2023:6494 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.11 (3.11.5). (BZ#2210785) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) * python: file path truncation at \0 characters (CVE-2023-41105) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3.11-idle-3.11.5-1.el9_3.x86_64.rpm 28d2a7cca0020a74eec0697b815b2194897f1776f5d4f27f1abe839f1c1ab850 python3.11-debug-3.11.5-1.el9_3.x86_64.rpm 386a0c1810ab58c253369dc67f7d1deed95d9652960a83161ad1bdc1125c184e python3.11-3.11.5-1.el9_3.i686.rpm 76c5912d687bb6afd5f80b5223c519c36f1c234cc4760d4445f50a977a907ea1 python3.11-debug-3.11.5-1.el9_3.i686.rpm 944cdb09a719bac3efc8abd9aa98b83f6d93833ddadf834be772f267972d8397 python3.11-tkinter-3.11.5-1.el9_3.i686.rpm d338b629b9b1a94c33e8023008410932b97d5635ba6bf596715963b550eb123d python3.11-test-3.11.5-1.el9_3.x86_64.rpm d998e84148a9279b4c706069284c5d5da3a64935532b5b6ad100ad7cec4f5027 python3.11-test-3.11.5-1.el9_3.i686.rpm decc88968f041f051a009a5ebf97316a56a4c78c63602601acc19b16c9b27eeb python3.11-idle-3.11.5-1.el9_3.i686.rpm e23b7eee4cb361fd6660ca999e665968c0c0c9163f03b30837530372dfedabf6 ALSA-2023:6508 Copyright 2023 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Empty entry in Java class path (CVE-2022-38745) * libreoffice: Array index underflow in Calc formula parsing (CVE-2023-0950) * libreoffice: Arbitrary file write (CVE-2023-1183) * libreoffice: Remote documents loaded without prompt via IFrame (CVE-2023-2255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libreoffice-sdk-7.1.8.1-11.el9.alma.x86_64.rpm 78cbf759e1afdb1978e844de6348baeb8b92395341eb3f15d3bf32c0fa470e5e libreoffice-sdk-doc-7.1.8.1-11.el9.alma.x86_64.rpm f14924469d488bfb8faedc32b523bd330c460bcd4b5471ea8daa71c26e2bff7a ALSA-2023:6518 Copyright 2023 AlmaLinux OS 0 1 Moderate

flatpak security, bug fix, and enhancement update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. The following packages have been upgraded to a later upstream version: flatpak (1.12.8). (BZ#2221792) Security Fix(es): * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100) * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default flatpak-devel-1.12.8-1.el9.i686.rpm 1a2eeaafe68b54a811748d633320d2779ac69be3426ed22d1fcec1f89880b03e flatpak-1.12.8-1.el9.i686.rpm 91c7912c3df21c3c615fb28033d767aad06940fb84c7c4fa33afd0d736d68348 flatpak-session-helper-1.12.8-1.el9.i686.rpm aee26ab5244745f23394c81b1f304536c8dbb65a28b05ae7031be4289a396d7e flatpak-devel-1.12.8-1.el9.x86_64.rpm db3927350d2c9306d4ddc2367e6afd0c181724811741ea2d39d8604380e1fff9 ALSA-2023:6544 Copyright 2023 AlmaLinux OS 0 1 Moderate

ghostscript security and bug fix update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: buffer overflow in base/sbcp.c leading to data corruption (CVE-2023-28879) * ghostscript: Out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in DoS (CVE-2023-38559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default ghostscript-tools-fonts-9.54.0-13.el9.i686.rpm 16edca080b636f75cdcab2f068559dd581b346a82d4ffbf672db6469c33cac1b libgs-devel-9.54.0-13.el9.x86_64.rpm 87a6391937855d9f5156de0619afcb45c173aed57f85626a80b80d29ce182ade ghostscript-9.54.0-13.el9.i686.rpm 9085ec60aaa4b2569f4ea1b01d3e42e18d5d504ed94b7fe2c9a986bbd2412c75 ghostscript-tools-printing-9.54.0-13.el9.i686.rpm cf9367068d6a9f98dfb4a5a7738b068cbc415bf5590b0b7d754b4f6c4cc3e35c libgs-devel-9.54.0-13.el9.i686.rpm fd651d8a60a21e51e87956844e81489ea9fd916c6d1741cdc234c62c3e29c140 ALSA-2023:6551 Copyright 2023 AlmaLinux OS 0 1 Moderate

yajl security update

Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default yajl-devel-2.1.0-22.el9.i686.rpm 4b9f95d4dfdc8099900c49a58d8690be607e7c012ce05cca6970255d273b074d yajl-devel-2.1.0-22.el9.x86_64.rpm 7822eaf3c5608b809196bbbd0ab9854dd77b547a200821d8655cf53e8dd95542 ALSA-2023:6566 Copyright 2023 AlmaLinux OS 0 1 Moderate

libmicrohttpd security update

GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application. Security Fix(es): * libmicrohttpd: remote DoS (CVE-2023-27371) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libmicrohttpd-devel-0.9.72-5.el9.i686.rpm 0b43d6d7edec512bcc1eb29c3da3eeb13be632e75c3b035b70f64f5d4413fa7a libmicrohttpd-devel-0.9.72-5.el9.x86_64.rpm 4d039a63a73f10e5f05073db5e9e8afc047d9b1d70f2849bb715cf6a79dbfeee libmicrohttpd-doc-0.9.72-5.el9.noarch.rpm 67390759e2ec13f61ba7f59dbe3cfaa36ab3d99119dee2bb683a6e76818003ec ALSA-2023:6575 Copyright 2023 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731) * libtiff: tiffcrop: null pointer dereference in TIFFClose() (CVE-2023-3316) * libtiff: memory leak in tiffcrop.c (CVE-2023-3576) * libtiff: heap-based use after free via a crafted TIFF image in loadImage() in tiffcrop.c (CVE-2023-26965) * libtiff: Buffer Overflow in uv_encode() (CVE-2023-26966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libtiff-tools-4.4.0-10.el9.x86_64.rpm d2fbbedd010390ebea64122194926858e263663a2722468796f890628c95788b ALSA-2023:6621 Copyright 2023 AlmaLinux OS 0 1 Moderate

protobuf-c security update

The protobuf-c packages provide C bindings for Google's Protocol Buffers. Security Fix(es): * protobuf-c: unsigned integer overflow in parse_required_member (CVE-2022-48468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default protobuf-c-devel-1.3.3-13.el9.i686.rpm 0e231f1a5dfeac470c2225ce32a61f6b5d11cc120993038355e50bd2f038a7bd protobuf-c-compiler-1.3.3-13.el9.x86_64.rpm 0e74ba239df5c269ea995d770ae8b0404a02ca79ccef82f6efa1f63875173995 protobuf-c-devel-1.3.3-13.el9.x86_64.rpm 650f9294e9a89f2a2b8cc4dc0a27049885a14e54d8c1b46dcd1643d22ae4870e protobuf-c-compiler-1.3.3-13.el9.i686.rpm d1513c1cf5ef9771f23fe6c11bb2050719d35c30408301669c3fd9faa65169da ALSA-2023:6631 Copyright 2023 AlmaLinux OS 0 1 Low

glib2 security and bug fix update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499) * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611) * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default glib2-static-2.68.4-11.el9.x86_64.rpm 6397a7853a91ba61791d19b9e3e6327e6dd1baaa952d1a1545faab2468940d40 glib2-static-2.68.4-11.el9.i686.rpm 87ee8e737f4016af2f3befb75c9f62e1c8451c6422c9330bd2673bc22a7c4007 ALSA-2023:6632 Copyright 2023 AlmaLinux OS 0 1 Low

shadow-utils security and bug fix update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: possible password leak during passwd(1) change (CVE-2023-4641) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default shadow-utils-subid-devel-4.9-8.el9.i686.rpm e2e445f2d144c356a7823eb4bfdd7fdcb5407501084e852fa54750782e710004 shadow-utils-subid-devel-4.9-8.el9.x86_64.rpm e797c7a645c887b11dbb3d575da1a68b07e95c6161d4ad57330683811dba9405 ALSA-2023:6659 Copyright 2023 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.18). (BZ#2210783) Security Fix(es): * python: tarfile module directory traversal (CVE-2007-4559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3-debug-3.9.18-1.el9_3.x86_64.rpm 3ab7f55d93b546d1bb7d6a5850ee6e6642a8e869fed3f2300aaf9ec42a997b51 python3-test-3.9.18-1.el9_3.i686.rpm 4f17d26ebf690d7edf6292271923ff837f31140ba3155c6271a5a8a04fcda54c python3-test-3.9.18-1.el9_3.x86_64.rpm 69675eafe74b25138853c7441f95a53a2f5bb38331c41d5cf1f8ffbc380fcaeb python3-debug-3.9.18-1.el9_3.i686.rpm 736ecbbac4d28e7642a4f27169f3071ca3085c10e218a12031fd545f45efc62a python3-3.9.18-1.el9_3.i686.rpm 73c6189d1116033628b326ef567eaacae932c0542b49482b2e68a1d8ae0c04b1 python3-idle-3.9.18-1.el9_3.x86_64.rpm 7c42a163f88373369dd510283f3f6c53fc6c24ff7698a45bfb647c17d1b787a6 python3-idle-3.9.18-1.el9_3.i686.rpm 9f122f43c13f19674ce0db9185a52d559472d0c05aad5649446d9044e5aaa8b1 python3-tkinter-3.9.18-1.el9_3.i686.rpm f0c8ec4be0d55698e7bd0b8e11f61fe9c721bbcc9a1ef876389bf959fcb291ea ALSA-2023:6667 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security, bug fix, and enhancement update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.18.6). (BZ#2190415) Security Fix(es): * samba: out-of-bounds read in winbind AUTH_CRAP (CVE-2022-2127) * samba: infinite loop in mdssvc RPC service for spotlight (CVE-2023-34966) * samba: type confusion in mdssvc RPC service for spotlight (CVE-2023-34967) * samba: spotlight server-side share path disclosure (CVE-2023-34968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default python3-samba-test-4.18.6-100.el9.x86_64.rpm 2278d06420b80eef23aea30644abd0a820a1b89c7f9e2a71e6b9aa57b04d5826 libnetapi-devel-4.18.6-100.el9.i686.rpm 2c228f502fddda8cc99f082785fa2ee023ceec26943a9f3caef313c81c6c049c libsmbclient-devel-4.18.6-100.el9.x86_64.rpm 2d53547079ed24691ff53e98a2ae8ecc34bf332573b050649dcb0d936a492aa5 samba-devel-4.18.6-100.el9.i686.rpm 51e2c6050fa060323875deb834e3a6704e2a23cd338657729f9b78a058e8f350 libwbclient-devel-4.18.6-100.el9.i686.rpm 56fb853213dfa6aca02380e82c112a01193550a25482771a19a3b7b127542e4a samba-pidl-4.18.6-100.el9.noarch.rpm 612991a14c95fa2121a221b922b765cc7bec8b2556c61d9b4fec0ed42bae7173 python3-samba-devel-4.18.6-100.el9.i686.rpm 64e4207fef67becb01b1b8870bad3c64e33d28062f7a5fe7b853af52dfd295fc samba-test-libs-4.18.6-100.el9.x86_64.rpm 6d8552c3c3aa847a184b4f54415e7d40764fa6a2aa06e82e6fcdfe0c97f32b02 python3-samba-devel-4.18.6-100.el9.x86_64.rpm 9469ffca936d1c469886388ffab0d8ab56cdb92d5e045ba48fbd3b1e2a814276 samba-test-4.18.6-100.el9.x86_64.rpm 9b2cf10820a6a95d0e975d7504eb175c427dec44ae9bf109d1e6859f16e8026e libsmbclient-devel-4.18.6-100.el9.i686.rpm b943b6899ac443066110c1d87ee4e5a021504dad7abe134e58d0d0339cb78779 libwbclient-devel-4.18.6-100.el9.x86_64.rpm e06301d2a0d94f3b663559d78227ac7fccc123fa7bc4f4c905a65ac670b22539 samba-devel-4.18.6-100.el9.x86_64.rpm e17f91306b67314007e9918a2c5fdcc27ad26354c9e3fe0aa8023af9af270690 libnetapi-devel-4.18.6-100.el9.x86_64.rpm e8c7b6085355f322ca45ac88aa680b669a9aec17bf5b080597be013f5ead98d5 ALSA-2023:6685 Copyright 2023 AlmaLinux OS 0 1 Low

tpm2-tss security and enhancement update

The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices Security Fix(es): * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default tpm2-tss-devel-3.2.2-2.el9.i686.rpm 1888c2d39c935cad722ae12cb8498b8ba95c5c206e312eace15ad2b12aca23d7 tpm2-tss-devel-3.2.2-2.el9.x86_64.rpm a252ad3261ffbe7f2a2b6d3c1aa00d7e70a259c884c6235794985fa20b942618 ALSA-2023:6705 Copyright 2023 AlmaLinux OS 0 1 Low

procps-ng security and bug fix update

The procps-ng packages contain a set of system utilities that provide system information, including ps, free, skill, pkill, pgrep, snice, tload, top, uptime, vmstat, w, watch, and pwdx. Security Fix(es): * procps: ps buffer overflow (CVE-2023-4016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default procps-ng-devel-3.3.17-13.el9.x86_64.rpm 1bd4e08a3c4e81964e8c77affc770ed38a43ac6115e54d5686edcc507cb14136 procps-ng-devel-3.3.17-13.el9.i686.rpm 806e776e569d3613766f898036ab5ecb992f78b215d67a981a782cc7599d5de3 ALSA-2023:6707 Copyright 2023 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket (CVE-2021-3468) * avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames (CVE-2021-3502) * avahi: avahi-daemon can be crashed via DBus (CVE-2023-1981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default avahi-devel-0.8-15.el9.x86_64.rpm 14fac24c749035d64056c31fe563f82c3d8730ef530e2f07706fc6a3f293232b avahi-compat-libdns_sd-0.8-15.el9.i686.rpm 468cbae7b80ae45a68f368eedddc77b6167bc8bfe224791567c65619100b75b8 avahi-compat-howl-devel-0.8-15.el9.i686.rpm 47dfa047f768f82216ac1b7c8db04800b4c99479f5156def1aabd7d171cdf752 avahi-compat-libdns_sd-0.8-15.el9.x86_64.rpm 4fcb2ef345746f968b91a35437241454210d2f11ef66864ad8491e672f5811af avahi-compat-howl-devel-0.8-15.el9.x86_64.rpm 5386c9a36c8665a78310a1451a1778e3cc52b881ea1cacf5836f33c636a84189 avahi-devel-0.8-15.el9.i686.rpm 58a0e820be35fc38fb60c3e684ec07b7c23706588a0cf90ebab52e7246e9fe2f avahi-compat-libdns_sd-devel-0.8-15.el9.x86_64.rpm 5a76259d78125f9d2bf0ae52613622e152a0d123168284eee195f18360e8c9b0 avahi-glib-devel-0.8-15.el9.i686.rpm 6fa1d7fd65acfbe31f5ce4d5610dbe1f25b5ff745916e13f324a9f62f49f8e78 avahi-glib-devel-0.8-15.el9.x86_64.rpm 8574902144dba6635bd2899bfda83c5bb505704b4fe764716ac7c8e7441ce830 avahi-compat-howl-0.8-15.el9.i686.rpm 92659fd0634b0c40d7d8eee214ee52d2e56360cfa9debe069fb7b662da12e4fa avahi-compat-howl-0.8-15.el9.x86_64.rpm e07990c8bec3e762605412b7494fd154cc5ef82ba9991a7c32fafb986dc7c3e4 avahi-compat-libdns_sd-devel-0.8-15.el9.i686.rpm e6958c6dc34752a395cd1d57393af9f02b92ab6c4896ccb8a2b86cd61a6e2358 ALSA-2023:6712 Copyright 2023 AlmaLinux OS 0 1 Moderate

python-wheel security update

Wheel is the reference implementation of the Python wheel packaging standard, as defined in PEP 427. Security Fix(es): * python-wheel: remote attackers can cause denial of service via attacker controlled input to wheel cli (CVE-2022-40898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default python3-wheel-wheel-0.36.2-8.el9.noarch.rpm 3d0309b1e2967adc653729a9f88ae803d2b08b950de795181354f1390ee081c9 python3-wheel-0.36.2-8.el9.noarch.rpm 3e81c4451b2cefe7a23125e40c7b73abefee7630a64b19b57cce91adb41850a0 ALSA-2023:6732 Copyright 2023 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: GhostPDL can lead to remote code execution via crafted PostScript documents (CVE-2023-43115) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libgs-devel-9.54.0-14.el9_3.i686.rpm 46c21b519343298eb782520009ef45ada03606c620d43b70d4a1a179a3cb9790 ghostscript-tools-printing-9.54.0-14.el9_3.i686.rpm 7dc7f14e08026ba8d5dc45859462ff878f042392148fbf4721c952db2f0f4697 ghostscript-tools-fonts-9.54.0-14.el9_3.i686.rpm b403034325b0898c23236e19e67ead2e8b3a1a15d86cf6c43adbf78e7029941a ghostscript-9.54.0-14.el9_3.i686.rpm b9192be3a2087b0e1dd36cc1ddc84e9180715a69ee27b5dff808bd2073815f54 libgs-devel-9.54.0-14.el9_3.x86_64.rpm c33754480a48ce424a40c2bffb5da81c7fd7580ad412d8179a1971b4525283c0 ALSA-2023:6738 Copyright 2023 AlmaLinux OS 0 1 Moderate

java-21-openjdk security and bug fix update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Additional validity checks in the handling of Zip64 files, JDK-8302483, were introduced in the 21.0.0 release of OpenJDK, causing the use of some valid zip files to now fail with an error. This release, 21.0.1, allows for zero-length headers and additional padding produced by some Zip64 creation tools. With both releases, the checks can be disabled using -Djdk.util.zip.disableZip64ExtraFieldValidation=true. * A maximum signature file size property, jdk.jar.maxSignatureFileSize, was introduced in the 20.0.0 release of OpenJDK by JDK-8300596, with a default of 8 MB. This default proved to be too small for some JAR files. This release, 20.0.1, increases it to 16 MB. (AlmaLinux-14954) * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-14962) * Installing the same java-21-openjdk-headless package on two different systems resulted in distinct classes.jsa files getting generated. This was because the CDS archive was being generated by a post script action of the java-21-openjdk-headless package. This prevented the use of the dynamic dump feature, because the checksum in the archive would be different on each system. This release resolves this issue by using the .jsa files generated during the initial build. (AlmaLinux-14946) * The /usr/bin/jfr alternative is now owned by the java-21-openjdk package. (AlmaLinux-14959) * The jcmd tool is now provided by the java-21-openjdk-headless package, rather than java-21-openjdk-devel, to make it more accessible. (AlmaLinux-14948) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default java-21-openjdk-headless-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 2d43898d83aec06facd032e102469db262adb93b964fa8be8625360d0f4f0fa2 java-21-openjdk-static-libs-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 30f321fb7f5a729ed36bfb952275eb36271c7aa39b1703f4b215b40f55976f17 java-21-openjdk-devel-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 64f57c91b1417d864e9ddc4dd5e93b59ab03adf35c7ea5d0c668faaf11c208b0 java-21-openjdk-devel-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 6c499ea877cf384cdb45a9110da60a5a9fea798af5fd011618c10189061008e0 java-21-openjdk-headless-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 763bac0abc050b00a97f2ac6bb78ecbb1c46b54d3e49d166e4289975e8b8fde8 java-21-openjdk-static-libs-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 7b4a5f8dd6128f6c2e10f7a09b0cbf429e2a9fef1eafd6c8786dd59405fd89fb java-21-openjdk-demo-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm 893fbc988786c9b7399f596010e9c1c724042f5f363ca0973ecad28c53135790 java-21-openjdk-jmods-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm ad87c4c5579d98052063278aeb0c9f4c0c6be45b8885787c044f1d1e74e9006c java-21-openjdk-src-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm af4a72007ee18fb4b418587da9bcfcd3eb8b00a472f8079e8cff6ca0c9352644 java-21-openjdk-jmods-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm c99738232e3c07f6c0e9d0b04d9eecd9cc87e3c77ddad9f11082c933e993a8f8 java-21-openjdk-src-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm ce46df82b0ea2d007dcfe45e04c56dbc8addf93a41bd05d8888bd5eef52fba4b java-21-openjdk-demo-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm da761e14689236af48c735093aa494b3b8b7f33d5ca88bd18004edbba1d0621f java-21-openjdk-fastdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm e5291c5f0c27a1ad5de957d8ac11e4efa18cb788f74b52e80a0ba07bd749d032 java-21-openjdk-slowdebug-21.0.1.0.12-2.el9.alma.1.x86_64.rpm f6fbe1dd981bc0af27737ce95fd262de8bf2477fbc6a9c04625e3f98331b9d27 ALSA-2023:6744 Copyright 2023 AlmaLinux OS 0 1 Moderate

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: smbd allows client access to unix domain sockets on the file system as root (CVE-2023-3961) * samba: SMB clients can truncate files with read-only permissions (CVE-2023-4091) * samba: "rpcecho" development server allows denial of service via sleep() call on AD DC (CVE-2023-42669) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default libsmbclient-devel-4.18.6-101.el9_3.alma.1.i686.rpm 0b77d6550a227c2254150e98ed6e58b5b3a43c1943818a48f2203ba2ce885556 libwbclient-devel-4.18.6-101.el9_3.alma.1.x86_64.rpm 13fd164ae492433b673a3521071e8078f0bf6090551a26ed48ad7dc93cea0fd4 libnetapi-devel-4.18.6-101.el9_3.alma.1.x86_64.rpm 299b81c200878b67112aaa5651427b58feb49e971706e54ad4c4e1b772879cbd python3-samba-test-4.18.6-101.el9_3.alma.1.x86_64.rpm 30feaacfe6c3dbc47d7093830b2ac65e6853a852559a7dc8c1fc883e2666935d samba-test-4.18.6-101.el9_3.alma.1.x86_64.rpm 72e5268c9c477fd5e7b0154132bc6814a58ad4aea122e7f7fc6a41347316357a libnetapi-devel-4.18.6-101.el9_3.alma.1.i686.rpm 78b32722c9bfc0c0f72994e6395923c7e763d7b9c84c71719d50916afdf9e8dd libwbclient-devel-4.18.6-101.el9_3.alma.1.i686.rpm 9583f06cf2f202fd19217ecab970bfbf51fc9cc727b96fbebff6f5306025f409 samba-pidl-4.18.6-101.el9_3.alma.1.noarch.rpm a354085fbc28e8f451498a06fa2c351712ff1a40a027007331bfc331b30c9272 samba-test-libs-4.18.6-101.el9_3.alma.1.x86_64.rpm b2ea8249d5bde41fd5fe5e0ddeafe19042587657a490f7ac6b15c35fb6b5e977 samba-devel-4.18.6-101.el9_3.alma.1.x86_64.rpm b91e4b21bf689829ef3e85146120abff502204270d10e39ef3ce372d4df0b73e python3-samba-devel-4.18.6-101.el9_3.alma.1.i686.rpm dcefcd05712130c8d62025cdf583d6e7fd6fdc657665ef230f0a0e6a069571b1 python3-samba-devel-4.18.6-101.el9_3.alma.1.x86_64.rpm e08af2b5ea7a6f85e5f0f23fab9f03bee49e02575cac38e9847bb3efc4906bdd samba-devel-4.18.6-101.el9_3.alma.1.i686.rpm f838e5647f383c8da68898f6bdd726d3e27334eac813a26d2841ba48ae23d0fc libsmbclient-devel-4.18.6-101.el9_3.alma.1.x86_64.rpm fca76449ff2bf930fc4994be16c998bb47445988b4a3f221e4e9d94bc05da1ca ALSA-2023:6746 Copyright 2023 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_2_default nghttp2-1.43.0-5.el9_3.1.x86_64.rpm 2bde5de5b928091efbc7d74f61f002b4276d5aa1acbfcbb8d3d78a2533a8ee32 libnghttp2-devel-1.43.0-5.el9_3.1.i686.rpm 7641771f23ec85bbc35220eb12d11fb59ce3eaad791a53aff950dcb2240b0d44 libnghttp2-devel-1.43.0-5.el9_3.1.x86_64.rpm b7b9f36fcecddae9a8130ab1dd30b9c8841db1700956bcaaa9291320a24ced6a ALSA-2023:7253 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.100-2.el9_3.x86_64.rpm 48943f8d54aedf3a4289df01a9f04c96e1fe72e374b819f08ed0a2c3b9ab2bbc ALSA-2023:7255 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.114 and .NET Runtime 7.0.14. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.114-1.el9_3.x86_64.rpm adeb4c31399a9ec82f9de27cf189ff89671c5d267ea6a06240e579686483e019 ALSA-2023:7257 Copyright 2023 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.125 and .NET Runtime 6.0.25. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) * dotnet: ASP.NET Security Feature Bypass Vulnerability in Blazor forms (CVE-2023-36558) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.125-1.el9_3.x86_64.rpm f27498262d5ecc5b374c1fa4d0d07b886f4fca1f4ee4bd60c09bc03b4ab6733e ALSA-2023:7784 Copyright 2023 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868) * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417) * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default postgresql-server-devel-13.13-1.el9_3.x86_64.rpm 278232fd361d6afde77b1d42464bc6f1e1058005ba1e7ebbfc7c4b228c541f30 postgresql-private-devel-13.13-1.el9_3.x86_64.rpm 3508a3c5d8b39963f40a83d81d05ebfe997d98107ce245d2ea8beb225647f34a postgresql-test-13.13-1.el9_3.x86_64.rpm 4fa83a5a050884f43b98e9e1cd3e8cadb7cacc9919a29deea1213ec1d488aea4 postgresql-docs-13.13-1.el9_3.x86_64.rpm 7926030a231762f0fcbc2a979a73b08f9b09f4868a2fd64dba133c8b974a59c8 postgresql-upgrade-devel-13.13-1.el9_3.x86_64.rpm c8bfa920d6767af9a29c8507df5045347e85035bc2bb0cd908b49ae34478b211 postgresql-static-13.13-1.el9_3.x86_64.rpm f84ec245ccd018164cc05f04eb1a7a20b950f90a7a7e8ed2153765c55fd10142 ALSA-2023:7791 Copyright 2023 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: AV1 codec parser heap-based buffer overflow (CVE-2023-44429) * gstreamer: MXF demuxer use-after-free vulnerability (CVE-2023-44446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default gstreamer1-plugins-bad-free-devel-1.22.1-2.el9_3.x86_64.rpm 17ca22d84b6ddd9a2b2eb879db9a848c56645a3931f6ed220791eec3e3df514b gstreamer1-plugins-bad-free-devel-1.22.1-2.el9_3.i686.rpm 5c58e5c39390bd6e8cf2e604533df3a148ce0a9f47716cb244888b3be6115f0f ALSA-2024:0141 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: Invalid CSRF protection (CVE-2023-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default python3-ipatests-4.10.2-5.el9_3.alma.1.noarch.rpm 68d1ad015ab26a9ad0dbf8959a913b4646f9c03e6148457726c5c1540c1443b8 ALSA-2024:0151 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.115 and .NET Runtime 7.0.15. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.115-1.el9_3.x86_64.rpm 4eab6b76b0646a222a6deeda382f057b30a87ccb16a6dc1ed9adbd61cc7c61d2 ALSA-2024:0152 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.101 and .NET Runtime 8.0.1. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.101-1.el9_3.x86_64.rpm c582f238d384cc6e1b94ee631c3b9d3007d2d091d0e1b1ac0fafdfbc99d27d0d ALSA-2024:0156 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.126 and .NET Runtime 6.0.26. Security Fix(es): * dotnet: Information Disclosure: MD.SqlClient(MDS) & System.data.SQLClient (SDS) (CVE-2024-0056) * dotnet: X509 Certificates - Validation Bypass across Azure (CVE-2024-0057) * dotnet: .NET Denial of Service Vulnerability (CVE-2024-21319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.126-1.el9_3.x86_64.rpm 7426a08055620e9f508864b01f0bb7d96992ee38256d7aaa88c75ea9356a6904 ALSA-2024:0249 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-21-openjdk-jmods-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 017f1352dabb42f9326bbe09151786c11cdcc978dc2df9bbe7c95afeeadc8eb7 java-21-openjdk-devel-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 06ca3d6b00657b4027b3ae79e6b53f365f65ad9598680c862b49dd2450a25812 java-21-openjdk-headless-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 08792312dc748dc985542d89a9cbb811e29f7718c21928874e8968012b38e570 java-21-openjdk-devel-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 09dc302860921f0c4ac5f787c8be5ccb1bed573ff54aa1ee0e840073406eb4cf java-21-openjdk-static-libs-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 34590646dc82df83bcf6012a4c2bd92acbda7efe3dbb79c5d5d9bc4707692f48 java-21-openjdk-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 45ff747ff6cf29198f8167cb9864a0dbe06203ed569a26b921893717321e3b6f java-21-openjdk-jmods-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 5f38ed6e2e1ba4b6cc7a40aa8bb9217408d814fdbbc9d1d9150da8a05683bb20 java-21-openjdk-headless-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm 73a6f8fd4f769f54d2be4fc60fd011b1579cd0864fe1ab654b1589b346a94159 java-21-openjdk-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm b6851f6a3a59e05a41f54892eb011fef49b7bf0de5146029e0e4b6f3c240aaa2 java-21-openjdk-static-libs-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm bf0b8b507030656cd26fe3203334b555e793f2cb24d16e02997a25adaddd2af5 java-21-openjdk-demo-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm bf0c18134560cf4d88d9e0e7c87b7de205759839ac60f62976616fb3e0465dd6 java-21-openjdk-src-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm c5d0f9653484a471ecf6bd5b7103ba5f65df8c4388a47de697c29fdf5bd80137 java-21-openjdk-demo-fastdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm ea0b056941d86b8b5f6fa1275fdb90096a6681671d752a3fd6a93f8b4ca7e185 java-21-openjdk-src-slowdebug-21.0.2.0.13-1.el9.alma.1.x86_64.rpm f82d144bb1fd5b78e24bdd93b4ff08c77bbe2cfc641f2fd3ead0919b6b9cdb1b ALSA-2024:0265 Copyright 2024 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security and bug fix update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In the previous release in October 2023 (8u392), the RPMs on AlmaLinux 8 were changed to use Provides for java, jre, java-headless, jre-headless, java-devel and java-sdk which included the full RPM version. This prevented the Provides being used to resolve a dependency on Java 1.8.0 (for example, "Requires: java-headless 1:1.8.0"). This change has now been reverted to the old "1:1.8.0" value. (AlmaLinux-19636, AlmaLinux-19637) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-1.8.0-openjdk-src-slowdebug-1.8.0.402.b06-2.el9.x86_64.rpm 113f8d2de8f957da52fbf0903d56ac8da397a0c23ab84c3eaddf9524ccb97515 java-1.8.0-openjdk-devel-slowdebug-1.8.0.402.b06-2.el9.x86_64.rpm 1995d36a37b6ca2ebcacf15f9ef3043c02fcc2c6135765351d8c2d2ee01cc260 java-1.8.0-openjdk-headless-slowdebug-1.8.0.402.b06-2.el9.x86_64.rpm 3f5744ad88d7dc7e800fedfd7f9475a83792d6acfc414a2f000096b7a72e0c77 java-1.8.0-openjdk-fastdebug-1.8.0.402.b06-2.el9.x86_64.rpm 438749a7579127927c688cd9064a1b157a50c3d6b785c172a26e4e3b3a0a5843 java-1.8.0-openjdk-demo-fastdebug-1.8.0.402.b06-2.el9.x86_64.rpm 5026ed62afd68ec719d0489aa705400a1e5d05055cb13136d563139ec14608d9 java-1.8.0-openjdk-src-fastdebug-1.8.0.402.b06-2.el9.x86_64.rpm b7438de692cfe6979e07322c5eae8df939feb65e920c03561f42530eac344ba0 java-1.8.0-openjdk-slowdebug-1.8.0.402.b06-2.el9.x86_64.rpm bb23d58e38ffddaa9a0b7664ebf8da59daa043beec33b6a99e9e562a8f9dd779 java-1.8.0-openjdk-devel-fastdebug-1.8.0.402.b06-2.el9.x86_64.rpm c271c4bcefc83aed544326858d36ecc624153ce26c3890086c31e6808d16c362 java-1.8.0-openjdk-demo-slowdebug-1.8.0.402.b06-2.el9.x86_64.rpm eff454859dee1e50f4ad0747db71f17b53a607cf660071bc35b05efbaeba7c14 java-1.8.0-openjdk-headless-fastdebug-1.8.0.402.b06-2.el9.x86_64.rpm fa1d4b3feb96b3b47fafc3f1d8f86ead8629fd7a64cfbd6abaa7418cb9fdd4c9 ALSA-2024:0266 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: arbitrary Java code execution in Nashorn (8314284) (CVE-2024-20926) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-11-openjdk-jmods-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm 216fd3ab8ebe4b123e6ff868ec7e364c1fe52ddb5a44e9e1bfc53f66e4f09872 java-11-openjdk-headless-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm 3546ff7bd48dd35b6e72422b0c1945f655ab0b331ace47f32c11236a42363aaa java-11-openjdk-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm 651dae5e522eed33626dca5b0a418d5a421e4461e2d343397ae81eb39bd0c0fe java-11-openjdk-demo-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm 6793908a8274823d75edb57fbd3d09bdded5c40d645a40980dd1ab08dbb614a8 java-11-openjdk-devel-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm 704b926b979f43d48d455191e2c46489e4217b84f43e3c966e383bcf4fca8546 java-11-openjdk-devel-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm 723fefc75b235c43065436eef150ac290b21f6420e4a496452a4501d664f9986 java-11-openjdk-src-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm 7696b473138e07d971cc5a270d63c8d414ee6f6487f337ae208b9323d73d7448 java-11-openjdk-headless-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm 9b7e61c8cf9d9af55de38e97dc2a8f4b7181073f61ec719e7e446629f7b02aad java-11-openjdk-demo-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm 9e6f4cf4e4bd418aa323eba777d50f4a842376ee28731f15c4ee45a6f39f017c java-11-openjdk-static-libs-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm a25ad6e1715a7fd478b7f553807c6bc212cfd0f1b32efbde995ea332ecd584df java-11-openjdk-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm a66433b998ff513b26bfbd25937fc3bf6070b6e24af1855a5a318b8b0ad31df7 java-11-openjdk-jmods-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm ac8b2e179b43eefeb29d6d99c429e1bad37fac526b6e46b1e654beadebd4395b java-11-openjdk-static-libs-slowdebug-11.0.22.0.7-2.el9.x86_64.rpm cd6f027b4078f6b4cdaa2eeabda8283efa90fc1281e2be8a5ea829325673ab0c java-11-openjdk-src-fastdebug-11.0.22.0.7-2.el9.x86_64.rpm f96c31ff45f5b8b2f26b21722651b1aaf876bd2b6640b786b6e5cc19c1e45b7e ALSA-2024:0267 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: array out-of-bounds access due to missing range check in C1 compiler (8314468) (CVE-2024-20918) * OpenJDK: incorrect handling of ZIP files with duplicate entries (8276123) (CVE-2024-20932) * OpenJDK: RSA padding issue and timing side-channel attack against TLS (8317547) (CVE-2024-20952) * OpenJDK: JVM class file verifier flaw allows unverified bytecode execution (8314295) (CVE-2024-20919) * OpenJDK: range check loop optimization issue (8314307) (CVE-2024-20921) * OpenJDK: logging of digital signature private keys (8316976) (CVE-2024-20945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * When Transparent Huge Pages (THP) are unconditionally enabled on a system, Java applications using many threads were found to have a large Resident Set Size (RSS). This was due to a race between the kernel transforming thread stack memory into huge pages and the Java Virtual Machine (JVM) shattering these pages into smaller ones when adding a guard page. This release resolves this issue by getting glibc to insert a guard page and prevent the creation of huge pages. (AlmaLinux-13930, AlmaLinux-13931, AlmaLinux-13934, AlmaLinux-13935) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-17-openjdk-headless-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm 06b95661e28953d9e06521e6c44c1e620b2e7e50d97738b4f5c0a0ac02a5309b java-17-openjdk-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 10c885e2f03a85d156c1a14cfc450cca34fffd5634601c9caf5a950e73b643c6 java-17-openjdk-demo-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 1cf2b090b54c8027d1eaaf4baffdf915a4ef39371e5cae4b94a741d42411c12f java-17-openjdk-headless-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 1e75e141efcc9469e83149458f8e5c6b2a75b35558c7ad944130fbaaa971b1be java-17-openjdk-static-libs-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 2f03aad58d7f0f3c81b2dd706598897b14310b497c28ce51f71b05fde41275de java-17-openjdk-src-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 52b89a4693851a00900c261f5a7df4599387741bb2b20468cfbbce88699d202f java-17-openjdk-devel-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 60c6b2ee029ed0adfe567d391effacc2153a6b337465713e868766ec80a095dd java-17-openjdk-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm 60d78eab4a0460e4a39e578a190dc33ea3498b451790a410f6625e79546b5918 java-17-openjdk-devel-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm 60f18d1e53a8ed4e4f5217666163f3213787ee48a256639d9356e020ab1eb3cf java-17-openjdk-static-libs-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm 7e5735227a3d75e0b35df3d50c3c9e9a01b86c434771064588b76a9f2a0ae9ea java-17-openjdk-src-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm 89c88a8a965f71200045ca7f43882c4580d58fa8b7f03aa2d62a24e2845abb48 java-17-openjdk-jmods-fastdebug-17.0.10.0.7-2.el9.x86_64.rpm 8bc9a20ea2451ef330b6783de57a83f22f11f839b5dc1600ff33e98a027d5c11 java-17-openjdk-jmods-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm b6ea74505394b2e5128736cb0f7d6ebebcaa1aa8e906f3bd084de5190bcefdd1 java-17-openjdk-demo-slowdebug-17.0.10.0.7-2.el9.x86_64.rpm f41d2faaa762f6e43944e9f58e2360ff995efc3d1b8767b64ec85031edbaffb1 ALSA-2024:0466 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default python3-idle-3.9.18-1.el9_3.1.i686.rpm 06b33e9e73ff8f1b3ab565e8c2a40aa7edc237337a0718b281ee22295833402f python3-tkinter-3.9.18-1.el9_3.1.i686.rpm 154163c3ac0e7934ebb3a1d20a0a27dbee68b32577fbac6326c711b5a9133b57 python3-idle-3.9.18-1.el9_3.1.x86_64.rpm 1a15a451ba899309ec14b2897156964bf78d5a530b16ae4e13f2b67d1418e252 python3-debug-3.9.18-1.el9_3.1.i686.rpm 33a55d2c83eabb33dcd959fa934526aeb935535c5b45939a9971e46f28345506 python3-debug-3.9.18-1.el9_3.1.x86_64.rpm 82a8c486bd70247d1a792c4048adb6beaaf905a2c84d0168064720ff377d99ac python3-test-3.9.18-1.el9_3.1.i686.rpm 9c14bfb92338937921862e5ddd5228712284591a1db29ca244ff3c07b302a801 python3-3.9.18-1.el9_3.1.i686.rpm ac10eb7c61d3ed632da4dc19d4dd0cefbaa7a397c5d09a435e4c8aba1fa5971d python3-test-3.9.18-1.el9_3.1.x86_64.rpm f47be1544c9a452a9f7a26b1e1025ba309dc3ea8314b98d93be4ab8e459e04af ALSA-2024:0805 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.116 and .NET Runtime 7.0.16. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.116-1.el9_3.x86_64.rpm 0e0976b402c2ac48f471718c940194eb20f71b15906ebc7220fbe3d6169c66d0 ALSA-2024:0807 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.127 and .NET Runtime 6.0.27. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-6.0-source-built-artifacts-6.0.127-1.el9_3.x86_64.rpm 96eda7ee31e31a452aede27796ab808389a74e0ea07c8481aa4c689182c4b1c8 ALSA-2024:0848 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.102 and .NET Runtime 8.0.2. Security Fix(es): * dotnet: Denial of Service in SignalR server (CVE-2024-21386) * dotnet: Denial of Service in X509Certificate2 (CVE-2024-21404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.102-2.el9_3.x86_64.rpm 39b8e5495d48d8da80162b013152a59b498a733419eb99ac70630be4ad527d85 ALSA-2024:0951 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default postgresql-test-13.14-1.el9_3.x86_64.rpm 5094d68cc366cdfbf27d0e5cd94e5d55c6c563fe6bcea8245e6114be1b78500c postgresql-upgrade-devel-13.14-1.el9_3.x86_64.rpm a9e2399ce64128a51d9ea8bed4c7cb47ff6a6850b5928cce87b7f1c784326739 postgresql-server-devel-13.14-1.el9_3.x86_64.rpm b2a3b87eb8ff711da1552b080b4ca1acad4c647a103711d53b1dac3a5c2ab178 postgresql-docs-13.14-1.el9_3.x86_64.rpm bd7d7252cffb0719bcd0ec8305af4cb19815c3a3378880ff0afc2ab87aee5b07 postgresql-static-13.14-1.el9_3.x86_64.rpm c355c5eb3fa8e76d3b326d1f81822b812a60668d4ad14570b8713aa5e78f76cb postgresql-private-devel-13.14-1.el9_3.x86_64.rpm d4e5e99e23eb6db26048dc11024f45d112196baba1567119247a5923a4cdeae2 ALSA-2024:0977 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind9: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.1.i686.rpm 373a9fcdd64438cb6103b47a283325d1dd447100bf35db9ade4e45d9f786693d unbound-devel-1.16.2-3.el9_3.1.x86_64.rpm e01443e46fc6d387fcf8b6a86d051f12cccea7b364c903cbeec393decb973aa3 ALSA-2024:10274 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf: Fix overrunning reservations in ringbuf (CVE-2024-41009) * kernel: USB: serial: mos7840: fix crash on resume (CVE-2024-42244) * kernel: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CVE-2024-50226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default libperf-5.14.0-503.15.1.el9_5.x86_64.rpm 3affe2d0522ea4d9473aa8bb52f7f1e900234dd330b73fa97ea990d9c6856528 kernel-cross-headers-5.14.0-503.15.1.el9_5.x86_64.rpm 54376cc82b590c84ea1f9bb3acff30574bb670dd2f09dd8f1261b86a3c6683e5 kernel-tools-libs-devel-5.14.0-503.15.1.el9_5.x86_64.rpm ee525b07d0b610377ee3d5c71a52e2c19cfbee4f985b257ae92d412d47fea3da ALSA-2024:1075 Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow in the DHCPv6 client via a long Server ID option (CVE-2023-45230) * edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message (CVE-2023-45234) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default edk2-tools-20230524-4.el9_3.2.alma.x86_64.rpm 632efcbd906141df4d146fb2fbff5e5c68214279a2b1c83514b4376367188692 edk2-ovmf-20230524-4.el9_3.2.alma.noarch.rpm 672357e5f22af5021147da1e6ea2940970361d3219b3256dc24010fdaeeb1424 edk2-tools-doc-20230524-4.el9_3.2.alma.noarch.rpm bfcb0f5d6e03f7d8b84272a53664e90bac1a421417262c4e9b2f8eefe207350d edk2-aarch64-20230524-4.el9_3.2.alma.noarch.rpm c344e31df64e7b01343cb0aed155d8145237772f7f844a227dd8eda235c3368c ALSA-2024:10791 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default postgresql-upgrade-devel-13.18-1.el9_5.x86_64.rpm 66d1a4da38806f039f2b89a98d9aee231e2e8bc4317371c13160a842fffc35db postgresql-docs-13.18-1.el9_5.x86_64.rpm 781ea4f966d0b18b86b89511db399b723e347f45ecb1aa40d7882bd8f10334d5 postgresql-private-devel-13.18-1.el9_5.x86_64.rpm 7cb99117e0357f089c699492bf607a70dec6c3b49486dd446824cc8c6c955bdc postgresql-test-rpm-macros-13.18-1.el9_5.noarch.rpm 8e7546673e90d6d2cf20b6956f17bd1e184001032394a5fb82dfcd5ef8e622ee postgresql-static-13.18-1.el9_5.x86_64.rpm b4ee588e7f502bff11a3a787519df29d9ecc177554ccc520757e3eec43c02e88 postgresql-test-13.18-1.el9_5.x86_64.rpm b838bb7b2262af1d00d4cf178d50fe987e07978ce6c154696504745e7a2c61c8 postgresql-server-devel-13.18-1.el9_5.x86_64.rpm df2147f996515e9b69b29097423db0586ea2c3d3509933d8dff1759961d3b084 ALSA-2024:10858 Copyright 2024 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default ruby-doc-3.0.7-163.el9_5.noarch.rpm 7485aeb0e6755d661e1ec91aaf7d312c6b374400a15cfc3836f7fa8b35c81c0e ALSA-2024:10939 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump (CVE-2024-26615) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: iommu: Restore lost return in iommu_report_device_fault() (CVE-2024-44994) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) * kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook (CVE-2024-46695) * kernel: net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CVE-2024-49949) * kernel: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CVE-2024-50251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.16.1.el9_5.x86_64.rpm 9e5aba6798acb057b990c17b8553f300cfd836a50f5af923c1a6a9ec605ba73f kernel-tools-libs-devel-5.14.0-503.16.1.el9_5.x86_64.rpm d132d3158989833feab247c4d68ee86ac10e07ef6ebe121bd35af55c27003fc5 libperf-5.14.0-503.16.1.el9_5.x86_64.rpm e40416c4b4208ee129c8e1102e20f086b59a00a7ef904ce355dc5d48e9cc890e ALSA-2024:10978 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Unbounded memory buffering in SelectorSocketTransport.writelines() (CVE-2024-12254) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3.12-debug-3.12.5-2.el9_5.2.x86_64.rpm 0385ae8fbce4c27e28f46186ffb60b3450c837b02fccd64466e080bef3c42192 python3.12-test-3.12.5-2.el9_5.2.x86_64.rpm 19947654deb55693d91582c083380edced79f9f4bbc6a5712969daf7d8103a44 python3.12-idle-3.12.5-2.el9_5.2.x86_64.rpm 43fd285a70dba3f33510ca2cdbee9f6267c16c54ba73bce73216c335aeeb48bc python3.12-tkinter-3.12.5-2.el9_5.2.i686.rpm 661d5649ac1a98126d8567d31f3211b6fb2627442e458c3e88064303722db972 python3.12-idle-3.12.5-2.el9_5.2.i686.rpm 72881fd2a38e779664230f0931ba45b4072c4290e1ef8e174c5ab259ac8da1bf python3.12-debug-3.12.5-2.el9_5.2.i686.rpm c50517105805490848196e7495b64b7f991fa3fe34b9d8a9bac05f6d64a015f8 python3.12-test-3.12.5-2.el9_5.2.i686.rpm eafd3df532e6b1973e2571897c3451d65db9cfacb04512abd21ebf597ed0d34b python3.12-3.12.5-2.el9_5.2.i686.rpm f1872256d04363e33e8a00a8d9a3d294749c972869b885cba935cda4b66d31a8 ALSA-2024:10983 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9:3.9.21 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) * python: Improper validation of IPv6 and IPvFuture addresses (CVE-2024-11168) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3-tkinter-3.9.21-1.el9_5.i686.rpm 10512979a0d6c78cdfc92f7ab38e9377851d7c425cd8bc9bc94d2f7f27065c6d python3-test-3.9.21-1.el9_5.x86_64.rpm 1fc35d3e4bfc4ffcc42f5caf2072f69de6bbdef45175526ef20ed0b0a1554def python3-debug-3.9.21-1.el9_5.x86_64.rpm a788edf7e63fc830ec9791036050c4b67ddacde50f3913ffc605fdc500c4b4ce python3-idle-3.9.21-1.el9_5.i686.rpm a9a8710269e0b7ab272559a6fdfb47bfa11f786a5e8419d9c2683246d3b125c5 python3-3.9.21-1.el9_5.i686.rpm b02a15f844996e94de9fee1c590d984c6de84a1e9465f9941ec91d670f664170 python3-idle-3.9.21-1.el9_5.x86_64.rpm b7e34c567c740bf42563d98caf7f1ae3da3b241e2b66d511428eefe0f95b95d1 python3-test-3.9.21-1.el9_5.i686.rpm c1e44d4495e635b89fac48da4af32f69d140e80b4c1b0c025e2c6f3a1aed43e2 python3-debug-3.9.21-1.el9_5.i686.rpm f57f8bdfad9cc77ff32f16bebdc6c0f79ec4ef544fa1a082fcc22a14ac72065f ALSA-2024:11111 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Virtual environment (venv) activation scripts don't quote paths (CVE-2024-9287) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3.11-idle-3.11.9-7.el9_5.2.x86_64.rpm 17b2479da19d2e822b7f7a090e52e2ab0eab79b97c9d43501865cd3b6fbefc00 python3.11-debug-3.11.9-7.el9_5.2.i686.rpm 1ab4d07ad6f09f0fe469412bbc0b15398505b069e7a05c036e989d684b4aff12 python3.11-debug-3.11.9-7.el9_5.2.x86_64.rpm 430e2302966d0df6f5803a2a67740b14db9d16296796e8159f6e307396dd682d python3.11-test-3.11.9-7.el9_5.2.i686.rpm 555dc0115df4dac862b1826197701c575ebe0df4386fc369bbe91b743c0599c3 python3.11-test-3.11.9-7.el9_5.2.x86_64.rpm 6a24dfa91765652e2faef29df1e3bf0cc105d31687ff07009be0245f94c175f2 python3.11-tkinter-3.11.9-7.el9_5.2.i686.rpm 88ac6b94e192bb5a29fe9edca23ead88b2887f772cae42ce3b769d5e54ca0a88 python3.11-3.11.9-7.el9_5.2.i686.rpm 8dbefb52b533ce464c8cc68baaf8110859643eb39f81f8d264d208093edafd22 python3.11-idle-3.11.9-7.el9_5.2.i686.rpm b1ca85a51b5b40564066a2c2a87e6dc351c6cfba34cd84c61b2c11f406ece862 ALSA-2024:11219 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2:20240524 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Integer overflows in PeCoffLoaderRelocateImage (CVE-2024-38796) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default edk2-tools-doc-20240524-6.el9_5.3.noarch.rpm 2b923e24eec0bc923208f279be2fa0de8f842b72a1682114e63d9f2e4b3d8654 edk2-ovmf-20240524-6.el9_5.3.noarch.rpm 78c94982627bd8d6000410fa5f470a76850f56d9d10d3b989fdf8cc767e6221e edk2-aarch64-20240524-6.el9_5.3.noarch.rpm b4113deecdfdfe37d6e0009c5471b1d36782fb5ed693b1ca0c64dfd4f940de66 edk2-tools-20240524-6.el9_5.3.x86_64.rpm bfabfbf35d7ab17c10e68264c794553864a0d4c8d0018fbc877e28ba4452e284 ALSA-2024:11232 Copyright 2024 AlmaLinux OS 0 1 Moderate

unbound:1.16.2 security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default unbound-devel-1.16.2-8.el9_5.1.i686.rpm 3d7aa0a2d464979160c7aea8ce4f610a6682097d6ee4e1a7ce7ff6d28165d556 unbound-devel-1.16.2-8.el9_5.1.x86_64.rpm fd5dab054f8adea7047fa7b8e092c686bd5c94d8c25cfe693566c820342c4089 ALSA-2024:11237 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile:1.0.31 security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: Segmentation fault error in ogg_vorbis.c:417 vorbis_analysis_wrote() (CVE-2024-50612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default libsndfile-devel-1.0.31-8.el9_5.2.i686.rpm 4961a02da0b383bf9f9e636ccbb1cead83347fcc1c235bd149b5f9e40d3992fa libsndfile-devel-1.0.31-8.el9_5.2.x86_64.rpm d11ef3b3759dc1ffd8bfd497a105623c9234249d0203a4617eff489f0892c735 ALSA-2024:11242 Copyright 2024 AlmaLinux OS 0 1 Moderate

mpg123:1.32.9 security update

The mpg123 packages contain real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2, and 3 (most commonly MPEG 1.0 layer 3 also known as MP3), as well as re-usable decoding and output libraries. Security Fix(es): * mpg123: Buffer overflow when writing decoded PCM samples (CVE-2024-10573) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default mpg123-devel-1.32.9-1.el9_5.i686.rpm 379c8e3f43f5318af9adb2187df10d1b21790e6da39914b774f925c2c5ea1b1f mpg123-devel-1.32.9-1.el9_5.x86_64.rpm e43a6cf4a538b1941fa57edca69cafa9d39c81572df919c670ac3dc3c140e221 ALSA-2024:1141 Copyright 2024 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2023) (CVE-2023-21911) * mysql: Server: DDL unspecified vulnerability (CPU Apr 2023) (CVE-2023-21919, CVE-2023-21929, CVE-2023-21933) * mysql: Server: Optimizer unspecified vulnerability (CPU Apr 2023) (CVE-2023-21920, CVE-2023-21935, CVE-2023-21945, CVE-2023-21946, CVE-2023-21976, CVE-2023-21977, CVE-2023-21982) * mysql: Server: Components Services unspecified vulnerability (CPU Apr 2023) (CVE-2023-21940, CVE-2023-21947, CVE-2023-21962) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21953) * mysql: Server: Partition unspecified vulnerability (CPU Apr 2023) (CVE-2023-21955) * mysql: Server: JSON unspecified vulnerability (CPU Apr 2023) (CVE-2023-21966) * mysql: Server: DML unspecified vulnerability (CPU Apr 2023) (CVE-2023-21972) * mysql: Client programs unspecified vulnerability (CPU Apr 2023) (CVE-2023-21980) * mysql: Server: Replication unspecified vulnerability (CPU Jul 2023) (CVE-2023-22005, CVE-2023-22007, CVE-2023-22057) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22008) * mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023) (CVE-2023-22032, CVE-2023-22059, CVE-2023-22064, CVE-2023-22065, CVE-2023-22070, CVE-2023-22078, CVE-2023-22079, CVE-2023-22092, CVE-2023-22103, CVE-2023-22110, CVE-2023-22112) * mysql: InnoDB unspecified vulnerability (CPU Jul 2023) (CVE-2023-22033) * mysql: Server: Optimizer unspecified vulnerability (CPU Jul 2023) (CVE-2023-22046) * mysql: Client programs unspecified vulnerability (CPU Jul 2023) (CVE-2023-22053, CVE-2023-22054, CVE-2023-22056) * mysql: Server: DDL unspecified vulnerability (CPU Jul 2023) (CVE-2023-22058) * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22066, CVE-2023-22068, CVE-2023-22084, CVE-2023-22097, CVE-2023-22104, CVE-2023-22114) * mysql: Server: UDF unspecified vulnerability (CPU Oct 2023) (CVE-2023-22111) * mysql: Server: DML unspecified vulnerability (CPU Oct 2023) (CVE-2023-22115) * mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024) (CVE-2024-20960) * mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024) (CVE-2024-20961, CVE-2024-20962, CVE-2024-20965, CVE-2024-20966, CVE-2024-2097, CVE-2024-20971, CVE-2024-20972, CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977, CVE-2024-20978, CVE-2024-20982) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024) (CVE-2024-20963) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jan 2024) (CVE-2024-20964) * mysql: Server: Replication unspecified vulnerability (CPU Jan 2024) (CVE-2024-20967) * mysql: Server: Options unspecified vulnerability (CPU Jan 2024) (CVE-2024-20968) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20969) * mysql: Server: DDL unspecified vulnerability (CPU Jan 2024) (CVE-2024-20981) * mysql: Server: DML unspecified vulnerability (CPU Jan 2024) (CVE-2024-20983) * mysql: Server : Security : Firewall unspecified vulnerability (CPU Jan 2024) (CVE-2024-20984) * mysql: Server: UDF unspecified vulnerability (CPU Jan 2024) (CVE-2024-20985) * zstd: mysql: buffer overrun in util.c (CVE-2022-4899) * mysql: Server: Security: Privileges unspecified vulnerability (CPU Jul 2023) (CVE-2023-22038) * mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2023) (CVE-2023-22048) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Oct 2023) (CVE-2023-22113) Bug Fix(es): * Fix for MySQL bug #33630199 in 8.0.32 introduces regression when --set-gtid-purged=OFF (AlmaLinux-22454) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default mysql-test-8.0.36-1.el9_3.x86_64.rpm 53da53582b7fbb504f9a312efadadee7f3fcb972193a208d696f8ac3273ac396 mysql-devel-8.0.36-1.el9_3.x86_64.rpm cf0d9c06e61c43e038372e20e6e9bcbc9e79e2a45ed7d92eefbb82e39ec19a3c mysql-libs-8.0.36-1.el9_3.x86_64.rpm e72fb5f6f03b1e41c4da2370d0e499c66e8d7f5646474403f56bdeb800736b17 ALSA-2024:11486 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CVE-2024-27399) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: bpf: Fix a kernel verifier crash in stacksafe() (CVE-2024-45020) * kernel: nfsd: ensure that nfsd4_fattr_args.context is zeroed out (CVE-2024-46697) * kernel: bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CVE-2024-47675) * kernel: bpf: Fix a sdiv overflow issue (CVE-2024-49888) * kernel: arm64: probes: Remove broken LDR (literal) uprobe support (CVE-2024-50099) * kernel: xfrm: fix one more kernel-infoleak in algo dumping (CVE-2024-50110) * kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125) * kernel: Bluetooth: ISO: Fix UAF on iso_sock_timeout (CVE-2024-50124) * kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (CVE-2024-50115) * kernel: xfrm: validate new SA&#39;s prefixlen using SA family when sel.family is unset (CVE-2024-50142) * kernel: Bluetooth: bnep: fix wild-memory-access in proto_unregister (CVE-2024-50148) * kernel: irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (CVE-2024-50192) * kernel: Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CVE-2024-50255) * kernel: sched/numa: Fix the potential null pointer dereference in task_numa_work() (CVE-2024-50223) * kernel: bpf: Fix out-of-bounds write in trie_get_next_key() (CVE-2024-50262) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default libperf-5.14.0-503.19.1.el9_5.x86_64.rpm 291c2afcd36f669c70284791ee74bb8cc851f6b90f7719ca392299a02a808d45 kernel-tools-libs-devel-5.14.0-503.19.1.el9_5.x86_64.rpm 3015ad1909d9371d3d2432151dbfcf051f169fbe4e95649112ca9436c6e83248 kernel-cross-headers-5.14.0-503.19.1.el9_5.x86_64.rpm 99a8a311cf3948c763402574561033822433bc4fa8b01f66a0430f6fdef0c300 ALSA-2024:1239 Copyright 2024 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default opencryptoki-devel-3.21.0-9.el9_3.alma.1.x86_64.rpm 1ac96cda28f1a0a0208346aa42350392dab45cc5efd88216eca65d2436ff4a64 opencryptoki-devel-3.21.0-9.el9_3.alma.1.i686.rpm 4bc34cc2831dad343513b25f14bd537d91f1bc209d842c1a3355c8b909a24b15 ALSA-2024:1309 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.117 and .NET Runtime 7.0.17. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-7.0-source-built-artifacts-7.0.117-1.el9_3.x86_64.rpm c618788bbbb3a7dfbbe9c38b2b85a1f2473505017f7d3a0ae380c044fbd7038c ALSA-2024:1310 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.103 and .NET Runtime 8.0.3. Security Fix(es): * dotnet: DoS in .NET Core / YARP HTTP / 2 WebSocket support (CVE-2024-21392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default dotnet-sdk-8.0-source-built-artifacts-8.0.103-2.el9_3.x86_64.rpm 4dd8a44e4e3453e7065e31534764c8baa990ba6b72be5055eba4499d07c9d4c1 ALSA-2024:1427 Copyright 2024 AlmaLinux OS 0 1 Important

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * CVE-2023-6186 libreoffice: various flaws (JIRA:AlmaLinux-20657) * CVE-2023-6185 libreoffice: various flaws (JIRA:AlmaLinux-20657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default libreoffice-sdk-7.1.8.1-12.el9_3.alma.x86_64.rpm 8c1cfb694924530b33c384cf97252b2f854d40cf4edabc48cb4d30567dc63e83 libreoffice-sdk-doc-7.1.8.1-12.el9_3.alma.x86_64.rpm ead609ef4567ff2e832fb78b2b6508eb7673f53d9fe6c3967c37c9eb16b8a64b ALSA-2024:1691 Copyright 2024 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default varnish-devel-6.6.2-4.el9_3.1.x86_64.rpm 0a3060f3236f591951b393125d87eb8abc27439a58b735be2dd0aabf45875b6e varnish-devel-6.6.2-4.el9_3.1.i686.rpm 793c3bb64f496959afee7b0353d4a1dc1d661a0c617094fa50044d44bb35a751 ALSA-2024:1750 Copyright 2024 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. The default combination of the "control-use-cert: no" option with either explicit or implicit use of an IP address in the "control-interface" option could allow improper access. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged local process to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. To mitigate the vulnerability, a new file "/etc/unbound/conf.d/remote-control.conf" has been added and included in the main unbound configuration file, "unbound.conf". The file contains two directives that should limit access to unbound.conf: control-interface: "/run/unbound/control" control-use-cert: "yes" For details about these directives, run "man unbound.conf". Updating to the version of unbound provided by this advisory should, in most cases, address the vulnerability. To verify that your configuration is not vulnerable, use the "unbound-control status | grep control" command. If the output contains "control(ssl)" or "control(namedpipe)", your configuration is not vulnerable. If the command output returns only "control", the configuration is vulnerable because it does not enforce access only to the unbound group members. To fix your configuration, add the line "include: /etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf". If you use a custom "/etc/unbound/conf.d/remote-control.conf" file, add the new directives to this file. (CVE-2024-1488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default unbound-devel-1.16.2-3.el9_3.5.x86_64.rpm 4e964e25a70fca72be9837070320265bc947a26cdbac7985b827b432e92c14ea unbound-devel-1.16.2-3.el9_3.5.i686.rpm 50e1dd3667141f1b4ce9f2041bdc42ea10e5355e9374d48e925d7d9d1debcff2 ALSA-2024:1789 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default bind-devel-9.16.23-14.el9_3.4.x86_64.rpm 1f3ab94be6710564bb101a0a53e3deb4d922032dc693d6930362555784a5606d bind-doc-9.16.23-14.el9_3.4.noarch.rpm 22ea42050319c6952320fdfdb1eb6f005290375161f8b1ae7f8089901182832f bind-devel-9.16.23-14.el9_3.4.i686.rpm 6bd599f817f7b49d1640c6cd5feb5c69a89e508b4ad4c59120b11e8208e8aad1 bind-libs-9.16.23-14.el9_3.4.i686.rpm 98c780637c10fcbd46d6fa5760530fc5b036ec2c1e95c202ca699324068bd28b ALSA-2024:1818 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-1.8.0-openjdk-src-fastdebug-1.8.0.412.b08-2.el9.x86_64.rpm 06b87df7aba16c966014707a8bca8b27a80f44ac4ecb0b4f46103bf3ebc493da java-1.8.0-openjdk-headless-fastdebug-1.8.0.412.b08-2.el9.x86_64.rpm 253015938e3492522a66062585b0401dbc85e37688eb8aa751e0573b79e77fa5 java-1.8.0-openjdk-src-slowdebug-1.8.0.412.b08-2.el9.x86_64.rpm 5f17f69bfd592345d26ce1afc276e1d1540751509d2075b3c5c8629e4f21e959 java-1.8.0-openjdk-headless-slowdebug-1.8.0.412.b08-2.el9.x86_64.rpm 72a9a6ad7479b5513dd9b241c6039996722d93e62796364ffc71d75f9fedadc0 java-1.8.0-openjdk-devel-slowdebug-1.8.0.412.b08-2.el9.x86_64.rpm 7b7653836fdb8817dc2637dd2ca5650ac02c78af6d5848beadbeb709daf961c1 java-1.8.0-openjdk-fastdebug-1.8.0.412.b08-2.el9.x86_64.rpm c02e965cf734b8a74db9da8f17a03defa0d53507dab21ee5fd196f280cd1d02a java-1.8.0-openjdk-demo-fastdebug-1.8.0.412.b08-2.el9.x86_64.rpm c3bbd51aa2f7a6670b257d48da9e3445a8fb6e0833b54d2de0ea99033c06f3c7 java-1.8.0-openjdk-demo-slowdebug-1.8.0.412.b08-2.el9.x86_64.rpm cee94166027f82f052a10ef002f381b457aa78c7cd2d3eb5022f6bebfac3cbd6 java-1.8.0-openjdk-slowdebug-1.8.0.412.b08-2.el9.x86_64.rpm d673654eacc0d932f429d6a86fb55fdbc35de13c5e1a2cba6d2f04b62deb659a java-1.8.0-openjdk-devel-fastdebug-1.8.0.412.b08-2.el9.x86_64.rpm def18f69cc7e9208d5d046432d04d9549c74a48919870c58a88ec83c03625f8b ALSA-2024:1822 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-11-openjdk-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm 039a0757a91e086da0936757bac266f22916c6db98ed36200411387ec3a4c757 java-11-openjdk-devel-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm 03d2d7c2d74d973aeca095dc0e04431f0cc3c7540dbe8d78df57088628a7b4aa java-11-openjdk-devel-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm 0b260e80d2bb6bbb4ff3962fc4a5b63bb5cdfce1e2aa38886f0616aba4dccfe0 java-11-openjdk-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm 12882e9a1683f056c12d071b6736703ebc0bfaf2385535370266ea6f053345f7 java-11-openjdk-static-libs-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm 1a8c3acf3086ed2ef7f23b033f7ade2c850ef33c686bcff3e9b24d8f4c79411a java-11-openjdk-demo-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm 4ee25f9df0a384e37ab3d9d9f82b76c3e86b96bd0258e0784fa73c44282db0bd java-11-openjdk-src-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm 58a5038f7f2989b794b747390f771f42a90c6cc069bffd434d816883593f2ba3 java-11-openjdk-src-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm 93a8099b530b677aa73bf5c7942b4ea16bd110f2fd40fd3292ceae9e4aff4bb0 java-11-openjdk-headless-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm a67c661aaa5c1fb7dd2178c191968444afca1c056e2c6da9f082fbc2d39aae40 java-11-openjdk-headless-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm dd2807b666be36c27bb5eca6946087d4a23fbce084465c7cd62e4e2ba8053c3b java-11-openjdk-static-libs-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm e76522702649d55224cd688bfe6bf508ad946d281820605f68294a5cc3e0cdd7 java-11-openjdk-jmods-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm e784d7fa7606e33b985dc02a0667046467a2a448cc4949e93ed8d8ccd0eb28bc java-11-openjdk-demo-slowdebug-11.0.23.0.9-3.el9.x86_64.rpm f0567dfa65f17293b4d025731b2781ec8fe1c9e85919481a1ac4739ae072bf62 java-11-openjdk-jmods-fastdebug-11.0.23.0.9-3.el9.x86_64.rpm f543dd67aa6c051945c8f2ae6789b3b37d251cc5e1093e154fc51eb9dc2205ca ALSA-2024:1825 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-17-openjdk-devel-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 1ed0482acde095e9774a9ab574dee900d70960caa1c227e3647aeca068cd3670 java-17-openjdk-static-libs-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 1f89ded0828e46f35df66fee35911ed96e8f3813e4da739dab2c0cd84e01fce4 java-17-openjdk-demo-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 24d467c1ac4e02769bcfeba0a16dc68b4515979543ae4290220303e5cd14ee31 java-17-openjdk-headless-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 2b6388581681ed0bcba621a3f8d53fd29fb49b8ca3fc571c96783911760fd02d java-17-openjdk-src-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 2bf783e29f7d464e2fbd411d430b26756a3344f8c92d5b4fee2d15e7a2ff5eb7 java-17-openjdk-src-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 4638ce3b40539db79197f1198ba4a3ef56a970257f7b03b83ec96c2144f80f14 java-17-openjdk-jmods-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 52931af8fa5177da28cae7d653216c05450272eba9755d03382d0505a61668b1 java-17-openjdk-devel-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 5b4b12641cd1e7cbae1d2189361a627608c8d76c7da1303cd5fde31e94cc7ccf java-17-openjdk-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 6aa729acfe4fd231e91fd287df4976a2790580f61c236ff5553c48c72fcc4fea java-17-openjdk-jmods-fastdebug-17.0.11.0.9-2.el9.x86_64.rpm 73a51f64bc1501211389a6b6739e30240a0fce4979c0adc91e72ec232deb8541 java-17-openjdk-static-libs-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 77674e77d2ae035b404b0bd0837f7a55c26564a750b1a7e6bdba37a38156d1d4 java-17-openjdk-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 872de9f1552ee7df6fb39030f11ebaa420859d648026b8bb361e5d8b781c9949 java-17-openjdk-headless-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm 9149833acc938a862ef2070766cd102463f1ea24222bdd6ae5d4df35f7c78251 java-17-openjdk-demo-slowdebug-17.0.11.0.9-2.el9.x86_64.rpm e9f4da38227d27faad4b6454bef9151894cabacbb4f4d879446768bd97164bb1 ALSA-2024:1828 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_3_default java-21-openjdk-jmods-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 12fe2f0dacab259d1b39163ebb2884c638a5bdb5afd6b62ba02647cbf4bfe5a4 java-21-openjdk-headless-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 29622a887c3666782277e0139c6007f1e59eacebd94647ab1c35b694c6e90ab0 java-21-openjdk-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 40b76f2789a3d5f28f22ac87ff8fedf904307b40ac995485968bd3f625d8d7e8 java-21-openjdk-src-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 5f9b150e72b75ffe0dd4650b1638b3d122e0877b5b7e334751d3e09da2a60cc7 java-21-openjdk-devel-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 7308c0fdf1340e12737f4810c149572a265b7cc7e89c3adffa2f789468594ff9 java-21-openjdk-devel-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 79258a39740055271e7d798a2da5bbc191c5b33f3725215b70dab86bbcf4b4b6 java-21-openjdk-demo-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 93369dc4007f46b99e9778321c90467d69d2248843a67d5199c3df21e2b023f7 java-21-openjdk-static-libs-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm 965db64cee901eab5aea54e12f8d0c2869863f368981f24ba3a497c9dca16571 java-21-openjdk-static-libs-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm a4eb51c57afd76c7af91700e70dfadd511ed552713c0a6e9add4873f9267d9e5 java-21-openjdk-headless-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm a8030951bb6981633dec8c1423ef76b26c07a3e01cf16fe9a12bd1a525992e46 java-21-openjdk-src-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm aef6b22b3667b3525e7f0db847ddf579658cfebb5e2a2c579b1665bfce789f26 java-21-openjdk-demo-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm dcf4665d3c72a6ffaaf76f68607c17476918300c4dd5332f61bfb0925ab0662e java-21-openjdk-slowdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm ecbd5bf2925f7825991e71c195cd6dcf062f6d23ffe9526d245d149f1e41034b java-21-openjdk-jmods-fastdebug-21.0.3.0.9-1.el9.alma.1.x86_64.rpm fdb015ad65cefec906305ee38f38651bdf6fb5fc95699f7ea7cf5dbc81459bff ALSA-2024:2137 Copyright 2024 AlmaLinux OS 0 1 Low

LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: a heap-buffer-overflow in raw2image_ex() (CVE-2023-1729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default LibRaw-devel-0.21.1-1.el9.i686.rpm c400fe0547812be77c77c9556f0ddaba71f600497bb2c10ab733c746685dbb6d LibRaw-devel-0.21.1-1.el9.x86_64.rpm edaaa25bed39cea251abc2b778b753ce5c041e89a9fbb6d51426ece81997b1e4 ALSA-2024:2147 Copyright 2024 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: specially crafted HTTP requests potentially lead to denial of service (CVE-2024-1481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-ipatests-4.11.0-9.el9_4.noarch.rpm d851142c22ff4c5d9ddf230430e8aced17c7f7736aaced76c0e7c45c4580cf6b ALSA-2024:2169 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty (CVE-2023-5367) * xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions (CVE-2023-6377) * xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (CVE-2023-6478) * xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer (CVE-2023-6816) * xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVE-2024-0229) * xorg-x11-server: SELinux unlabeled GLX PBuffer (CVE-2024-0408) * xorg-x11-server: SELinux context corruption (CVE-2024-0409) * xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent (CVE-2024-21885) * xorg-x11-server: heap buffer overflow in DisableDevice (CVE-2024-21886) * xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-24.el9.noarch.rpm 312de6141de8edf176752f753a27b2608f335b89d5c094f576bbb86755bd521f xorg-x11-server-devel-1.20.11-24.el9.x86_64.rpm 557e59f69b53f13e2e0c74f7d19082fb1adb48e1716761d003ab12f01024af85 xorg-x11-server-devel-1.20.11-24.el9.i686.rpm 6a61a57ae109ac1e5d172d27293c26d0cd82ff4a7c687828491ee487f58944cf ALSA-2024:2184 Copyright 2024 AlmaLinux OS 0 1 Moderate

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in src/mat4.c and src/au.c leads to DoS (CVE-2022-33065) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libsndfile-devel-1.0.31-8.el9.i686.rpm 1a7113a3e37dca16a979ebc7e3bdf5c394f5991ed061f9004deec82dc276e0f7 libsndfile-devel-1.0.31-8.el9.x86_64.rpm e06ca0a58f1cbed32ee1ce5c54e55ff32b8675f70bb232bfebaca434f277ff6a ALSA-2024:2199 Copyright 2024 AlmaLinux OS 0 1 Important

pmix security update

The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. Security Fix(es): * pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default pmix-pmi-devel-3.2.3-5.el9.i686.rpm 0a6cb2bac9b9ec4abf1e54615608e28a1697e05d63127fb6936e56b4ccd5e2ff pmix-pmi-devel-3.2.3-5.el9.x86_64.rpm 2a57f5ac0c1b1eac5a4f3b412c94098815dd6e67eb185ecadc8a3cc5a2e4c59b ALSA-2024:2204 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: Malicious NBD server may crash libnbd (CVE-2023-5871) * libnbd: Crash or misbehaviour when NBD server returns an unexpected block size (CVE-2023-5215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libnbd-devel-1.18.1-3.el9.x86_64.rpm 10fa7d213351bc4dc1450cae076b1aa1761a97c98ff45da6b040329902f059ed ocaml-libnbd-devel-1.18.1-3.el9.x86_64.rpm 825992e4a75405a84f88924f488de7f7477066870c24ef6a9b6ff76ec004fcb7 libnbd-devel-1.18.1-3.el9.i686.rpm b2b00038f00875d58991193e837506a442fa006619cc016efbb007de314041fd ocaml-libnbd-1.18.1-3.el9.x86_64.rpm e7ed3c3cc0a05c5459fa347f22558da35d8c1234ab91933bbb73c08a5eb3ea8e ALSA-2024:2208 Copyright 2024 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350) * freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351) * freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352) * freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356) * freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186) * freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567) * freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations (CVE-2023-40569) * freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589) * freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353) * freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354) * freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181) * freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libwinpr-devel-2.11.2-1.el9.i686.rpm 541068d16c9b71bc99dce43711cc4b8dc6886140bf0e69bfac0a99685014627f libwinpr-devel-2.11.2-1.el9.x86_64.rpm 9776756c2fdb90b4665f97bbf7a60eb29656a774875fdd666a9408a3b4c965b5 freerdp-devel-2.11.2-1.el9.x86_64.rpm a740f259b551fd2b37dc69429b83da4f6a2451999b86a61509562d96d1e7cb93 freerdp-devel-2.11.2-1.el9.i686.rpm b255e88908418573383ec0654bea71c36b4a4d5d8fe57e7e92bafb14e908149d ALSA-2024:2236 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: NULL pointer dereference in udevConnectListAllInterfaces() (CVE-2024-2496) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.el9_4.alma.1.x86_64.rpm 0d8eb78bde2f2f5ecd75fa37f809c647ec3481316e8c65b2d676399038321c46 libvirt-docs-10.0.0-6.el9_4.alma.1.x86_64.rpm 32ba5e848443acb56096d7f0b9cef7793bcf86cc24e3026cc125ea3f88258211 libvirt-daemon-plugin-sanlock-10.0.0-6.el9_4.alma.1.x86_64.rpm 7837ed8fe5a656b7f2faaa70008b3f6af7d60bc0f3e09a6e2655d5cc8e2a1f19 ALSA-2024:2264 Copyright 2024 AlmaLinux OS 0 1 Important

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default edk2-aarch64-20231122-6.el9.noarch.rpm 11c7381fdcf07651682bd9e85df65511cb7101453de8db5b48967987e5e6c6a9 edk2-tools-20231122-6.el9.x86_64.rpm ebca6f52208aee541c0db0f441df6f5372935278cade1c4b8c772acfa7b716cf edk2-tools-doc-20231122-6.el9.noarch.rpm fea2aecfc1c20965950c39c0c2bf9fc32aecfd41f5c952d8f00fa41a0fe43687 ALSA-2024:2276 Copyright 2024 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: incorrect integer overflow check (CVE-2023-51714) * qtbase: potential buffer overflow when reading KTX images (CVE-2024-25580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-9.el9.i686.rpm 294dbff7ef5ac36286bb9e9735da01c86b1a7dfb908c2e54925cefc4801e30ee qt5-qtbase-static-5.15.9-9.el9.x86_64.rpm e2250ea75ce57cb32dad83669ae3c42615c15554834604392368d7bdc97f7023 ALSA-2024:2287 Copyright 2024 AlmaLinux OS 0 1 Moderate

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video (CVE-2023-40474) * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (CVE-2023-40475) * gstreamer-plugins-bad: Integer overflow in H.265 video parser leading to stack overwrite (CVE-2023-40476) * gstreamer-plugins-bad-free: buffer overflow vulnerability (CVE-2023-50186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default gstreamer1-plugins-bad-free-devel-1.22.1-4.el9.i686.rpm ddc2ba5c5f7a6a4538968ac251b30eaae012c137250bc136fc00310c1ab4a21e gstreamer1-plugins-bad-free-devel-1.22.1-4.el9.x86_64.rpm ed7665908329246f7645369b2f380bcc60f2649c0bd2141747aeef391326a175 ALSA-2024:2289 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: infinite loop via a crafted TIFF file (CVE-2022-40090) * libtiff: segmentation fault in Fax3Encode in libtiff/tif_fax3.c (CVE-2023-3618) * libtiff: integer overflow in tiffcp.c (CVE-2023-40745) * libtiff: potential integer overflow in raw2tiff.c (CVE-2023-41175) * libtiff: heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c (CVE-2023-6228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9.x86_64.rpm f11d6038e4780fc2e19b4e7f6868f36273cef7b76806c1638fabe0ac08edf2b9 ALSA-2024:2292 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple (CVE-2023-27043) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-test-3.11.7-1.el9.i686.rpm 02caeec558043200d16dcd484ac34abf853299bd999be6cf30f501f5fda8bd27 python3.11-3.11.7-1.el9.i686.rpm 32d88fe045a17634bbaa57670f75c851cb15f364fb4e83c34a7af4ee391eb99e python3.11-idle-3.11.7-1.el9.i686.rpm 51390452e7b2da006f3bdcd2902fcc1d8c5806c4e520bf6c0c57c2f1afee1c95 python3.11-test-3.11.7-1.el9.x86_64.rpm 7d2f0a63095c8f51329698066620552de34854d6da153224c94381d8a5c56e2c python3.11-debug-3.11.7-1.el9.i686.rpm 7ddda7bc81af91c3053b349266e9260879967d937492c85cb2523fcab0898142 python3.11-tkinter-3.11.7-1.el9.i686.rpm 8f53dc5a45aa38ba84af37788ea4904997eb3ed32a70891b82203311d313ecbf python3.11-idle-3.11.7-1.el9.x86_64.rpm 9fec1d06a20fa1a1fbec4c34d236a09dc88ca28b581f249c9230a84296a0a4e3 python3.11-debug-3.11.7-1.el9.x86_64.rpm b01299984fe501b557b9644349c181d4bae559745513a1e85acc3dfd58a115e1 ALSA-2024:2295 Copyright 2024 AlmaLinux OS 0 1 Moderate

libjpeg-turbo security update

The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default turbojpeg-devel-2.0.90-7.el9.x86_64.rpm 56f897a00b93ba990aa99418a9de09bb2d85a492aafbc63e913489b753b9464f turbojpeg-2.0.90-7.el9.i686.rpm 6dc93bb77690081da572bbf443ac15190fa772301f7fcce5f2fd653f8e4fb575 turbojpeg-devel-2.0.90-7.el9.i686.rpm 9d5bd7da3b630c7b6febf4f06c62405f3f8e480502577bb0031c7255e0f6431e turbojpeg-2.0.90-7.el9.x86_64.rpm f5e1ceebbdcadc0a983d2ea2bd69b5c2b24dafd4c8da12cb457423d8b345e012 ALSA-2024:2353 Copyright 2024 AlmaLinux OS 0 1 Moderate

mingw components security update

MinGW (Minimalist GNU for Windows) is a free and open source software development environment to create Microsoft Windows applications. Security Fix(es): * binutils: Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfd_getl64 (CVE-2023-1579) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default mingw64-binutils-2.41-3.el9.x86_64.rpm 72e45cbcd3981e7a20160b3914ef27c331e975b920222035888a043dc9c33329 mingw32-binutils-2.41-3.el9.x86_64.rpm 941bc48380d4484ffe50ed3f6d2da059470e402f75b6b3bd6b5c18a9554c08b9 ALSA-2024:2377 Copyright 2024 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: invalid memory access at zzip_disk_entry_to_file_header in mmapped.c (CVE-2020-18770) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default zziplib-devel-0.13.71-11.el9_4.x86_64.rpm 21e5059e8fabfee4c6f6e82ab044102c367ddce86632ca5731666a5514062224 zziplib-devel-0.13.71-11.el9_4.i686.rpm 83fa538c94c89316ac4d11eb9567f0d225f68095046ffb399833c75a00e9c685 ALSA-2024:2394 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546) * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582) * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480) * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448) * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934) * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040) * kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531) * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931) * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023) * kernel: irdma: Improper access control (CVE-2023-25775) * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464) * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866) * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083) * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194) * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756) * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863) * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434) * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489) * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522) * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581) * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578) * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580) * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610) * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565) * kernel: tls: race between async notify and socket close (CVE-2024-26583) * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584) * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585) * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586) * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593) * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602) * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609) * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176) * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476) * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620) * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.13.1.el9_4.x86_64.rpm 17150f6654b3ef1c8748d37d964806836942b02eac3eb8a2b7bfa42f8a417cfe kernel-cross-headers-5.14.0-427.13.1.el9_4.x86_64.rpm 2b1280ce203fe3a224874e7a63b2c23ace1657916ea4204db2b797ec29083d66 kernel-tools-libs-devel-5.14.0-427.13.1.el9_4.x86_64.rpm 9d9d3f91549e9ad7d4b2bbc00827494c23851d057e3aaf8d813f4a209b6fb773 ALSA-2024:2433 Copyright 2024 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Reachable assertion in avahi_dns_packet_append_record (CVE-2023-38469) * avahi: Reachable assertion in avahi_escape_label (CVE-2023-38470) * avahi: Reachable assertion in dbus_set_host_name (CVE-2023-38471) * avahi: Reachable assertion in avahi_rdata_parse (CVE-2023-38472) * avahi: Reachable assertion in avahi_alternative_host_name (CVE-2023-38473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default avahi-devel-0.8-20.el9.i686.rpm 084d45f82e183f0cce73f6934eaf2d4ee7e8c0d84e73fd108625ef0e2846fb67 avahi-glib-devel-0.8-20.el9.x86_64.rpm 0b453e1fcefaa8a3d08f6eef7c66e4af4be509ce6a2587dc038768f6abef5ea2 avahi-compat-libdns_sd-0.8-20.el9.x86_64.rpm 0e5d559fa7d32b31d03a86a0288df779a779f3e1d45402c7215408f51f7c4387 avahi-compat-libdns_sd-devel-0.8-20.el9.x86_64.rpm 2b75e54bd35e1125dd046d8d19076429899e195a487e0ec71339e848116399ef avahi-compat-howl-0.8-20.el9.i686.rpm 3e4b3340b8140c0a150eb341b25b725ee7ae95452cafce235d5404e8ad34684a avahi-devel-0.8-20.el9.x86_64.rpm 520df33913f7e1ddebe413998abd77ffb1a7ee61b14860e0607685d6f086f057 avahi-compat-libdns_sd-0.8-20.el9.i686.rpm 52b09aa7f436e7a9e87df8061af12f25980b1df031001a6a81d1caf302b62722 avahi-compat-howl-0.8-20.el9.x86_64.rpm 57045d6f676ebc60c74ac1bb45b0229144220284770ee22b25a1e22ef282bbfb avahi-compat-howl-devel-0.8-20.el9.i686.rpm 66b73cadcc89351c2eb1560d550a41b2cd05a2871503349e3b9b9411d9aba280 avahi-compat-howl-devel-0.8-20.el9.x86_64.rpm aa6471ff65b4916e802b8cb9316e0004deccfedea6b32be90e8afe9326a87b68 avahi-compat-libdns_sd-devel-0.8-20.el9.i686.rpm e73ccc9ecf29ddedce58b01ead58dc2f1bee4e3ebccd60d6805d141df6569a1c avahi-glib-devel-0.8-20.el9.i686.rpm fe29f2816741db06080b635df92c269963fb78066530732e9bf32f0e2614560d ALSA-2024:2463 Copyright 2024 AlmaLinux OS 0 1 Moderate

systemd security update

The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes (CVE-2023-7008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default systemd-boot-unsigned-252-32.el9_4.alma.1.x86_64.rpm e897938f17643025bcdcf602d4a8e012be61e5f6c2b5a217c5a1d1a52a6e43ca ALSA-2024:2512 Copyright 2024 AlmaLinux OS 0 1 Low

file security update

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Security Fix(es): * file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default file-devel-5.39-16.el9.i686.rpm 53aacf5210e6bd5511f9f5da75cfe08d1e7240921a3616fa4315706fa6203627 file-devel-5.39-16.el9.x86_64.rpm c2edb53441ae3e4121b4976ec6c1e3324bb8a31de083a266cb80bdfd2a90a4f0 ALSA-2024:2525 Copyright 2024 AlmaLinux OS 0 1 Moderate

mingw-pixman security update

Pixman is a pixel manipulation library for the X Window System and Cairo. Security Fix(es): * pixman: Integer overflow in pixman_sample_floor_y leading to heap out-of-bounds write (CVE-2022-44638) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default mingw32-pixman-0.42.2-3.el9.noarch.rpm 07603021a28859b36aeb48c4aa15c5b96743dca186a9a556f8c044dac95fcd40 mingw64-pixman-0.42.2-3.el9.noarch.rpm c2fbf33dbc77425cba74765e158b8483b31db258b2cb1a90921a590dcad78825 ALSA-2024:2528 Copyright 2024 AlmaLinux OS 0 1 Low

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499) * glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611) * glib: Timeout in fuzz_variant_text (CVE-2023-32636) * glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default mingw64-glib2-static-2.78.0-1.el9.noarch.rpm 206020896cc3cf20421ed70865dbd9343ffff98194f87c6476e42df03c6eee2d mingw64-glib2-2.78.0-1.el9.noarch.rpm 839339f8fd55dc4c85f77df9117e90bd5bd6fbff613ab09d91ce207d269b3d10 mingw32-glib2-2.78.0-1.el9.noarch.rpm cff64d89762143bbf988c66a8e8ac3d7ed2220331371a1261ea6f7fd78d3aa8f mingw32-glib2-static-2.78.0-1.el9.noarch.rpm e2fd3c66e44f228a14f348af913e612cef7c65e18358d7dcc0e1f4f74eef3e4c ALSA-2024:2551 Copyright 2024 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) Bug Fix(es): * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default bind-libs-9.16.23-18.el9_4.1.i686.rpm 51a338667417c99dafbe529b2e73c5bf5bf3dfc927946cf0f1169d5e1e9411e9 bind-devel-9.16.23-18.el9_4.1.i686.rpm 869c3ff51f30f39bbaabb7aeb8d0d45994499842bfdd1faba3d8659001148859 bind-devel-9.16.23-18.el9_4.1.x86_64.rpm e51ef145e049cb39beca061e774b1ce871a9705684ab10faadc47d494db11db3 bind-doc-9.16.23-18.el9_4.1.noarch.rpm f79829629665932a43bcf0575918edac6feb3858caced0cd6b7d9228d46c6ec4 ALSA-2024:2560 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security and bug fix update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441) * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() [almalinux-9] (JIRA:AlmaLinux-25081) * libvirt: negative g_new0 length can lead to unbounded memory allocation [almalinux-9] (JIRA:AlmaLinux-29515) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.2.el9_4.alma.1.x86_64.rpm 17620a7bcf965e97731b6586d2ad51697e2b488961c944ce316119e2a91c6346 libvirt-docs-10.0.0-6.2.el9_4.alma.1.x86_64.rpm bf2536b62a63e2a709cb5a3c6f9c6a157483c160200302523fc01d4c75ad316d libvirt-daemon-plugin-sanlock-10.0.0-6.2.el9_4.alma.1.x86_64.rpm de3d7da944563e4d7e96d36a07fa6777d96fdeea6fa769beedd814d16cbd2c12 ALSA-2024:2571 Copyright 2024 AlmaLinux OS 0 1 Moderate

sssd security and bug fix update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758) Bug Fix(es): * socket leak (JIRA:AlmaLinux-22340) * Passkey cannot fall back to password (JIRA:AlmaLinux-28161) * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (JIRA:AlmaLinux-27209) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libsss_nss_idmap-devel-2.9.4-6.el9_4.i686.rpm 55b2e07ce7642d30f86b0913c111149b1010f7cced2a8bda22b417436f07fd10 libsss_nss_idmap-devel-2.9.4-6.el9_4.x86_64.rpm d4a47fa1b0cbde1792ea2086a44c9e2890dea809af79173f319434a63a030861 ALSA-2024:2758 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240) * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-SN-3008,CVE-2024-25742,CVE-2024-25743) Bug Fix(es): * ffdhe* algortihms introduced in 0a2e5b909023 as .fips_allowed=1 lack pairwise consistency tests (JIRA:AlmaLinux-27009) * mm/mglru: fix underprotected page cache (JIRA:AlmaLinux-29235) * [EMR] [TBOOT OS] SUT could not go to S3 state with AlmaLinux 9.2 Tboot OS One CPU return -16 running BUSY (JIRA:AlmaLinux-29673) * system hangs completely - NMI not possible (JIRA:AlmaLinux-30678) * ice 0000:6f:00.0: PTP failed to get time (JIRA:AlmaLinux-30110) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.16.1.el9_4.x86_64.rpm 20ae29795e2433fc0dcd5cce8eb04eac770a7f8be8fe485befdb367aa31f52ea libperf-5.14.0-427.16.1.el9_4.x86_64.rpm 9c9c816cdddb8656e7494a54a04545abb473c851b5fcd56ca24e765b7e6faa03 kernel-cross-headers-5.14.0-427.16.1.el9_4.x86_64.rpm aace99b7a2ad3ba3e2977b27a30e99c197b0ed36da768bfdd6bc9f47f4f3a3e7 ALSA-2024:2842 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.105-1.el9_4.x86_64.rpm 7eb65867521581e372be20c13bb34bac56bc86b228c02b82e75d5c5ff2941b75 ALSA-2024:2843 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 7.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.119 and .NET Runtime 7.0.19. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-7.0-source-built-artifacts-7.0.119-1.el9_4.x86_64.rpm 4949285c3af5810f86699f8361ac8a903f05cf7d19b198c5bc1c48db04006f41 ALSA-2024:3306 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.18.1.el9_4.x86_64.rpm 31871e5eb67955c2ff8d997e1447225df52ecd46621b4f19c7e077f3bdf2ef33 kernel-tools-libs-devel-5.14.0-427.18.1.el9_4.x86_64.rpm 9aa23cc5c2325f9290904c9c468508ee43cc904177156b0cb3643aa142d38183 kernel-cross-headers-5.14.0-427.18.1.el9_4.x86_64.rpm ac21577564951033a36dabecca35dc779c804213a6cefaad18cdafb0c7f3a6f4 ALSA-2024:3339 Copyright 2024 AlmaLinux OS 0 1 Important

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (CVE-2024-2961) * glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599) * glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600) * glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601) * glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default glibc-benchtests-2.34-100.el9_4.2.x86_64.rpm 246d76cc3efdd63e292c3768e31e1fa671f19f0dd89efa10979087fb0f46084c nss_db-2.34-100.el9_4.2.i686.rpm 30af3a324b0a96403ce6d7d6b14e909110bfb839e679267e26e1bd2c9af89af5 glibc-static-2.34-100.el9_4.2.x86_64.rpm 44a8e6cbe86e64b8beb795fdd774db75935763d114a7bdb7aef97ef3cdf16cc2 glibc-static-2.34-100.el9_4.2.i686.rpm 4ec5fa37b80a38991371407568656c440fba2cce0998da20d577eba3be7dc70e glibc-nss-devel-2.34-100.el9_4.2.i686.rpm 886dad0cf380fb941d9fccb784e22efbd5c7669e77dcecbeff83b48dcbea8b43 nss_hesiod-2.34-100.el9_4.2.i686.rpm a8f87ad2082f29b844f8bb1f38c8e1e610dc860e47019e06ef17d6bdec8894f3 nss_hesiod-2.34-100.el9_4.2.x86_64.rpm b8ac7307fda6be295072d9c10af7949447a440dcd67ae0ba1feab83bbf2eda72 nss_db-2.34-100.el9_4.2.x86_64.rpm e956526ded54e5de742c2fd95fc1690abb3764a2bb77951135f03d087c212181 glibc-nss-devel-2.34-100.el9_4.2.x86_64.rpm fbfd038eea47131c9f4573618145e3a796f02d446b5853ece1d4718036a54ea3 ALSA-2024:3501 Copyright 2024 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libnghttp2-devel-1.43.0-5.el9_4.3.i686.rpm 78bc22b3742a83a9ad9bce69b79b83f2d33eee1ac2f99869abcdc6fb0ecc4404 nghttp2-1.43.0-5.el9_4.3.x86_64.rpm ca448ce4b472d60167d61631d8ed1ef9d939053cd2b0ac7b80e039c7d95efd05 libnghttp2-devel-1.43.0-5.el9_4.3.x86_64.rpm f8c8486c4db8d81f78b99c08ea5386b8e25967c6b556331e966e84fefb07dcf5 ALSA-2024:3619 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.20.1.el9_4.x86_64.rpm 5638bdd977dc516275e041ffee1f5bb22a413655c0172f89d1819a6b746f1eab kernel-cross-headers-5.14.0-427.20.1.el9_4.x86_64.rpm deac5093d73a8e040d29790b4a369e823b7e7d4d72a2742eade54582792c1ab6 kernel-tools-libs-devel-5.14.0-427.20.1.el9_4.x86_64.rpm fea9741b89c5fee9a9c848f3f849d725aebc5f44595dbd359274068d2e81d273 ALSA-2024:3754 Copyright 2024 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVE-2024-2698) * freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVE-2024-3183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-ipatests-4.11.0-15.el9_4.alma.1.noarch.rpm 78a871b98a4d70c7e4965a260510e083551216826811b20ae35783e13bdd5fdd ALSA-2024:3835 Copyright 2024 AlmaLinux OS 0 1 Important

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185) * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libreoffice-sdk-7.1.8.1-12.el9_4.alma.1.x86_64.rpm 72cc8e991348521b4111021d4584447f1ebf2307fa4af7ee105e402a692b4590 libreoffice-sdk-doc-7.1.8.1-12.el9_4.alma.1.x86_64.rpm 91ccabc01d0661103e48441130cafba8e8579734cbdefc4bab9fc1879a50d849 ALSA-2024:3837 Copyright 2024 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657) * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-8.el9_4.x86_64.rpm 812c9b72d1e358437a2255567e38772b87b0164d1e79dba3bdf2f7c67bb43ba2 ALSA-2024:3838 Copyright 2024 AlmaLinux OS 0 1 Moderate

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0). (AlmaLinux-35740) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default ruby-doc-3.0.7-162.el9_4.noarch.rpm 08fa7f7a8c78fdb7c1bcc7a1c92de0956e0c4e18dc0c8953ef596a1a75bec22b ALSA-2024:3959 Copyright 2024 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default flatpak-1.12.9-1.el9_4.i686.rpm 376e378a9743b683c50ae2d4d21f665697d9462a91601b9a68e3314e63d3dc06 flatpak-devel-1.12.9-1.el9_4.x86_64.rpm 3c1c586fa45c877e9548f344a7ed5e0de8af6f4c5dc6a90b6820d387055b7ab0 flatpak-session-helper-1.12.9-1.el9_4.i686.rpm 79837d80ea163f77d419263b452169bb479ee93ff77ab60094dc6efb8ec604f0 flatpak-devel-1.12.9-1.el9_4.i686.rpm eb3a4a1b208ae7e2e220bf99853be35aba88680f59ec06f22e5e356c3aada781 ALSA-2024:3999 Copyright 2024 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: OPVP device arbitrary code execution via custom Driver library (CVE-2024-33871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default ghostscript-9.54.0-16.el9_4.i686.rpm 075bec707c9fb90302d06c6c86c16d036b00e14659f8fa306b106e82b32aef13 libgs-devel-9.54.0-16.el9_4.i686.rpm 12a61641dd2f616570b5a19f622712ecc42e6c59e3022b8378bc36aa38d93212 ghostscript-tools-fonts-9.54.0-16.el9_4.i686.rpm 19ec56d2855f91c80f23dc012693c885b2c9c644d1e50ff0061eb4b07f8ffe0f libgs-devel-9.54.0-16.el9_4.x86_64.rpm 6c3868ffdf1bd08e2abe885bebe2c6afef42d1195b3823406dc9a81808e954c5 ghostscript-tools-printing-9.54.0-16.el9_4.i686.rpm 90334f295c0825a25a8caffba1ad7ef2b87eeef4b8a89ec0bcd683bf283000fd ALSA-2024:4077 Copyright 2024 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-test-3.11.7-1.el9_4.1.i686.rpm 10b9ea6ee55c8138148bc972a9fb0ea95cbf92faf7d48b8a4472fc58896b705c python3.11-test-3.11.7-1.el9_4.1.x86_64.rpm 314ceeb0703de62f4d8c6e19a87375b0983c9e92a62f788b6f17977098a06789 python3.11-tkinter-3.11.7-1.el9_4.1.i686.rpm 39b45980d53d797f362cfc2d6b88e00ece30c3f6930847191b477d3125e788a5 python3.11-idle-3.11.7-1.el9_4.1.x86_64.rpm 85aef842d063ca9c98f605554ad3745fe5974550c271564d352697c74ab8ffdf python3.11-3.11.7-1.el9_4.1.i686.rpm 89ef3d7ba74eaa3453b132acf0f9324859cf0c69316c5ea534c22c2e30d31909 python3.11-debug-3.11.7-1.el9_4.1.i686.rpm c0d47c3734f4d582311dacdce3c0c8dc033915a53cd755aa1cd52ba2e27cbbf0 python3.11-debug-3.11.7-1.el9_4.1.x86_64.rpm d0ea13ebf0f95a51c7ed0767876c100dc06f52bbbf2dda6cf6373f560f22552f python3.11-idle-3.11.7-1.el9_4.1.i686.rpm ea560b15344b5d337f3ead988cd0f815b2e6db23a1a3683549ec8577f9b88ddf ALSA-2024:4078 Copyright 2024 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-idle-3.9.18-3.el9_4.1.i686.rpm 47d8593c9c2e9feba00849aa154ff96fb0f35791034e8e396182d9fd0a49a81f python3-test-3.9.18-3.el9_4.1.x86_64.rpm 746c1899df85315aff422344d05c6e00a209e460a147f7095f99c452c2d94ff1 python3-tkinter-3.9.18-3.el9_4.1.i686.rpm a08510f6caa3be3f3088384eb16e5a0e135fe2778277196107ce0eef617f226b python3-test-3.9.18-3.el9_4.1.i686.rpm afc9186f8f6b8bba21ea7cffa8e9c01146dba124ba0f1f5b7c9327b6621d5f39 python3-debug-3.9.18-3.el9_4.1.x86_64.rpm d2dc41880589f9ee20b090e8b2f0b7a5298545bf2a1e1b6399dd37dcd5699160 python3-3.9.18-3.el9_4.1.i686.rpm dc5c951ca40e9a4d47fcce7780765951ef1011cafdae5416859cc800af566bee python3-idle-3.9.18-3.el9_4.1.x86_64.rpm eaa0184fc895ecd56805adc4acb7a7474b22d50d8e5d65866f616295450b40fa python3-debug-3.9.18-3.el9_4.1.i686.rpm fa0b914dcae5500f1df766beab7309df2d11cacf77306c20d7765c6bf39f11ba ALSA-2024:4349 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801) * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974) * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393) * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667) * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870) * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960) * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400) Bug Fix(es): * cifs - kernel panic with cifs_put_smb_ses (JIRA:AlmaLinux-28943) * BUG: unable to handle page fault for address: ff16bf752f593ff8 [almalinux-9.4.z] (JIRA:AlmaLinux-35672) * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [almalinux-9.4.z] (JIRA:AlmaLinux-36220) * [AlmaLinux9] kernel BUG at lib/list_debug.c:51! [almalinux-9.4.z] (JIRA:AlmaLinux-36687) * ice: DPLL-related fixes [almalinux-9.4.z] (JIRA:AlmaLinux-36716) * CNB95: net/sched: update TC core to upstream v6.8 [almalinux-9.4.z] (JIRA:AlmaLinux-37641) * IPv6: SR: backport fixes from upstream [almalinux-9.4.z] (JIRA:AlmaLinux-37669) * [RFE] Backport tmpfs noswap mount option [almalinux-9.4.z] (JIRA:AlmaLinux-38252) * Isolated cores causing issues on latest AlmaLinux9.4 kernel and not functioning as desired. [almalinux-9.4.z] (JIRA:AlmaLinux-38595) * [ice] Add automatic VF reset on Tx MDD events [almalinux-9.4.z] (JIRA:AlmaLinux-39083) * [HPEMC AlmaLinux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [almalinux-9.4.z] (JIRA:AlmaLinux-34953) * bnx2x: fix crashes in PCI error handling, resource leaks [almalinux-9.4.z] (JIRA:AlmaLinux-43272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.24.1.el9_4.x86_64.rpm 9c6b6869a6000f29b7b301c4b32d15bcd662ce359958afdd7f9d7bf641ed5754 libperf-5.14.0-427.24.1.el9_4.x86_64.rpm caae346cac046b455ebbfef3cc81f8b4fd8ae03e8731bbbf2ea46ee81fed7b9f kernel-tools-libs-devel-5.14.0-427.24.1.el9_4.x86_64.rpm daa76cef1ba85056c99cc729d45fd5749c8fe7366d1df1746cc2e4d4a8469dc1 ALSA-2024:4439 Copyright 2024 AlmaLinux OS 0 1 Moderate

dotnet6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.132 and Runtime 6.0.32. Security Fix(es): * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.132-1.el9_4.x86_64.rpm 6e54639f0d01554b3454c3535362846ccf4404aac19c5c46d912458369dc046f ALSA-2024:4450 Copyright 2024 AlmaLinux OS 0 1 Important

dotnet8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7. Security Fix(es): * dotnet: DoS in System.Text.Json (CVE-2024-30105) * dotnet: DoS in ASP.NET Core 8 (CVE-2024-35264) * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.107-1.el9_4.x86_64.rpm de7a7fd059151020814acdc0a06a98f95133f6ca639badbc30ffc6713c52b4e1 ALSA-2024:4563 Copyright 2024 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-1.8.0-openjdk-demo-slowdebug-1.8.0.422.b05-2.el9.x86_64.rpm 0d15adf814326d81f21f6358f32186b44a6f573987d1ab5010e7b5c55fe240cf java-1.8.0-openjdk-slowdebug-1.8.0.422.b05-2.el9.x86_64.rpm 26aa38c1747d5083739206a32616808e714009bc0165cc1e2d837d440f65821f java-1.8.0-openjdk-src-fastdebug-1.8.0.422.b05-2.el9.x86_64.rpm 26cbf3484cdd334fe40a207a32f944fa2fce9c366960a6b5d5f4064b93952f13 java-1.8.0-openjdk-devel-fastdebug-1.8.0.422.b05-2.el9.x86_64.rpm 561b213053f7d13c4666b5854c5eec3fc058ee89c53e0604b5fef8e0db955d56 java-1.8.0-openjdk-headless-slowdebug-1.8.0.422.b05-2.el9.x86_64.rpm 999c4b2008c6101132653b4955a3d332f6ea906ab13e2381538ea3d3a2b1b571 java-1.8.0-openjdk-src-slowdebug-1.8.0.422.b05-2.el9.x86_64.rpm b3c8f6b5b8dd4bc31aa5488966893766061112a9cb55c6b830ef27c5ee0ccdf6 java-1.8.0-openjdk-headless-fastdebug-1.8.0.422.b05-2.el9.x86_64.rpm bff60427f9e9b7a737c775da0f64ccd0b3739950eb31fd17db521aa8f1ccba19 java-1.8.0-openjdk-devel-slowdebug-1.8.0.422.b05-2.el9.x86_64.rpm c8b7eb114496c8d05f8c230fe960c262ac3b2737386409bd2ebea5599e9f8be3 java-1.8.0-openjdk-demo-fastdebug-1.8.0.422.b05-2.el9.x86_64.rpm e0720d6e392959a02d12333415350d7e64786b978795a90cb9dac121444756fd java-1.8.0-openjdk-fastdebug-1.8.0.422.b05-2.el9.x86_64.rpm e0745f9da6fb36ad4baf5d19a86a590bdf4e42296492a5660feb8e09602bfd89 ALSA-2024:4567 Copyright 2024 AlmaLinux OS 0 1 Important

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Pack200 increase loading time due to improper header validation (8322106) (CVE-2024-21144) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-11-openjdk-headless-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 170cebd4679a9dcf437059ab8496e5f2ba436ccc20be1057e04c9d11e3282b11 java-11-openjdk-jmods-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 199cebfcd3b0e0fdc5f3e09abcd3fe090136f75537ca002a1a0fa77e4866cc1f java-11-openjdk-devel-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 19ba0429f8cda368caf8ae868a5515479e2d261bd08449402d562d6c66728f5b java-11-openjdk-headless-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm 1b94aeadc33c9630b93dd570a92d4c7ac02f7ed74ec80a3770f74421c6911d2b java-11-openjdk-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 58be6462b14cc60146c663c4f5983bbb4c69aa535b56ac2fa9ed56f36a5a050b java-11-openjdk-demo-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 5ac87c8477fcab0255f766c46c0acea03aed4bb6b92b729cdcc4d8b3818b72d0 java-11-openjdk-static-libs-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm 60e21cf4b0e7e61d142b6e64e4c49b16efb1adef120209527b912da6b4d57e48 java-11-openjdk-src-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm 64d429b35805050bc0db0c696d9c31315f07748ca713837f4bbf2889c431d492 java-11-openjdk-src-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm 6c00497f082b5c70ff80b992106e9e206c18cf1f3315a83a3cbfef7b64e41f18 java-11-openjdk-jmods-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm a064f26a830af570c3f7d3fe36cc8c780bdf381a8bb4583baf26eaf7d221d3bc java-11-openjdk-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm ab1d704584b785d10abd279238cddba94b5ada5fc2fbeb4e58af75f27f531f03 java-11-openjdk-demo-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm baf455d9f809ba027468f910d90ccf18c2e4c2ff307f2473c8b5546063b6121e java-11-openjdk-devel-slowdebug-11.0.24.0.8-2.el9.x86_64.rpm bed083c7badc39cba516950512adc8bbf51130b83b2be6eb5dc416c1ec102748 java-11-openjdk-static-libs-fastdebug-11.0.24.0.8-2.el9.x86_64.rpm ceac79df6ff1322b4dc2dc79a95a31b9b625242d99de8a91817716e1106880db ALSA-2024:4568 Copyright 2024 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-17-openjdk-demo-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm 1bb8901f8d59717de83ae551ea47c420e5e806efbe1c29a1555972c638d225ab java-17-openjdk-src-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm 2826fc527e3530ff9684d423d3f2153b994751ddba1483bac5e868e3f25144a1 java-17-openjdk-devel-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm 30a2dedc1b017539a8732672bfb62d5700c15bd898e9ddc595ad9054db130f62 java-17-openjdk-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm 3c2db3aefb7f75c017acf06f53d8308ead02d01c73bd127b61894d3570f57b2f java-17-openjdk-jmods-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm 405bdef43b66a6b1eb6ad007f8d88e17204b089ad401e7ee94c47008e5e44c6d java-17-openjdk-jmods-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm 4afbc844115726e36a7fe3fe5fe7e062dea0197bad7fcf32e9eda3bdc30d60ff java-17-openjdk-src-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm 6067a0d0d023d640a53eb00ef7aca98e96396d96c224c5bcbef67203b42f91d4 java-17-openjdk-demo-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm 7c64cbf9421e31215ace61d444341dcb8dc66cba3b8ddce7ded16bea81f3a640 java-17-openjdk-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm c2b44e00f38815ae8f6aab656374625f8b4b96262b43a26c3fea0b7833f7090f java-17-openjdk-static-libs-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm c8dfaeccdf3c3c848c09a513c0ce4280732f35c58d38dd95de071a69e1fd9f42 java-17-openjdk-devel-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm c90333430fb2d536679f4b5a0684b7edadca02facfd37275e365ca1db05ad954 java-17-openjdk-static-libs-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm d0f091bba64abf1c5127847788bc3ca73fdcf0d1978d0ba98922f397165474fd java-17-openjdk-headless-fastdebug-17.0.12.0.7-2.el9.x86_64.rpm e58e5f27decc3c5700a8d723525ae9e11d0e9ef3144831bb3b17191edc94eec3 java-17-openjdk-headless-slowdebug-17.0.12.0.7-2.el9.x86_64.rpm ee029bea8a1297f76282d3a67e2c047e98b7319a0f58c5a8709fef8f962efd5e ALSA-2024:4573 Copyright 2024 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-21-openjdk-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 09fbf53ade5fb3c7d38ae5381f50049223c606ed2dcc4b226df70d031f47a03a java-21-openjdk-headless-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 1d99d1be92571df05e892a21addc8ef73b72cf6c7df419d752e50ea64ef46728 java-21-openjdk-headless-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 3c77cec209cd3b9efaf655458c39e55eb14fb40254efe9e9dc13927b2536aa05 java-21-openjdk-static-libs-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 533e04c4ae0cec8e99632724d308e6ffb6072c12b5a333d3e4269d0813e4c44b java-21-openjdk-demo-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 53612ac955126f97647793776848413673daa784b5a249cce0326b6aea1ed6ac java-21-openjdk-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 564d295f6e103ce57c2f8094d3f1377319ba80e5cf1fbeb35ccdca831f1f388b java-21-openjdk-jmods-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 5f5bffab1d8b42f007f9125b431c3840dd5dd29eccbdaf6440cffa1788f8e870 java-21-openjdk-static-libs-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 76db8acd953d62b1c0e1a0f873ab29205d7d1ef037376279bc80a098896cb5de java-21-openjdk-devel-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm 93fcda14797402d7e12c31f5a438997f8f33b1e483f51c3a680fc0e4e20f4eca java-21-openjdk-src-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm a3507fb124c31cf4b829e20a927134177b9f53fdbfc17c5fa42d542d375a6da6 java-21-openjdk-jmods-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm b094d12a57bc5f47c0b9b82ccf49269a1383d0c6e0378420cbb3efc9ab11028b java-21-openjdk-demo-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm d91164fc02c16c35063294a631afe9a34f871580e110d1228e26f07733cf3aef java-21-openjdk-src-fastdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm e875284e52701b03900447aceb5bca1d4f76e5bf82ab66997d9d2925c74f8ed7 java-21-openjdk-devel-slowdebug-21.0.4.0.7-1.el9.alma.1.x86_64.rpm f079fc7c836c0569b624d5ab91322791e461704c534bd626b8c126199fc93ca2 ALSA-2024:4583 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (CVE-2024-26858) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435) * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958) * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904) * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543) * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593) * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957) * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.26.1.el9_4.x86_64.rpm 538edc28dba123c8aeb3d8cf9683533cf002ba566482519a63d8bc681a450ad9 kernel-cross-headers-5.14.0-427.26.1.el9_4.x86_64.rpm 5ba3babf7065d02b3024b8f7264feaec89165885340a49b497b0d31a6e450a96 libperf-5.14.0-427.26.1.el9_4.x86_64.rpm f827e11699434778454a55163c40f983bdc01f23a513c72e00931ce1eac73ba0 ALSA-2024:4623 Copyright 2024 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default qt5-qtbase-static-5.15.9-10.el9_4.i686.rpm 300dc8578f815ac8b9ff67740a281ab109861e8e0a215107a6b7ab1b5006052f qt5-qtbase-static-5.15.9-10.el9_4.x86_64.rpm 9a8ba0bb1f41bfceec3af86b8c26037ef72ee91cd57164ff74c330efe17a7525 ALSA-2024:4749 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * EDK2: integer overflow in CreateHob() could lead to HOB OOB R/W (CVE-2022-36765) * edk2: Predictable TCP Initial Sequence Numbers (CVE-2023-45236) * edk2: Use of a Weak PseudoRandom Number Generator (CVE-2023-45237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default edk2-ovmf-20231122-6.el9_4.2.noarch.rpm 07ab65898528b14bd133dcc29037207a0575b113ba24d06b8ec9fb9a2740a4a8 edk2-aarch64-20231122-6.el9_4.2.noarch.rpm 9a5248396531529aa0a93ef15d4a30176a9c18dced35b724cbc45a4b1e0b3784 edk2-tools-doc-20231122-6.el9_4.2.noarch.rpm c756059b460fd70f02088389aa5bc06026f457801491df61042de96189563f25 edk2-tools-20231122-6.el9_4.2.x86_64.rpm dd4851b48637abc2e8d2482693c6be271d3599f20410b809ac733744a5a5905f ALSA-2024:4755 Copyright 2024 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic (CVE-2024-3044) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libreoffice-sdk-doc-7.1.8.1-13.el9_4.alma.1.x86_64.rpm 531caa7c869750ee0959bca7a91205a846bdb7c7439856d2fde8e9d90dfa50d4 libreoffice-sdk-7.1.8.1-13.el9_4.alma.1.x86_64.rpm 6198d955f1be345d57277e74bcfcb817b81bfb8ff6152d0353fb105d8f2dd9a6 ALSA-2024:4756 Copyright 2024 AlmaLinux OS 0 1 Moderate

libuv security update

libuv is a multi-platform support library with a focus on asynchronous I/O. Security Fix(es): * libuv: Improper Domain Lookup that potentially leads to SSRF attacks (CVE-2024-24806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libuv-devel-1.42.0-2.el9_4.x86_64.rpm 8fa6da2c257bc194bad89676f6cb035d7013ed8bd439c0c3a5c0a968ffce1a28 libuv-devel-1.42.0-2.el9_4.i686.rpm ae7e16ce2e5a54b6c4eaf5a62726ae6fbbc04cd46b6ce3e5dfa47ae9888de8e3 ALSA-2024:4757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: stack use-after-free in virNetClientIOEventLoop() (CVE-2024-4418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libvirt-devel-10.0.0-6.6.el9_4.alma.1.x86_64.rpm 8cec438a1a58270cfd2c57943c3e1a4ec9a433313ace0b15e4fd49275f197c3e libvirt-daemon-plugin-sanlock-10.0.0-6.6.el9_4.alma.1.x86_64.rpm a5f8c89a230bd96d698035041ba5d5790a29cb11cf65e01ff89a411e7044acef libvirt-docs-10.0.0-6.6.el9_4.alma.1.x86_64.rpm a79b6a8606f6e12c58967db74650de75939ffb709ef26a7ab6fbfbcd22f5fc4a ALSA-2024:4766 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.3.i686.rpm 25c70954db586f15dea8c4d1bfaae5cd3df35c0eaa1a9fd00537651971d8d108 python3.11-test-3.11.7-1.el9_4.3.x86_64.rpm 3038f72121b18fecb852c2a4b9848a4186c1a10b475840baf21d4462e0cae86b python3.11-test-3.11.7-1.el9_4.3.i686.rpm 5d535d8c46abb9216e4da390de7cd12e590513b36d164e42b29d2390a9f95bb9 python3.11-idle-3.11.7-1.el9_4.3.i686.rpm 6c5824d76a60ae1b23cecfb59dc8ce378dc31d5cc324d50097827381952a8c9b python3.11-debug-3.11.7-1.el9_4.3.x86_64.rpm 8516d18d9027b95fadcabe2b0e6cc5e39b82b1faf4dea6661381c5001edd5d9f python3.11-idle-3.11.7-1.el9_4.3.x86_64.rpm d942a26aedf5326f4b1c082f7e23bf5ffae5ca74a9d254ba102d13316ade7ab0 python3.11-tkinter-3.11.7-1.el9_4.3.i686.rpm e2a19645fe3004ad527c9d1efe6d7f98a2bd00bb86019778973cdb5a794be1ce python3.11-3.11.7-1.el9_4.3.i686.rpm e8003ac5377d0d1dd9c3461115a219f5d6c5c74bfc88b938c6d061eeb21753a7 ALSA-2024:4779 Copyright 2024 AlmaLinux OS 0 1 Low

python3 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-debug-3.9.18-3.el9_4.3.i686.rpm 001b65c943c3eb1421956ec88ebca1fa342daa5b474034cf7e0ea97b61b0ccd2 python3-idle-3.9.18-3.el9_4.3.i686.rpm 8fce55a25c615fde0d73a7f4d2dfa86c757a53c82760423caae2346c14ab64b8 python3-debug-3.9.18-3.el9_4.3.x86_64.rpm a229269717a91c5230ab46e6c06ea5b1bc8a767e69fb89bd478e7897df5cf818 python3-test-3.9.18-3.el9_4.3.i686.rpm a9e5bceafa42cbb7f0fe3be35f9596bcad09d981ed8bb59c273b64ea2b86570d python3-3.9.18-3.el9_4.3.i686.rpm d73dd81c85f5926497866867abc1070bfedb2e8de7ec9a58d1ca8fe8472ca040 python3-tkinter-3.9.18-3.el9_4.3.i686.rpm e1629baf12243e895daece71fab04480ebb46bc8c692b0aa643e9d725f0ecd0a python3-test-3.9.18-3.el9_4.3.x86_64.rpm ff141a25c2dcb7c9132a534739f724a1533363bc80d19dab7a11cd8945358f39 python3-idle-3.9.18-3.el9_4.3.x86_64.rpm ff2f7322bcaa4d50b9940dc7ea9bc84e533fbc94856c792afd65d3a3edde7cdf ALSA-2024:4928 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458) * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773) * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737) * kernel: dm: call the resume method on internal suspend (CVE-2024-26880) * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852) * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) * kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046) * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030) * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857) * kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907) * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885) * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809) * kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459) * kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924) * kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952) * kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743) * kernel: epoll: be better about file lifetimes (CVE-2024-38580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.28.1.el9_4.x86_64.rpm 4411644690140bdccb9f34fb11b3933c54fa268999df6dbf520d94b3ea994f55 kernel-tools-libs-devel-5.14.0-427.28.1.el9_4.x86_64.rpm 50c208496b6d0f1d382216e76b384b71098d504094d4a916457d6e58cb950175 kernel-cross-headers-5.14.0-427.28.1.el9_4.x86_64.rpm ec6641e50d8f6c3d2ce1dada494374a275cdd891719ac5d6ea3eb61e9243b84e ALSA-2024:4935 Copyright 2024 AlmaLinux OS 0 1 Important

freeradius security update

FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: forgery attack (CVE-2024-3596) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default freeradius-rest-3.0.21-40.el9_4.x86_64.rpm 0860b7941037dc3454c6322b40765447fd8ee2a114a0ffc845b3085aaf50c454 freeradius-mysql-3.0.21-40.el9_4.x86_64.rpm 43c4df6ea9bb0cae20d1c819bf0dff91cceef115b0bebe35dc1e7b2ba2e2e62a freeradius-sqlite-3.0.21-40.el9_4.x86_64.rpm 529acd0be4bb5ba9db5c9b30c130b8d576c51e922df52caffaf3fce504c78f51 freeradius-perl-3.0.21-40.el9_4.x86_64.rpm 767a7b415bafe747529a741934edcfee8fba536c41ebcd455ebd37be641d6ab0 freeradius-unixODBC-3.0.21-40.el9_4.x86_64.rpm 76e0d1f62bbbabf3e5b0735500d22ec2cf058a649ef657fb66a443ae2d1036a3 freeradius-postgresql-3.0.21-40.el9_4.x86_64.rpm cdaa6d80f23d66de05929a4a3ec422830a6f32c5831bee93227d8524ef1c527d ALSA-2024:5192 Copyright 2024 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953) * 389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request (CVE-2024-6237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default 389-ds-base-devel-2.4.5-9.el9_4.x86_64.rpm 495f442140d399c4b7835795b06c0501e511233a790f66bcda7c29e7dcc53bc4 ALSA-2024:5231 Copyright 2024 AlmaLinux OS 0 1 Important

bind and bind-dyndb-ldap security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam (CVE-2024-1737) * bind9: bind: SIG(0) can be used to exhaust CPU resources (CVE-2024-1975) * bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content (CVE-2024-4076) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default bind-devel-9.16.23-18.el9_4.6.i686.rpm 38e6e3c495400ee6f943da0090f38a9e8fb83da7de666f843028cdf01c8ff340 bind-devel-9.16.23-18.el9_4.6.x86_64.rpm 73e1124e110710b90d3e9c1e6ebd35f03b8914a4a2a56da0487bdbfd853f7627 bind-libs-9.16.23-18.el9_4.6.i686.rpm 94a32320a66459da400592d294420be8b62ba193ec66b80b97a662354a02743d bind-doc-9.16.23-18.el9_4.6.noarch.rpm a5ec8a6da6cd1f20a2976b83bb6408fc04182069d72450b79a1f8eac28b51e2b ALSA-2024:5334 Copyright 2024 AlmaLinux OS 0 1 Moderate

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.108 and .NET Runtime 8.0.8. Security Fix(es): * dotnet: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * EMBARGOED CVE-2024-38167 dotnet8.0: Information disclosure vulnerability in TlsStream (CVE-2024-38167) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.108-1.el9_4.x86_64.rpm 0d7cd0b724d9b75848f2083c22b51247a5bf40b3b657ccadca211c3438400ede ALSA-2024:5363 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: phy: (CVE-2024-26600) * kernel: netfilter: multiple flaws (CVE-2024-26808, CVE-2024-27065, CVE-2024-35899, CVE-2024-36005) * kernel: cifs: (CVE-2024-26828) * kernel: wifi: multiple flaws (CVE-2024-26897, CVE-2024-27052, CVE-2024-27049, CVE-2023-52651, CVE-2024-35789, CVE-2024-27434, CVE-2024-35845, CVE-2024-35937, CVE-2024-36941, CVE-2024-36922, CVE-2024-36921, CVE-2024-38575) * kernel: nfs: (CVE-2024-26868) * kernel: igc: (CVE-2024-26853) * kernel: dmaengine/idxd: (CVE-2024-21823) * kernel: ipv6: multiple flaws (CVE-2024-27417, CVE-2024-35969, CVE-2024-36903, CVE-2024-40961) * kernel: vt: (CVE-2024-35823) * kernel: efi: (CVE-2024-35800) * kernel: mlxsw: (CVE-2024-35852) * kernel: eeprom: (CVE-2024-35848) * kernel: ice: (CVE-2024-35911) * kernel: platform/x86: (CVE-2023-52864) * kernel: i40e: (CVE-2024-36020) * kernel: rtnetlink: (CVE-2024-36017) * kernel: net: multiple flaws (CVE-2024-36929, CVE-2024-36971, CVE-2021-47606, CVE-2024-38558, CVE-2024-40928, CVE-2024-40954) * kernel: ipvlan: (CVE-2024-33621) * kernel: tcp: (CVE-2024-37356) * kernel: virtio: (CVE-2024-37353) * kernel: tls: (CVE-2024-36489) * kernel: cxl/region: (CVE-2024-38391) * kernel: bonding: (CVE-2024-39487) * kernel: netns: (CVE-2024-40958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.31.1.el9_4.x86_64.rpm 0998340766d7643f05eaa625dea2e7953b14ff3c76fb7dd93722b9fff1b88a02 kernel-cross-headers-5.14.0-427.31.1.el9_4.x86_64.rpm 1535b0afa480b40ab5a5f72aebab0bcdc13de62c425cb11c2330a76faf954e68 kernel-tools-libs-devel-5.14.0-427.31.1.el9_4.x86_64.rpm dd6e6478b22c43caaef11f8ad78bf3fe98dec0bc0404c706bf46df545d55665b ALSA-2024:5533 Copyright 2024 AlmaLinux OS 0 1 Important

python3.12-setuptools security update

Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.12-setuptools-wheel-68.2.2-3.el9_4.1.noarch.rpm 131b0a0f2d74e9412a6cc9f472ba83b59d41a1569d92fe31ea3e11e061212f48 ALSA-2024:5583 Copyright 2024 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: bility to trust not validated macro signatures removed in high security mode (CVE-2024-6472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libreoffice-sdk-doc-7.1.8.1-14.el9_4.alma.1.x86_64.rpm 3e4ef93e7ef789ce3902d4ff4a11a6c4a3a63ab4846fff70fc81c5597eb7a73c libreoffice-sdk-7.1.8.1-14.el9_4.alma.1.x86_64.rpm 4d534236799ca12dd3276ba2a0bdd6bbf6cc6e93ba9e8b713462023a70449de6 ALSA-2024:5928 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nftables: nft_set_rbtree skip end interval element from gc (CVE-2024-26581) * kernel: netfilter: nft_limit: reject configurations that cause integer overflow (CVE-2024-26668) * kernel: vfio/pci: Lock external INTx masking ops (CVE-2024-26810) * kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CVE-2024-26855) * kernel: x86/xen: Add some null pointer checking to smp.c (CVE-2024-26908) * kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (CVE-2024-26925) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019) * kernel: netfilter: flowtable: validate pppoe header (CVE-2024-27016) * kernel: netfilter: bridge: confirm multicast packets before passing them up the stack (CVE-2024-27415) * kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898) * kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897) * kernel: netfilter: validate user input for expected length (CVE-2024-35896) * kernel: netfilter: complete validation of user input (CVE-2024-35962) * kernel: ice: fix LAG and VF lock dependency in ice_reset_vf() (CVE-2024-36003) * kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race (CVE-2023-52771) * kernel: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (CVE-2023-52880) * kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (CVE-2024-36025) * kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608) * kernel: crypto: bcm - Fix pointer arithmetic (CVE-2024-38579) * kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (CVE-2024-38544) * kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540) * kernel: net: bridge: xmit: make sure we have at least eth header len bytes (CVE-2024-38538) * kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (CVE-2024-39476) * kernel: ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905) * kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station (CVE-2024-40911) * kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CVE-2024-40912) * kernel: mm/huge_memory: don&#39;t unpoison huge_zero_folio (CVE-2024-40914) * kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CVE-2024-40929) * kernel: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (CVE-2024-40939) * kernel: wifi: iwlwifi: mvm: don&#39;t read past the mfuart notifcation (CVE-2024-40941) * kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957) * kernel: scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978) * kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983) * kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090) * kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091) * kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041) * kernel: NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076) * kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (CVE-2024-42110) * kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-tools-libs-devel-5.14.0-427.33.1.el9_4.x86_64.rpm 13e0ee4ddef7ec39c053462f19250f043686e8deeb00267b1c68f51f4f19bb6e libperf-5.14.0-427.33.1.el9_4.x86_64.rpm 34d178d6c4e9adf64b5c8b520f7bc0c900bfcf8720f320b96492966160591e74 kernel-cross-headers-5.14.0-427.33.1.el9_4.x86_64.rpm f3b06442c2461644dac6ebf0eee436b8744182ddb67f93989739fcb2be388f12 ALSA-2024:5999 Copyright 2024 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default postgresql-server-devel-13.16-1.el9_4.x86_64.rpm 1dc3d7cbe0b8af7ba4a283a24ff37e222fbd138f3b9b34a74859bad55e368819 postgresql-upgrade-devel-13.16-1.el9_4.x86_64.rpm 25b13d542aff8f03ca0f5ead74b745713d25dd881e27ac9e69d4338849451642 postgresql-test-13.16-1.el9_4.x86_64.rpm 3665dd039b3bc93c6ac9f8bca5f30c2d74a3e37aa49758deded0d0c6c4a9545e postgresql-private-devel-13.16-1.el9_4.x86_64.rpm 54a9be63798d3b54b0c96fae58c9b44074b71bbd784b76ea61c816d1d11c2070 postgresql-docs-13.16-1.el9_4.x86_64.rpm 81cec6b8a4d2bed06193ac58516cdac7a6cf8f8decec93860e110a72ea66600e postgresql-static-13.16-1.el9_4.x86_64.rpm fb7bdc5a53ccd14bdd1a5890cc649841e9a5b882a0275ef8cdcbb29e1649026c ALSA-2024:6146 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.12-test-3.12.1-4.el9_4.3.x86_64.rpm 5aa0ba12c4ff19e4a9b7167dcfd1e189d99eb67859a9ff2682581a59ea334c0c python3.12-debug-3.12.1-4.el9_4.3.i686.rpm 6c785477a5d23e26cbbacb390b50de4aaecd9de6655592f8c6c6f86f1d93e8b0 python3.12-test-3.12.1-4.el9_4.3.i686.rpm 9a3c92f32339568b23016fc5e7a14e81d092223c1bf31200a6e323d217b3e5e0 python3.12-tkinter-3.12.1-4.el9_4.3.i686.rpm b89abb2d3ed0af397e37f355e3aac0bb81cda6acccca8d2b983dfe6846b9a9c9 python3.12-idle-3.12.1-4.el9_4.3.x86_64.rpm cd5dd2c8dd0a2fd9bcac9870c604c614a05410ca711bc94a3c476293f9407e35 python3.12-idle-3.12.1-4.el9_4.3.i686.rpm cf66e4508a2575dd98c1545fa75c885d0dff35d5178f6f2dc1d4f3e7df2e0cbe python3.12-3.12.1-4.el9_4.3.i686.rpm dd75ea8e2d8116093848743dd17c14c093613e873e9ff4ef361dd4861bb462c2 python3.12-debug-3.12.1-4.el9_4.3.x86_64.rpm fd7ae4404e12ae9f15783bfbf372a55efde8c713b293b93525402b6e18ba0db7 ALSA-2024:6163 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-tkinter-3.9.18-3.el9_4.5.i686.rpm 0ccf531b1fcda6cf51680ba11cb2d69753e15d956b208c4fef7b6585636e3b65 python3-3.9.18-3.el9_4.5.i686.rpm 26b14baae5de11d6e5d9e3ba30ddd965964993b53b30413727f637ac9a6488c7 python3-idle-3.9.18-3.el9_4.5.x86_64.rpm 2a29de465f94d63a6473cfd9b0e55379651e7e89da77535a7e92e34bd03c1a91 python3-test-3.9.18-3.el9_4.5.i686.rpm 48254a402d2f12bd4c82d1b22c86d4e161ed8765add6d04236d4b634c6665b52 python3-test-3.9.18-3.el9_4.5.x86_64.rpm 6ad8938dc8c5ea1abd688dfa6c9f014c702d4edac3f6ddf73bedfd2a173ee8d1 python3-debug-3.9.18-3.el9_4.5.x86_64.rpm 8f89404bb2faef8448484d1597f70892cead58e71feb57c70f1a0aa062f20be3 python3-idle-3.9.18-3.el9_4.5.i686.rpm d40fe8c9f18540e1d3be7e067cc94939fc9c01ed066d60322eb707c1865dd305 python3-debug-3.9.18-3.el9_4.5.i686.rpm ee9ddba28d5b73456aae4e037f116abb5c9c293eb512f63c4aa922f18ffa01c1 ALSA-2024:6179 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-debug-3.11.7-1.el9_4.5.i686.rpm 060218f02d2235fa87beea9decefde1e2ddd9345fec7909cf825b99b81ee67a8 python3.11-test-3.11.7-1.el9_4.5.x86_64.rpm 15c74f2e6ae8d7774b3426aec87cdbfd4899ba10c469476da9707ca3da6011f4 python3.11-idle-3.11.7-1.el9_4.5.x86_64.rpm 222c8275e56635a9ec572ba5811866b05979febfde9c4750c785a67c430ee3b7 python3.11-idle-3.11.7-1.el9_4.5.i686.rpm 3978e736c6647d72dbf0fd8f257c8f4e755ab00b3eddbafa5a2711f696f5bc7c python3.11-3.11.7-1.el9_4.5.i686.rpm 90749ceaa9e5617fdbcf136056d83908e2727e3258c00d455cfc76a192586e38 python3.11-test-3.11.7-1.el9_4.5.i686.rpm 9b95ca4b2c74ca91db86a17e0d4831679d70d1a92af645c79f7ee52ebf5165c8 python3.11-debug-3.11.7-1.el9_4.5.x86_64.rpm d12208d337a39cad1d740bf32f6cd64f2b6f3d34a835d2d7f3ea09f89c636577 python3.11-tkinter-3.11.7-1.el9_4.5.i686.rpm d718725ae0662eebee5bf0c50b9eaed94d594cf882b8572f0a97d5e5e14f26b5 ALSA-2024:6197 Copyright 2024 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: format string injection leads to shell command execution (SAFER bypass) (CVE-2024-29510) * ghostscript: path traversal and command execution due to path reduction (CVE-2024-33869) * ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths (CVE-2024-33870) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libgs-devel-9.54.0-17.el9_4.x86_64.rpm 0026d59c82bdc30a92d6fae83f8b40d13b60ccee890ba5610e60873d7d6901a0 ghostscript-tools-printing-9.54.0-17.el9_4.i686.rpm 56a222baf900e70d913093b0424c4e077be259c98bcbe6bde42506b453a4b292 libgs-devel-9.54.0-17.el9_4.i686.rpm 9684b7cf907e2d59952a310e0ab41f4be5bba08d604a2412a17b12612da8240e ghostscript-tools-fonts-9.54.0-17.el9_4.i686.rpm e2b72e50c3c614c95390f7fa2d8114351afd39b610b73faddfd2654cfb66ec7d ghostscript-9.54.0-17.el9_4.i686.rpm f052e075990e4621dbd763f5f4566b03c255d6a606fe98b134185d29aeac2bce ALSA-2024:6356 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default flatpak-session-helper-1.12.9-3.el9_4.i686.rpm 10ed413f8b61555e4ac8d50ad19ba04114baf5b7787a42de738fa508035f61b9 flatpak-devel-1.12.9-3.el9_4.x86_64.rpm 28774ad1da0cc77405c43b2aac91f5c39bed8d66ff3d82f8c94eb11ff29731b8 flatpak-devel-1.12.9-3.el9_4.i686.rpm 653b683e4461db2cfad73e29dd2bc15bea83fbc1016bd8fcd237eaa781d8cb72 flatpak-1.12.9-3.el9_4.i686.rpm 68bd6b216be00546c4696a9ba3dc48867c5168b674b4905471d8ce5a6de02b7a ALSA-2024:6464 Copyright 2024 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default glib2-static-2.68.4-14.el9_4.1.i686.rpm 054d3f07bde25609c06c42265cd8c93d7bd3467ef93322e0f0f38bcfe068a914 glib2-static-2.68.4-14.el9_4.1.x86_64.rpm 94b4efa61cdb9a279497502f7cb9acfe4703afd83a9beafeab94ed99a0faabde ALSA-2024:6529 Copyright 2024 AlmaLinux OS 0 1 Moderate

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dovecot-devel-2.3.16-11.el9_4.1.i686.rpm 3c02fd1b5274bbe7d993df8315ba5fa12467c371c9f0ad67fd64d1c40a4564b7 dovecot-2.3.16-11.el9_4.1.i686.rpm 6b18cc3a2eb81d23f0f033dfec9edbfaefa217280a25ea82adb1483b732fb46d dovecot-devel-2.3.16-11.el9_4.1.x86_64.rpm 71f1e54f81773cfb8437d1ccb0cd18ab4247ee2a4a85380f2b8bd05cc82f91e9 ALSA-2024:6567 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) * kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886) * kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946) * kernel: KVM: SVM: Flush pages under kvm-&gt;lock to fix UAF in svm_register_enc_region() (CVE-2024-35791) * kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797) * kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875) * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000) * kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801) * kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883) * kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019) * kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) * kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979) * kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) * kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927) * kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936) * kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040) * kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096) * kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082) * kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096) * kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34; (CVE-2024-42102) * kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131) * kernel: nvme: avoid double free special payload (CVE-2024-41073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.35.1.el9_4.x86_64.rpm 30138129ffa9c8c8792447008543d60549d8b6f2fd79f4f3803a605f65a24260 kernel-tools-libs-devel-5.14.0-427.35.1.el9_4.x86_64.rpm 79e492455261a1afddbb2125260b0f178dde582bd071ef461a851eb220d83d26 kernel-cross-headers-5.14.0-427.35.1.el9_4.x86_64.rpm b440d3b16d7b16725c5fcbd6e74892b0f8d09ee02dd00513f9db781057b4fb6c ALSA-2024:6757 Copyright 2024 AlmaLinux OS 0 1 Moderate

libnbd security update

Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: NBD server improper certificate validation (CVE-2024-7383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libnbd-devel-1.18.1-4.el9_4.i686.rpm 2b05fd33efda0b5e3b40f467288b1242ed09be2ff32e77f9aa02587daa441fdd ocaml-libnbd-devel-1.18.1-4.el9_4.x86_64.rpm 5ec5eec526acadb92a6e886a4470274ad4cf4b0c693852d9fd411cb881ee00f9 ocaml-libnbd-1.18.1-4.el9_4.x86_64.rpm a8fa4a36a1e41bd7b13fefb26167a9f5ca5ad1a831cb5c2f4c0d9da4b4e8a7ba libnbd-devel-1.18.1-4.el9_4.x86_64.rpm c43bed7694f81f71d093bb0bd658cc8d2eeee730e7a2e3619be8d9d0cac899c3 ALSA-2024:6997 Copyright 2024 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439) * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739) * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947) * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931) * kernel: scsi: qla2xxx: Fix double free of the ha-&gt;vp_map pointer (CVE-2024-26930) * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929) * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022) * kernel: KVM: x86/mmu: x86: Don&#39;t overflow lpage_info when checking attributes (CVE-2024-26991) * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895) * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899) * kernel: cpufreq: exit() callback is optional (CVE-2024-38615) * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601) * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573) * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570) * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562) * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884) * kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34; (CVE-2024-40984) * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071) * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225) * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.37.1.el9_4.x86_64.rpm 73212c0ea17c8bfab69459b53985379e3d46089076a4479d3e2b63120476a025 libperf-5.14.0-427.37.1.el9_4.x86_64.rpm 80659156cb0600a05ba30d8dfb0c402d1c445d3789b15ac2eddc4f43a0e96147 kernel-tools-libs-devel-5.14.0-427.37.1.el9_4.x86_64.rpm 8f05fa71c2e3dcd7dee68effd043464866a046af451132aef41621c084bdac8e ALSA-2024:7346 Copyright 2024 AlmaLinux OS 0 1 Important

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source () * cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes (CVE-2024-47076) * cups: libppd: remote command injection via attacker controlled data in PPD file () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default cups-filters-devel-1.28.7-17.el9_4.x86_64.rpm 8e39e8448817b3115260742909db71b7ed12b2d491c0fad9a0141f443eb4f912 cups-filters-devel-1.28.7-17.el9_4.i686.rpm c7cac6a5f0e98cc4a03ae09dda9ad52a42169fc3a910ce27e76bfd11856b402b ALSA-2024:7867 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35. Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-6.0-source-built-artifacts-6.0.135-1.el9_4.x86_64.rpm 99524b2cbd02674b8464627adc39aba57e2d02dcbb566dd484bae8fe2208cf1b ALSA-2024:7869 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.110 and .NET Runtime 8.0.10. Security Fix(es): * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-8.0-source-built-artifacts-8.0.110-1.el9_4.x86_64.rpm b085510892d92e770842072b77030bf641bd277ace8de2f59ffceeec24988922 ALSA-2024:8037 Copyright 2024 AlmaLinux OS 0 1 Moderate

OpenIPMI security update

The OpenIPMI packages provide command-line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. Security Fix(es): * openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator (CVE-2024-42934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default OpenIPMI-devel-2.0.32-5.el9_4.i686.rpm 034c3d282ff17bae256878b4eb015fcebb9a45a37b97c4706b6dd7af99b09ab2 OpenIPMI-devel-2.0.32-5.el9_4.x86_64.rpm 8a7c64a6b75ed11d40f0d868c0b18d4e7b56cd69102b41d273af3f6be9b1bed9 ALSA-2024:8117 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-1.8.0-openjdk-src-slowdebug-1.8.0.432.b06-2.el9.x86_64.rpm 1e68af51c1fadaccf674cdbbfd062a8cbf149ade9bb8fc198ee02b8dc19109bc java-1.8.0-openjdk-slowdebug-1.8.0.432.b06-2.el9.x86_64.rpm 2439db4946e990ec26806a4e9570d72c82ec2ba91473121e09cc37a1b50b0a3f java-1.8.0-openjdk-demo-fastdebug-1.8.0.432.b06-2.el9.x86_64.rpm 72135c57e8a444d559ff9f065cc857a9d5d21cf39b3e631e364cef34ab89efa5 java-1.8.0-openjdk-devel-slowdebug-1.8.0.432.b06-2.el9.x86_64.rpm 87d4b51d10d3a07d74e2415548c4bf272ee086d67982defd1e76ee8b80f496b1 java-1.8.0-openjdk-headless-slowdebug-1.8.0.432.b06-2.el9.x86_64.rpm b1cf1ffbb6d35673e3a0f61f1b47eb18a2deb636c3edac12f0c738d40499f0f5 java-1.8.0-openjdk-devel-fastdebug-1.8.0.432.b06-2.el9.x86_64.rpm b4979c165b4e1159e94dab7400274192039426911cd4b69ffcdafaccac673c5b java-1.8.0-openjdk-src-fastdebug-1.8.0.432.b06-2.el9.x86_64.rpm c2909207774357a757413e98f4b3067eed5dc945ab712805a85ca5dedcbc78bd java-1.8.0-openjdk-headless-fastdebug-1.8.0.432.b06-2.el9.x86_64.rpm d86fd298bc1bfffa5f6c9565526a903cad0cad33c1e98f54632dc9c374545ab0 java-1.8.0-openjdk-demo-slowdebug-1.8.0.432.b06-2.el9.x86_64.rpm eb1fdd9458086bbb80128b34ac7230a9922e62e8549b38c2cf2fce17be9a38b4 java-1.8.0-openjdk-fastdebug-1.8.0.432.b06-2.el9.x86_64.rpm f8e0821cfd631969818b02963fe5c01a3d92134a1fdcb3b6a76a738c8e69a57f ALSA-2024:8121 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-11-openjdk security update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-11-openjdk-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm 285c0c9e5365317ce130f681f23094453b267949c8b7f08fec0d87a284c26ec9 java-11-openjdk-src-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm 2c89f204b261d378dc062029998b32c1b6d96eacb5c3ec238fac8c5684eab142 java-11-openjdk-devel-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm 2caa9372014611bf28e95af87f7239ee83d840f8fad866c4f93032d7318101d8 java-11-openjdk-demo-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm 38ba22c351cd8344c5e51a99b4be9343e2e0fa2ef77bdeb230c9670e0d9884dd java-11-openjdk-headless-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm 45b2769c8bdf0f16b8cbc872fac9061ccc533a501f77d58e66a7936fc6fe2722 java-11-openjdk-jmods-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm 475595a01d54c1dfd9309ea88ce33b9abd83dbc8e9aa9d9ab256046667875259 java-11-openjdk-headless-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm 566a162aefe5310e2079781b760180d680dacc0102ef66e57c24a24d4688c5df java-11-openjdk-src-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm 74df491e0325b2216751fc64d4b0f19cca3eabfbff0b3242318c4824ce094989 java-11-openjdk-jmods-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm 7ced5ceac44ac808cc644b7e7c5e6569c799a9ee8fd6eef360ab6ff19753fd01 java-11-openjdk-static-libs-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm 8baadcb9c1a0cd7b562d9b73c65d100e728854dcda534e26f29c029dc7484d79 java-11-openjdk-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm b730753606c1fb186e3efb81d97cf220e06e51a8f76463d08f567768fa9b4731 java-11-openjdk-devel-fastdebug-11.0.25.0.9-2.el9.x86_64.rpm d72fc266ec47eeb656d5b3a2f8d798e8c57b9a69506851aab42b4c40416df4bd java-11-openjdk-static-libs-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm df8a023da35c8f94617f52534303db8ca88f8709a12d7feb0e15e07dd1007185 java-11-openjdk-demo-slowdebug-11.0.25.0.9-2.el9.x86_64.rpm f7251b3dacfe8ea6e502985d8e071bf18b6f69c3fd0bcadaa0f82124fb51dc8e ALSA-2024:8124 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-17-openjdk-devel-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 01bd80c6954b34686c4b703552f7a99785d46f22af1af9f7cc96aaabe18ae85f java-17-openjdk-headless-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 22402ea30319312d2ec9e23beff450cc7c3d71ec48d8d7f3df9a1c02293010f0 java-17-openjdk-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 39db24150fcc19d18045de58b15f999585ef8d1920bc4958285eb59fee5ac841 java-17-openjdk-src-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 39f9b633b1dfd70d0c84b03da1ee4c3067c65b390ee199cf34ec35777ef3891d java-17-openjdk-demo-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 4574666f8f005f4a88b48917f61f0214f5ba411d880efe131700e10c25b8a2f8 java-17-openjdk-src-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 489ec73a5f466d9afbd2531dcfe1d4eac82e25d09f0a1fa78b8ec7d6207b2dee java-17-openjdk-jmods-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 5e025e1cb69d81b5c9ceb2598160563b6dfb37815670eca63df2a3e2fb93919c java-17-openjdk-jmods-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 5e82a531013c24ecba9108e3df127ab688cdafff88a8664fcc715fc7dba95046 java-17-openjdk-headless-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 61216d30f2dfdde61c4e68de2963df1b0da673f44c637342ee06e809f9f2ed26 java-17-openjdk-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 7f646aae063514417b251ea63f69388be4759c3feedb7b5a70f9b403f2c5e6f6 java-17-openjdk-demo-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 87ea840b0c08d22760f560d5db4bd2453ec24d0b28cc8605c14d737d26ffa0ef java-17-openjdk-static-libs-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm 99388c089fb74008a7751d74badfd38c0c60df5562b04b20b361bf37bd4ff7b2 java-17-openjdk-devel-slowdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm cc21cb87c66497d7fe5f9dbe9ae787417ba708af5ad3a00aa35e9be4daf6bf6a java-17-openjdk-static-libs-fastdebug-17.0.13.0.11-3.el9.alma.1.x86_64.rpm e33814d9a7098cc968d8cfe0a2a6bc43d310167b9be669ed6a683e7c220713e0 ALSA-2024:8127 Copyright 2024 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 runtime environment. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default java-21-openjdk-headless-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 02fc009f4b66e470462496ef5b51dda355b3da989e7652b6ddae9568bb5875cc java-21-openjdk-devel-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 2c299924914ba3b8926d77504d1e44dcfb7160643c09894dbc2f1ae45b1d28d7 java-21-openjdk-jmods-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 4c56750f0a632d2f08d1f05ed77e5be82f635c0f34f386f7d43343f1598b304e java-21-openjdk-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 5bf57b59fa6ca26a8d845b55ec731664a867b6a8635fe1b128a6ca8f465bd094 java-21-openjdk-static-libs-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 6f81f81dd8eef6fe2b55163664f677c137eb8f57b39ee461f5ba33d615ec0fba java-21-openjdk-devel-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 84f264962d82869548995f1aca946a6dd198436ff023414a69207c668ed342d1 java-21-openjdk-jmods-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 88f8c62c105da4cbbfc4561281ada89fb4809c9414914587035ef20bfad207d4 java-21-openjdk-src-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm 9e09a1d2b25c1d11a06e12086258d995829d57d8a0c860ee14113632e31d5476 java-21-openjdk-demo-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm b1dae63c6367ba8f0ed0d0c2df7dac2779da69a9a4763c4e067454c1d67a5a20 java-21-openjdk-static-libs-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm c36469345792dccbf986ef4132d7806f099184e58fd08f152fd2fa35db92d4ac java-21-openjdk-headless-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm d7c022cf70c2757c528e539903f2f8174764aa0a3fe5c99061cfcec67c7cc3cd java-21-openjdk-fastdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm d846d4d207b702db130c8148550eb02260b1453544f0601408eec9a27bcfc3b4 java-21-openjdk-demo-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm f7d1343ccd708d3fa01df1cecb460b011237a528304567d12d09a523d04bbbee java-21-openjdk-src-slowdebug-21.0.5.0.10-3.el9.alma.1.x86_64.rpm f9f6188e310884ecb5be6bf4dcf43bac2ec766b9625883e9bec936078ce9e161 ALSA-2024:8162 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Local information disclosure on Intel(R) Atom(R) processors (CVE-2023-28746) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34; (CVE-2023-52658) * kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989) * kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47385) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) * kernel: net/mlx5: Add a timeout to acquire the command queue semaphore (CVE-2024-38556) * kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVE-2024-39483) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959) * kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079) * kernel: sched: act_ct: take care of padding in struct zones_ht_key (CVE-2024-42272) * kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-427.40.1.el9_4.x86_64.rpm 3fe0fb78efbcbc4d5481633f341c6c14d40298daa1f413180e33bd4f2b82fb7d kernel-tools-libs-devel-5.14.0-427.40.1.el9_4.x86_64.rpm 9725de4e92003a11e934e131ae77f1d74ce1aa736bc50c159dd98155907ead86 libperf-5.14.0-427.40.1.el9_4.x86_64.rpm dc3d4467148896a408731d3fb0e3d0f3e99e4443761aec4c824f0194692004ef ALSA-2024:8374 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-tkinter-3.11.7-1.el9_4.6.i686.rpm 1d869304040fbe272514310a1d812626b2d92158954901de6b6f5033f2c19890 python3.11-3.11.7-1.el9_4.6.i686.rpm 4beb87232001ee6f0273599fc3e621e22f727244ea1ad8010a668348d5a0eb37 python3.11-debug-3.11.7-1.el9_4.6.x86_64.rpm 838dad7df967e8ef26105f0790cec45a949582476acf6eb9a724f3a5ef5bec39 python3.11-idle-3.11.7-1.el9_4.6.x86_64.rpm 9a2ae92c68f4d9ca474abcda69056a5511866747c8586cc258160d26992ec127 python3.11-debug-3.11.7-1.el9_4.6.i686.rpm ca8b48b1fc0e92097aace5d35e704d6237a4b8b25bcfa54c4d3cc211fe2a3616 python3.11-test-3.11.7-1.el9_4.6.x86_64.rpm d76cd24884865b8061f0261b1172f95bd329e469633914e904d93b6c7ec9a5eb python3.11-idle-3.11.7-1.el9_4.6.i686.rpm e2c7c06bbe273e5421270f268402e09051c96467eb100ca42c484c8f8d3341aa python3.11-test-3.11.7-1.el9_4.6.i686.rpm fe49b7954f35aeea5db41e7d69c4b8b7fb9f530e472c391221b397ba04b70c83 ALSA-2024:8446 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-test-3.9.18-3.el9_4.6.x86_64.rpm 0a375ec9b92cac37e8b255c8f33129f44fd74331c79e834a28b4bb9fd058a4f8 python3-idle-3.9.18-3.el9_4.6.x86_64.rpm 4b6acc35e8e2fbc3c3ef5dbd4eff86f9b53c64e5b36d90e9117b773c890a0d81 python3-idle-3.9.18-3.el9_4.6.i686.rpm 71c7832098a13ddc2e704ee2e62f8b6a776db992cc2f0b6b50bdf59c0bf7c5c3 python3-test-3.9.18-3.el9_4.6.i686.rpm 90caad3248a223f6edec2dff4f439ce0af3525c38dc639f9e784644876a752d6 python3-debug-3.9.18-3.el9_4.6.x86_64.rpm aa072d56d0e233dab63f92e63e6a7d46206d04083f9c0f5bbbe0604e2d3cff9f python3-tkinter-3.9.18-3.el9_4.6.i686.rpm c464f17b174091fb774b13aeff5a938a2c0fea65954e6c4f36fd1984bffd36b5 python3-3.9.18-3.el9_4.6.i686.rpm d67aca11603940bd5ab100e10e8ad6d22e08c6ed75c5445f55b0c51c0f891b76 python3-debug-3.9.18-3.el9_4.6.i686.rpm ed3a5bbdc32830e01ccbe46ca796cd2d685ec1f149a96edc5ad1e37d6a50e2f4 ALSA-2024:8447 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.12-test-3.12.1-4.el9_4.4.x86_64.rpm 1232e09c6b1c33a8e11f4bf6111bd2e3636171ed0ff924d4460e38a403f29056 python3.12-test-3.12.1-4.el9_4.4.i686.rpm 6ac9c2b43bad51f5ab735cdf46e8d1d4fe089720d91cafdfca95438d1f68ba23 python3.12-idle-3.12.1-4.el9_4.4.x86_64.rpm 6d8c16b5358153282ca1bc411c19e7316400db372cb6255c1cbabcdb657fc3a2 python3.12-debug-3.12.1-4.el9_4.4.i686.rpm 895a8ae238dc25daeb89b105adac46f9016c076fec661f0fa4dd078125e4c1a9 python3.12-tkinter-3.12.1-4.el9_4.4.i686.rpm 9a6ed2350cbdc1106b6b48398a2d8977535c746912ea0ae70d2299dc17c65d9b python3.12-idle-3.12.1-4.el9_4.4.i686.rpm c1332c6295993c867d58b2c4b413f26994ed29b4821701d1ec54ea61f7422e36 python3.12-3.12.1-4.el9_4.4.i686.rpm f3d862892e1fe00577e38aeb3a24ae2e87aac5f37c70e7bfa12493718ebaeb88 python3.12-debug-3.12.1-4.el9_4.4.x86_64.rpm ff2efab5921b7ff9ee8072c381a56b372bedb7688ebaa129e0351e016fc46aff ALSA-2024:8617 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923) * kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961) * kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935) * kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383) * kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244) * kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472) * kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504) * kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904) * kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931) * kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960) * kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972) * kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977) * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995) * kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() (CVE-2024-40998) * kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005) * kernel: xfs: don&#39;t walk off the end of a directory data block (CVE-2024-41013) * kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libperf-5.14.0-427.42.1.el9_4.x86_64.rpm 93fc9e6bdc4a5dad55087c35e5ed0af85c9e0dfe0dac6e2dd1062ccd25b77027 kernel-cross-headers-5.14.0-427.42.1.el9_4.x86_64.rpm bf7c13394056003bd4def12cb0a06193e4a119e9ffeb8d0c827e77ddd839ff72 kernel-tools-libs-devel-5.14.0-427.42.1.el9_4.x86_64.rpm cbebda2efee1a6e6ceb29939c243b55c9449f33a4ab6d6fe48f77ff72d064b61 ALSA-2024:8800 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_4.1.x86_64.rpm 56e83b3bcdf940c9bcd69a6cd02c5f21ddb5a34afdc845e2f6f4be0399b8ea35 openexr-devel-3.1.1-2.el9_4.1.i686.rpm 817360e8fb16fe2e7978ed7796df4340c2baee9360fe8e344e78ab6379642c5d ALSA-2024:8914 Copyright 2024 AlmaLinux OS 0 1 Moderate

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libtiff-tools-4.4.0-12.el9_4.1.x86_64.rpm 1fdd9edb65ac013123396709e96a5e311bd3aff92191b1e29089c3a6a18993c5 ALSA-2024:8935 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default edk2-aarch64-20231122-6.el9_4.4.noarch.rpm 6ead2d3429f2753faeac142fafcbdb556ed7e654686566cc8c3c51d6d0443a73 edk2-tools-20231122-6.el9_4.4.x86_64.rpm 77142da292d12d7fabfd5a0305cf390edbca35a39a70f341ba81f203af210124 edk2-tools-doc-20231122-6.el9_4.4.noarch.rpm ba46cd872396c59af904379ce10005c4a600251e4545cdf711095752271afbd0 edk2-ovmf-20231122-6.el9_4.4.noarch.rpm f240e4196ec775d8927b7347b3954c802adec030b855c4acc8bda3228f24530f ALSA-2024:9088 Copyright 2024 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129) * openssl: Excessive time spent checking invalid RSA public keys (CVE-2023-6237) * openssl: denial of service via null dereference (CVE-2024-0727) * edk2: Temporary DoS vulnerability (CVE-2024-1298) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default edk2-aarch64-20240524-6.el9_5.noarch.rpm 0d9f83e534d3284e489bcfefea1d4408a20de4e7e09474f1f0ed1e86c95b7a22 edk2-tools-20240524-6.el9_5.x86_64.rpm 336dcdd44c07dd10249e73578b32ad82cde32cf38181428de88e9028a5941b53 edk2-tools-doc-20240524-6.el9_5.noarch.rpm 4abac5ddb9cf5e935717a02dfcab6de42d97baf7fe07f016bd130036a1619678 ALSA-2024:9093 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default xorg-x11-server-Xwayland-23.2.7-1.el9.i686.rpm 33c99e9ce748fccb3771c851d2e8e9a254f63b7442a04563116b048efc8ecae5 xorg-x11-server-Xwayland-devel-23.2.7-1.el9.x86_64.rpm 542d10cc19672bd1fee926fde1d08fcb1280b6990fb264e50fb96a667572ff28 xorg-x11-server-Xwayland-devel-23.2.7-1.el9.i686.rpm 548b626999958984b243ce780d5982a4ab22021b900d48b509f332fac96f77b3 ALSA-2024:9122 Copyright 2024 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: Use-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default xorg-x11-server-source-1.20.11-26.el9.noarch.rpm 04014f59feac5b00a0590cbb6cacb7c373f1b5fc9e24cb3e7ba498b0e97163f9 xorg-x11-server-devel-1.20.11-26.el9.x86_64.rpm 1b9aee3105fdccdfc4062d9ab260d459e9c9530203ff571f77c103bb3fb8d8fb xorg-x11-server-devel-1.20.11-26.el9.i686.rpm 715043c285398cc516cf15529e6606ca203f7fd780d6835c18ed4c5f8dfc0527 ALSA-2024:9128 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Crash of virtinterfaced via virConnectListInterfaces() (CVE-2024-8235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libvirt-docs-10.5.0-7.el9_5.alma.1.x86_64.rpm 025475a863131b8ee68330c053e48ecedf39a31fec2b7fea2421cd8267b122a3 libvirt-daemon-plugin-sanlock-10.5.0-7.el9_5.alma.1.x86_64.rpm 2535c8f845dd01526c8b062da25710738634313be0a5a6bb04f254ff43952a40 libvirt-devel-10.5.0-7.el9_5.alma.1.x86_64.rpm 4d76a0fb9943c3865609d63aea4f13a8c8687f3f2308f5742d1c516b033197e2 ALSA-2024:9167 Copyright 2024 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: pdfinfo: crash in broken documents when using -dests parameter (CVE-2024-6239) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default poppler-glib-devel-21.01.0-21.el9.i686.rpm 182d4fafe0ac0cf8cedfd42b0fb81d8308df4773a4bb2588b30c108b45640e6e poppler-glib-devel-21.01.0-21.el9.x86_64.rpm 58a8ce56f8aa0d4394afcb0279c5c90a1eace08e7487492c3d8b1d6045f7b3f2 poppler-cpp-devel-21.01.0-21.el9.x86_64.rpm 612e2527386cb19d4d5b463377c4aea44502d8717e79223463b6fba07425fba7 poppler-qt5-devel-21.01.0-21.el9.x86_64.rpm 81d940ea0928ef6863eac2836a9702ba7408d5b034280b6d9ea0fb7557bb8895 poppler-devel-21.01.0-21.el9.x86_64.rpm 92a0687727ed454cd6795af507b335e97e4ac058e70fd60573c2b0edbfbeb7e6 poppler-glib-doc-21.01.0-21.el9.noarch.rpm a61fb4d179262e8f7b527744c120382860ebb8da6f1f7d37d23fde01e3e82987 poppler-qt5-devel-21.01.0-21.el9.i686.rpm b652cc0cc1fa835371d09fc24424fbe6ba96f37fee1dbe087d02ddf1146f40e9 poppler-cpp-devel-21.01.0-21.el9.i686.rpm c1efba042a5ff1bf59e33668dbf8730a7f35e45fd06338ee3e6afe5fbf04e2b9 poppler-devel-21.01.0-21.el9.i686.rpm c5ad37037ff550b371a32ade68ea32360bbb75945deea3760d95f3931667a02d ALSA-2024:9181 Copyright 2024 AlmaLinux OS 0 1 Moderate

jose security update

Jose is a C-language implementation of the Javascript Object Signing and Encryption standards. The jose package is a dependency of the clevis and tang packages, together providing Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * jose: resource exhaustion (CVE-2024-28176) * jose: Denial of service due to uncontrolled CPU consumption (CVE-2023-50967) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libjose-devel-14-1.el9.x86_64.rpm c81ad45bbc22795e046a30b39b0dd2ecf1ba9ebbda49b0304ed61b693accd3f6 libjose-devel-14-1.el9.i686.rpm c924138bceaf77ad42477b8c1dbe840d6bb2790d26c2b8c0d42d0f3162512398 ALSA-2024:9184 Copyright 2024 AlmaLinux OS 0 1 Moderate

gtk3 security update

The GTK+ library provides a multi-platform toolkit for creating graphical user interfaces. The gtk3 packages contain GTK+ version 3. Security Fix(es): * gtk3: gtk2: Library injection from CWD (CVE-2024-6655) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default gtk3-devel-docs-3.24.31-5.el9.x86_64.rpm c72305265d9e7ee4ddbeb23009e224d8507bf6f0fd6697c542f343bbce64cde7 ALSA-2024:9187 Copyright 2024 AlmaLinux OS 0 1 Low

bcc security update

BPF Compiler Collection (BCC) is a toolkit for easier creation of efficient kernel tracing and manipulation programs. BCC uses the extended Berkeley Packet Filter (eBPF) tool. Security Fix(es): * bcc: unprivileged users can force loading of compromised linux headers (CVE-2024-2314) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default bcc-devel-0.30.0-6.el9.x86_64.rpm 2dd57215fb2e587eeea11e0160309dc5fdaa592ae26e6a6001916c877639928f bcc-doc-0.30.0-6.el9.noarch.rpm bfa0e15890e368fcde724436ef7855beb8037f5b9570b22facd5dbaf178346b0 ALSA-2024:9190 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: incorrect IPv4 and IPv6 private ranges (CVE-2024-4032) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.12-test-3.12.5-2.el9.i686.rpm 0625b6af4964cfdeb4a9738f4f7ff5660d6702829454fe2df182db25b877e905 python3.12-debug-3.12.5-2.el9.i686.rpm 07f532cd3b585296a2a44dae523f609aa0aad736bbd794e813f13b977a814f4b python3.12-idle-3.12.5-2.el9.x86_64.rpm 09794481328d1f88f72624466c676345cd524a3b46efaa9bd700915bb062e55f python3.12-tkinter-3.12.5-2.el9.i686.rpm 2b5bd13058137556cc1b1620dbcdd2662b07738355aafa27c75cef7a0b8b38b1 python3.12-3.12.5-2.el9.i686.rpm 5b0e9c2734eb854d6947199b57644c3bb1ae0cc5a15f196b264f75d6c705651c python3.12-test-3.12.5-2.el9.x86_64.rpm 6caf7b2ed10a2b8457a618400c34c108ad02ae2f8edc74a18a040b989779398c python3.12-debug-3.12.5-2.el9.x86_64.rpm 8ce66f18c22024e3a8fedb223b432b910769ff0aa66928c798424d7d24770683 python3.12-idle-3.12.5-2.el9.i686.rpm 955e7e8b254d650adb48020f25741ebfa400f5cb7a874f033c0e6587f3f7583a ALSA-2024:9192 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-test-3.11.9-7.el9.i686.rpm 0f93edb1cd1e8e25a3ada786631b785fe6459de344f4706a8a7625093fff382e python3.11-3.11.9-7.el9.i686.rpm 1a3d414f12be77e0df0c4b46fcdad6a2d873b0fb14210c86b2aa6c658890c5eb python3.11-idle-3.11.9-7.el9.x86_64.rpm 22f90d81a528c03abeb0a4842db247418b481b0d91afcb41e0fad577173b5cb5 python3.11-debug-3.11.9-7.el9.i686.rpm 2d63fd0d6aa35afbbbef9a1bf7aa4bba4d95c0caf3345543073f2f2be7961d44 python3.11-tkinter-3.11.9-7.el9.i686.rpm 57ef0cc6e443eeee4ea383751a325fc143a96e593770e7608675714091ab5e22 python3.11-debug-3.11.9-7.el9.x86_64.rpm a6543800fe5185eb593e30cd5fadc1b5ec9eecda4917a17542d0cbd3058ae2d2 python3.11-test-3.11.9-7.el9.x86_64.rpm d1635f0b518496c00773515a43faa9fa3a6b918f7fb6e9838315aaf7141d4ba8 python3.11-idle-3.11.9-7.el9.i686.rpm f46d781ce9f2ab1f3ae4ec59fb228b68637d62161df97f1698dd06d971988fc7 ALSA-2024:9317 Copyright 2024 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: Denial of Service (CVE-2024-6501) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default NetworkManager-libnm-devel-1.48.10-2.el9_5.alma.1.x86_64.rpm 49d4f7ad86426b2f9046238781a9f671096874c9fb4b3875ab40d26f03976111 NetworkManager-libnm-devel-1.48.10-2.el9_5.alma.1.i686.rpm f2d2217b786ea54d3f916966741498b41b6674052bf46204817cb712e3fa6c22 ALSA-2024:9371 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service (CVE-2024-8088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-tkinter-3.9.19-8.el9.i686.rpm 2b27049288a1b52cd5f19ce556bc316a3c5e728bd298249b13f7ca996e54139c python3-idle-3.9.19-8.el9.x86_64.rpm 6255c1cd297f6a1716c18a8113abe74fa263bf1e6029bf02cd4de9941bf809d8 python3-idle-3.9.19-8.el9.i686.rpm 7424858d0557f236adcec5133e3e504e2325330c01b3d5dcfd2258c55d3ab763 python3-debug-3.9.19-8.el9.x86_64.rpm 74cafc7cd943cac77d7c634e4cd9fa5c60f2ec381b44b133a03eff934315344a python3-debug-3.9.19-8.el9.i686.rpm 7b9dcc63d5a3fe9b2b18571ecff6cf910a4cfb6f957a314f75bcbf0b128c88c3 python3-test-3.9.19-8.el9.x86_64.rpm 96e636e72cec745bd41eafdf267d8f6534816c1e873e16e4608efbbfcbb03d88 python3-3.9.19-8.el9.i686.rpm b008813832d539a3090d2207d3acc22c4c4f97d464b073420dcef424f984a1f6 python3-test-3.9.19-8.el9.i686.rpm e588fd747a533acd88e2d5aae272fc60ccdbf037b41b83ec73a4134581acd154 ALSA-2024:9413 Copyright 2024 AlmaLinux OS 0 1 Moderate

bluez security update

The bluez packages contain the following utilities for use in Bluetooth applications: hcitool, hciattach, hciconfig, bluetoothd, l2ping, start scripts (AlmaLinux), and pcmcia configuration files. Security Fix(es): * bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution (CVE-2023-45866) * BlueZ: Audio Profile AVRCP Improper Validation of Array Index Remote Code Execution Vulnerability (CVE-2023-27349) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-51596) * bluez: OBEX library out-of-bounds read information disclosure vulnerability (CVE-2023-51594) * bluez: audio profile avrcp parse_media_folder out-of-bounds read information disclosure vulnerability (CVE-2023-51592) * bluez: audio profile avrcp parse_media_element out-of-bounds read information disclosure vulnerability (CVE-2023-51589) * bluez: avrcp_parse_attribute_list out-of-bounds read information disclosure vulnerability (CVE-2023-51580) * bluez: AVRCP stack-based buffer overflow remote code execution vulnerability (CVE-2023-44431) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50230) * bluez: phone book access profile heap-based buffer overflow remote code execution vulnerability (CVE-2023-50229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default bluez-libs-devel-5.72-2.el9.i686.rpm 1615e55af77bc355f30465e8b9484c6849d271e13343aa6c643e60ae2ab1872a bluez-libs-devel-5.72-2.el9.x86_64.rpm 2e092ba6b9d929bc5c915835700b0c34cfb3c7be99ff0474c21be527d5da3571 ALSA-2024:9439 Copyright 2024 AlmaLinux OS 0 1 Moderate

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: command injection via crafted archives or compressed files (CVE-2024-25082) * fontforge: command injection via crafted filenames (CVE-2024-25081) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default fontforge-20201107-6.el9.i686.rpm 702d5256b986bd6bd7e3d7326779d2a2e9f7b7e2fb9421d55e0d0023fa08183b fontforge-20201107-6.el9.x86_64.rpm d0d77f39a1f2dfdb55076a7b0fd0e897b83b65d0ff41f2683e85bb881aeeffe2 ALSA-2024:9442 Copyright 2024 AlmaLinux OS 0 1 Moderate

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default mingw64-glib2-static-2.78.6-1.el9.noarch.rpm 40282712f860e2ef03f28f243ccd26a64d12a7ae6f566f62e061aa77117081aa mingw32-glib2-2.78.6-1.el9.noarch.rpm 419833fe35439ea6d7ef4aa0e06893694e4958a26a0e6080e815a8c92245c238 mingw32-glib2-static-2.78.6-1.el9.noarch.rpm 642707450586165424bac0db9ef6090b6bbfc972f8f28bb138c0e5dfef0c56e5 mingw64-glib2-2.78.6-1.el9.noarch.rpm 64b1262e5542da5520223fb2467932e1ac251005da33974b59b2d087f5abf2d4 ALSA-2024:9449 Copyright 2024 AlmaLinux OS 0 1 Important

bubblewrap and flatpak security update

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default flatpak-1.12.9-3.el9_5.i686.rpm 667f5ea851e8479f059ae437c659eea3f9a928f313cdb7f8013b8602bb81962b flatpak-devel-1.12.9-3.el9_5.x86_64.rpm 8caf3d648227725096cb8d85e158b3edc6fa0d3d5309a060ec7eb86b4865fd6e flatpak-devel-1.12.9-3.el9_5.i686.rpm a3e0537fd2b66e1e926832ec889d576cc6998b35ad15e71f3b3f76bbe2417d3e flatpak-session-helper-1.12.9-3.el9_5.i686.rpm e8217b6734d752463c00d8b0bbc2d9675fe120d895b1b725ec306d26031f4e79 ALSA-2024:9450 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.11-test-3.11.9-7.el9_5.1.i686.rpm 00d135e1bd8f6541d63524567b694d4c0090c623478680c66272978d7ba80c14 python3.11-idle-3.11.9-7.el9_5.1.x86_64.rpm 2dd228097ef93500806da2de0afea6057f6863baada9c67b8050c695dad0b640 python3.11-idle-3.11.9-7.el9_5.1.i686.rpm 6800f7e4a132b7050658cf366191dcaab071503eec43737861d34c513ded02a6 python3.11-debug-3.11.9-7.el9_5.1.x86_64.rpm 90b075b80b1fb87daa7580bcb5cc515a4073d5a3da043f0d86ebe8336add3b7a python3.11-test-3.11.9-7.el9_5.1.x86_64.rpm 9b342eff259448dbf3df64cbf3f8f391eb54e70bf4f24c9a87b3de6026efea48 python3.11-tkinter-3.11.9-7.el9_5.1.i686.rpm ce770cd42f5c701317b94a11a2ea2f094ff2e6f6a51aabfd4056eec07973d1cd python3.11-debug-3.11.9-7.el9_5.1.i686.rpm d2c4fcf46a62b73094ba232f44edb8ad5d7fd4d8fbd6d4b21155d8abb29d5240 python3.11-3.11.9-7.el9_5.1.i686.rpm e3f725e7730c728e9853041f61a7f6074aa134e1c7baf2f3e6fda5fcec76c939 ALSA-2024:9451 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3.12-test-3.12.5-2.el9_5.1.x86_64.rpm 121982da70adb4012b88571d717cca6b338c6750fe742eb9b23b8d641f4fe3b0 python3.12-tkinter-3.12.5-2.el9_5.1.i686.rpm 4cecfa4cad0432b2d1f3f37a84d397cd799d54ab7e2671a1c19961bd122c1779 python3.12-debug-3.12.5-2.el9_5.1.i686.rpm 53913d4bbf903ac842985f8e3e6a340ac662056c62428018ac3e3f8189d71330 python3.12-idle-3.12.5-2.el9_5.1.i686.rpm 64714d4d0487b561756979af05da83709fd44b2b887e744a8141b48bf2e4ab64 python3.12-debug-3.12.5-2.el9_5.1.x86_64.rpm 7de0da3f75e5709d87d2a2aaf632b62da6a3077ec63dcb3c905780a06593af78 python3.12-test-3.12.5-2.el9_5.1.i686.rpm 8ce81f9887587d5a89620f21df37df84236d69e92a15c79984f70ee74044e939 python3.12-idle-3.12.5-2.el9_5.1.x86_64.rpm 8d79408f8decde1eaa3d2e130c2c51556a441e40347ecc74f5808279ff656f58 python3.12-3.12.5-2.el9_5.1.i686.rpm d8ad5e98d364bf950c3db925b18f29bad41bb55a68568389a426e68c66129389 ALSA-2024:9468 Copyright 2024 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default python3-test-3.9.19-8.el9_5.1.x86_64.rpm 32f4692e2940c519208a47b7892ea566b4ff0f6888e66f8410c4bdf7a511e03d python3-idle-3.9.19-8.el9_5.1.x86_64.rpm 3e3355cfa99d4423e166ca478ec75d1dfb29f53e3854b337cab4529b14aaa502 python3-debug-3.9.19-8.el9_5.1.x86_64.rpm 437c857bde7d0677ee07a1697bf5ef65b03443f758a1ea595171a4d188f792ef python3-test-3.9.19-8.el9_5.1.i686.rpm 51137e826829ac3fa0546314622162093955d8e512a819bdca9ba7466062ee5d python3-tkinter-3.9.19-8.el9_5.1.i686.rpm b93161a7c57595520ba6dc89d5817bb67234362bd5bffcce1f47d1313eefc6c4 python3-3.9.19-8.el9_5.1.i686.rpm c2c798c6a71d49caeba6110cb9cf93edfbfb0de4266a1e27bf3f11e658840667 python3-debug-3.9.19-8.el9_5.1.i686.rpm ea4a70fe3eec72e4308b7e656308b7fca699d9bcd2f7ea781312714953dd8f2c python3-idle-3.9.19-8.el9_5.1.i686.rpm f36a4450707e00f28288efbc6c44543ae47da07f67786295bed57a2f1bacb985 ALSA-2024:9543 Copyright 2024 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.100 and .NET Runtime 9.0.1.0. Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: Type confusion vulnerability leads to AV in .NET Core NrbfDecoder component (CVE-2024-43498) * dotnet: .NET Core - DoS - (unbounded work factor) in NrbfDecoder component (CVE-2024-43499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default dotnet-sdk-9.0-source-built-artifacts-9.0.100-1.el9_5.x86_64.rpm 4d2550d7e44fd44a06a568cab86e48ae8d44be5e1f7cdf09bb99b508c8fd74db ALSA-2024:9548 Copyright 2024 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default openexr-devel-3.1.1-2.el9_5.1.x86_64.rpm 03011fa397ae83fa5099e46a9e4662fee9dea503c19f5ab2c2d48eb27258cc6d openexr-devel-3.1.1-2.el9_5.1.i686.rpm bbb1f74bd1709c42f3a1775fddfed7a36a676656348fc8b0079af8213c6f0186 ALSA-2024:9605 Copyright 2024 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: nexthop: Initialize all fields in dumped nexthops (CVE-2024-42283) * kernel: iommufd: Require drivers to supply the cache_invalidate_user ops (CVE-2024-46824) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default kernel-cross-headers-5.14.0-503.14.1.el9_5.x86_64.rpm 5e286f5ae6fb91ce3b8fa1c1175dd40e4f5a58bd9357cfbf60aec1504be8bacb kernel-tools-libs-devel-5.14.0-503.14.1.el9_5.x86_64.rpm b545cce49e58d00d1f081b21e0f9d4c9aed54d11f94c0270841c67b6ef28fb83 libperf-5.14.0-503.14.1.el9_5.x86_64.rpm ee991952ba3798ed74a58cf780c0c0f6dede22fed171341275d4d1657a3f1f49 ALSA-2024:9827 Copyright 2024 AlmaLinux OS 0 1 Moderate

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Integer overflow in vpx_img_alloc() (CVE-2024-5197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_4_default libvpx-devel-1.9.0-8.el9_5.i686.rpm 7c429d8a8923289553e0c0c95572f3b406cb00d9575b683c00c6793be1d9c8ce libvpx-devel-1.9.0-8.el9_5.x86_64.rpm 8c7d86eb1582ebf03b8964dcc1e9c5a7d746f2d2c89daf57bcadf4f8e550a7ab ALSA-2025:0059 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: perf/aux: Fix AUX buffer serialization (CVE-2024-46713) * kernel: RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (CVE-2024-50208) * kernel: mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CVE-2024-50252) * kernel: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (CVE-2024-53122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-tools-libs-devel-5.14.0-503.21.1.el9_5.x86_64.rpm 3b2548c8e7191c5a542c0d5e40c91b890f51db72165d88778e12d8b999e9c840 kernel-cross-headers-5.14.0-503.21.1.el9_5.x86_64.rpm bcb65d70e956a314dbf5516d83520dd2332dcfcbca7e43738f6de0afa78afac5 libperf-5.14.0-503.21.1.el9_5.x86_64.rpm d0862e4a09e8b468446b7250997a431f8229381c3c2ea2e11f6e05610b46959f ALSA-2025:0312 Copyright 2025 AlmaLinux OS 0 1 Important

raptor2 security update

Raptor is the RDF Parser Toolkit for Redland that provides a set of standalone RDF parsers, generating triples from RDF/XML or N-Triples. Security Fix(es): * raptor: integer underflow when normalizing a URI with the turtle parser (CVE-2024-57823) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default raptor2-devel-2.0.15-32.el9_5.i686.rpm b34982253825e15aadde5a298f8f7adfd9b7f8bf9f94ca80070735aef4481f3f raptor2-devel-2.0.15-32.el9_5.x86_64.rpm f527622c6cacf0dd7dad33a5d236907982c428bde35d3dc632f4a34460c87672 ALSA-2025:0334 Copyright 2025 AlmaLinux OS 0 1 Moderate

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: Administrative user data leaked through systemd journal (CVE-2024-11029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3-ipatests-4.12.2-1.el9_5.3.noarch.rpm 63c9534df50cf8bcb1e19b77e31e903b15a1c98caad904dce2fa4fe6deeae352 ALSA-2025:0377 Copyright 2025 AlmaLinux OS 0 1 Moderate

Security and bug fixes for NetworkManager

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security and bug fix(es): * Routes in table different to main are not deleted on reapply [almalinux-9.5.z] (JIRA:AlmaLinux-73013) * Route to VPN server not stored in routing table that is specified by ipv4.route-table [almalinux-9.5.z] (JIRA:AlmaLinux-73166) * VPN connections do not support ipv4.routing-rules settings [almalinux-9.5.z] (JIRA:AlmaLinux-73167) * CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic [almalinux-9.5.z] (JIRA:AlmaLinux-64726) For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default NetworkManager-libnm-devel-1.48.10-5.el9_5.i686.rpm 0caac3ba9aab31f31dac98779a4ad6d64f45e10311536cde6134ab057c2d58d5 NetworkManager-libnm-devel-1.48.10-5.el9_5.x86_64.rpm e77e2a5705681142358cb2ff3ce4191d324d7413141356798f9cd165b691bd1e ALSA-2025:0422 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update for AlmaLinux 8.6, 8.8, 8.10, 9.4 and 9.5

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) Bug Fix(es): * The AlmaLinux OpenJDK packages rely on the copy-jdk-configs package to transfer configuration files to a new updated JDK. With this update, the JDK has been updated to use the latest version of copy-jdk-configs, which has been used for some years on later AlmaLinux versions (AlmaLinux-73867, AlmaLinux-73871, AlmaLinux-73872). For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default java-17-openjdk-src-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 1c4cbed7ec7984385e8ecafa1da0bdd666724c8f46b7c8e3e19b963824e79f3b java-17-openjdk-devel-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 27139e3634893c4aa03b736480dc0ab0bc5ec38ebe6a23639837cd36ee1b8e4e java-17-openjdk-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 32f7ea9a1a02026b492b27d0acf6bc136839d73c9b22e825f2689958bae9f726 java-17-openjdk-demo-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 36e7c26dd8e28bdf5dfa6bc28eaf46796fb4915e42c83b2922d81e90264a5d4f java-17-openjdk-jmods-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 4cae3032910a205462672fb90421df66024f4396f36ada783d9f68ed40159c49 java-17-openjdk-jmods-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 57656d41c6d3332a3d96f5b349a98d3128d3bd9d23e2e5ced477ae86777a1490 java-17-openjdk-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 5b855f14bbc0ea8247ecc79e128012404e3d19feb9ac175403ced67596aba40a java-17-openjdk-devel-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 72d5be3644d6a72b8a077580502df7e1d40d109224492661d030fd05ea67dc39 java-17-openjdk-headless-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm 7f19910c5b1f017487c7f5cd859b5b1200d233b2c080cacff6b914dfd6d5fc7b java-17-openjdk-demo-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm a09d1263acd0bf0c4e7429e6c80eb48434e9be4813e6514a4cd47d8dfcaa1ae8 java-17-openjdk-static-libs-slowdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm ab2f8ad92c2c0291b2e6424960d32a1a47aa49714f37684e94c2a082488a99e6 java-17-openjdk-static-libs-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm d2f3c00bfd950133161f422f596a17bccd3895ea3fc3d1b7baa8e90044a7373d java-17-openjdk-src-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm dc681556c08d093b168c57b632b5b84f0fd90ae2c40e7531c813caf448f2d361 java-17-openjdk-headless-fastdebug-17.0.14.0.7-2.el9.alma.1.x86_64.rpm edb5b526d2aadc7105d384eb8c49e926008d242631b1f658f9975722a2d82339 ALSA-2025:0426 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update for AlmaLinux 8.10, 9.4 and 9.5

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default java-21-openjdk-src-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 17d5f191d7fcbaaccc70290d75bd5322119dc74954f791a1e85b10f3e45078ca java-21-openjdk-headless-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 1e627e01768d0ec1d0705b858d9632adb91c9ffc6f5637c093408d67607e592e java-21-openjdk-headless-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 22b5a594980057af8d2d482c1982f2f3a9e86d04ec636ddb3d785313f6d56553 java-21-openjdk-static-libs-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 38ebd6b3113b4fd3bcbfab051bf0a261149c60de9738446b362a3dd9674132df java-21-openjdk-jmods-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 4365c6708c1eb798083af1c52570e17c4a7607e076e373107549609dd03eea37 java-21-openjdk-static-libs-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 4a36f6b33c9bec5c9c7376a1a118e428e1a5923d11a58551ad810f22857511a3 java-21-openjdk-demo-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 548643d2b47f8efc72a7d6f6f00b50de92c7a79abac764ed482404c92be1d37c java-21-openjdk-devel-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 71647ee96c749d7e061e12ed52d0a6f7b783cc09fd04abd0e4ee47585b85ad06 java-21-openjdk-demo-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 7d15a446622ec7518b315d06b036ad6dbe5ea4516143d676ceb48f67b6853f2c java-21-openjdk-devel-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm 89678b4f20e89e837935867b525dbb6ec7425712e730f55467d9460903b5cd15 java-21-openjdk-src-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm a2bbd17c6ed4ee3d3dd1b77a7e7a8f489970095485509cf67b224fdb73c438e5 java-21-openjdk-fastdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm aab99fceb4452a8436441aaf1f56bcfa0bf1fe751d9b2d48c09942b61a0ce904 java-21-openjdk-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm e8a7d70194ce18e3d467e4f63be0f3d068a18bf78fbca4138f1796a512f66a1f java-21-openjdk-jmods-slowdebug-21.0.6.0.7-1.el9.alma.1.x86_64.rpm f38bdd3ebc6d984e6efec5471e358d1530acd18b2494e4fff8eca842bc1554e5 ALSA-2025:0578 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tcp/dccp: Don&#39;t use timer_pending() in reqsk_queue_unlink(). (CVE-2024-50154) * kernel: arm64/sve: Discard stale CPU state when handling SVE traps (CVE-2024-50275) * kernel: i40e: fix race condition by adding filter's intermediate sync state (CVE-2024-53088) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.22.1.el9_5.x86_64.rpm 63edacc71a98a668a43026aace40d58d6191b5e7242e6e9bdc0350535b60d7b2 kernel-tools-libs-devel-5.14.0-503.22.1.el9_5.x86_64.rpm 6db3de81f59324e4606c197bcfe194f251c67b14f36cf2449cd432b92c2a8a01 libperf-5.14.0-503.22.1.el9_5.x86_64.rpm a2acbc1f934a0c9e3162868d5c98af38dddd112ca6cdd95d88e093e44a671fc0 ALSA-2025:0914 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Oct 2023) (CVE-2023-22084) * mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024) (CVE-2024-21096) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default mariadb-test-10.5.27-1.el9_5.x86_64.rpm 6c90b57a88bd26cc4b1b67e360e9c024d2dcca3c693cc293bb786669275553f8 mariadb-embedded-devel-10.5.27-1.el9_5.x86_64.rpm 9d13a0bedeb4464a683cf1ecd068d7b5727f65498b9b72d05ecb619ee32e62df mariadb-devel-10.5.27-1.el9_5.x86_64.rpm e0aaa9d794844fe373f9ebdae8c4e8ab109bbc3014919cefeaa34d467a1a79c5 ALSA-2025:0936 Copyright 2025 AlmaLinux OS 0 1 Moderate

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default mingw32-glib2-2.78.6-2.el9.noarch.rpm 128871448c9b21e7438cc3cd483f74cabf6ad09cafb61734200e78dde1ff505f mingw32-glib2-static-2.78.6-2.el9.noarch.rpm 14c2bcca8f6ae2d21d055d6512d0ab1fa9240841b82a53c8867c02309045b42c mingw64-glib2-static-2.78.6-2.el9.noarch.rpm 80af2ec3a3e874c32f2aea0701782b80a34937781e0e90351ad79d08faad2031 mingw64-glib2-2.78.6-2.el9.noarch.rpm 8db5e55d188be13f2170097af43b9038911ee0712db69a4a9363fe07c8ff5010 ALSA-2025:10136 Copyright 2025 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3-test-3.9.21-2.el9_6.1.i686.rpm 3039799f576ff0d8a791051fb84bcecf5fbeeb57524494c4cb80aff25658a034 python3-test-3.9.21-2.el9_6.1.x86_64.rpm 4bcc425d1486f4c73cde993ccfb4dd29616051b48be5d8324052671a45b508f5 python3-idle-3.9.21-2.el9_6.1.i686.rpm 6818af6e786a1f8663225bed3805579cfe9575bd007c0e7ea5644052ab94a20d python3-3.9.21-2.el9_6.1.i686.rpm 6a223eabebaad0c655953dd6f9c3fbd0cdcce4c0f0c2449f4257f98bf4652ef2 python3-debug-3.9.21-2.el9_6.1.x86_64.rpm 75ff5c7888463a2d316dfcf1e1178c2e52a35ce2269c8117dfafdc676766b15d python3-debug-3.9.21-2.el9_6.1.i686.rpm dc626d0ba99318fc5b15d15af112a3bf192130fa380aa7fd6ec16fdc9c76444e python3-tkinter-3.9.21-2.el9_6.1.i686.rpm ec34a06274151171b0862c15777b2293fecd1890a8fdab02819120c60bc22cf4 python3-idle-3.9.21-2.el9_6.1.x86_64.rpm ef63fb47f18b62147ce41b14aab84924561607172418ab6aec421368173cccf4 ALSA-2025:10148 Copyright 2025 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.11-debug-3.11.11-2.el9_6.1.i686.rpm 028938aeb5db8455a05040fc8ffa8ecaba5a10af9d876a5beae294491a8e6cf8 python3.11-tkinter-3.11.11-2.el9_6.1.i686.rpm 5c3454b9cbf7babe2c105e213ab5ad02e9c62ac53feae895ccb3c11b18354b4e python3.11-test-3.11.11-2.el9_6.1.i686.rpm 79b8776e823eda9e8a0491b5e52887d8aa952dc99ced81fb00c657b20662210c python3.11-test-3.11.11-2.el9_6.1.x86_64.rpm 8e978e74c9fdbda798b1342c771c765ab1ce886e6701de19f162486209ef14f0 python3.11-debug-3.11.11-2.el9_6.1.x86_64.rpm 9e27471642699c5dc8ba3ffb7621a923c5370189ea34da30e3de0c1fb5ce9f54 python3.11-idle-3.11.11-2.el9_6.1.i686.rpm c0dc088c454046083078c83e907763b45fa6a25d1b9720760dd1916c7e4a4c59 python3.11-3.11.11-2.el9_6.1.i686.rpm d9f2c04d7ede0c2dda239df30bcb14a9712689616b0bc323bc1170de3886a216 python3.11-idle-3.11.11-2.el9_6.1.x86_64.rpm ddcbe867816ea3bce13abf78bd50ad83fc7d0443118e3a3a1e0701b5c3c8fe91 ALSA-2025:10189 Copyright 2025 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435) * cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718) * cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330) * python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517) * cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.12-test-3.12.9-1.el9_6.1.x86_64.rpm 20fddc3815d761379f700730a2c35b46d5ab826c5bd8430794c011c929dc50ec python3.12-debug-3.12.9-1.el9_6.1.i686.rpm 62b49d170bc2817d00320dccddb4856ea2389954032e0d530934212e5e5a3c51 python3.12-tkinter-3.12.9-1.el9_6.1.i686.rpm 782b7ab9233576ab8d85fc95ac9c75b8ec964a1aba2a6d2fc8639bd550e85df8 python3.12-test-3.12.9-1.el9_6.1.i686.rpm 83191caef861634780e1bc6b13b9ebb66f06f94c323fe6be00abfc380889574a python3.12-idle-3.12.9-1.el9_6.1.x86_64.rpm b9b071adc1085f433bb678980a56217dead769cf457584b7c0494b5ec379eb5b python3.12-3.12.9-1.el9_6.1.i686.rpm c5cd2d818e34e2103a1cd9d3bd7c7c4d6e40ef1b438b1b6eb337b6f62cd5e6e1 python3.12-idle-3.12.9-1.el9_6.1.i686.rpm cdb31126ed23c832355817afb56aeb927c8d6d924db3d53d880e1523d3a785dc python3.12-debug-3.12.9-1.el9_6.1.x86_64.rpm f6f8764e9746fd6b66ef45b3712378d0a26f61c5d0b4881ec7ce34704d5912ec ALSA-2025:10379 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759) * kernel: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CVE-2025-21887) * kernel: net: atm: fix use after free in lec_send() (CVE-2025-22004) * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846) * kernel: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CVE-2025-37799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.25.1.el9_6.x86_64.rpm 754c1dfe6aea5dbcc449a753966c27e92baef6787a9c84066abf90173aea2acf libperf-5.14.0-570.25.1.el9_6.x86_64.rpm 7d5c7c5078220ca6fd1877bf89202a3e8d9b19b88ebdbe7154d8cf61fb4a25d7 kernel-tools-libs-devel-5.14.0-570.25.1.el9_6.x86_64.rpm 8ad8a04b4ec69f5a2f29e88fb91f87f89ed3cb3e229e2e24d61c6d6e26171154 ALSA-2025:10585 Copyright 2025 AlmaLinux OS 0 1 Moderate

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: jq has signed integer overflow in jv.c:jvp_array_write (CVE-2024-23337) * jq: AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVE-2025-48060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default jq-devel-1.6-17.el9_6.2.i686.rpm 89e2102bf4c8f5665161fee4c1f59aa3f1f97195dbcb7040be830dfce95d6441 jq-devel-1.6-17.el9_6.2.x86_64.rpm b80c5dc06c3d57a737b0f2d617c89f15ad96c3cdd3e623e85aa65d5d41b6c70b ALSA-2025:10837 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CVE-2025-21991) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.26.1.el9_6.x86_64.rpm 05476d6813e9be69adb0539b49947b6c0e73325697c4b22437c3d2008bac28dd kernel-tools-libs-devel-5.14.0-570.26.1.el9_6.x86_64.rpm 761fa6b70e098defe65e0864879e60ce770c371fd34c8a24b4896f5502636ba1 libperf-5.14.0-570.26.1.el9_6.x86_64.rpm 8207ee9aa0bce303adb4edcf2ff424f108bcd36f4f07adcce478e89a46f76a17 ALSA-2025:10862 Copyright 2025 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve scripting supports (CVE-2025-30761) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * On certain system configurations where the IPv4 stack was preferred over IPv6 (either due to -Djava.net.preferIPv4Stack=true being specified or no IPv6 interfaces being present), the method java.net.InetAddress.getLocalHost().getHostName() would return the fully qualified hostname instead of the short hostname. This behavior was only ever intended for Solaris systems and it deviated from the method's behavior for IPv6 interfaces. In this release, the method will return the short hostname on all interfaces. (AlmaLinux-102904, AlmaLinux-102905, AlmaLinux-102906, AlmaLinux-102907, AlmaLinux-102908, AlmaLinux-102909, AlmaLinux-102910, AlmaLinux-102911, AlmaLinux-102912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-1.8.0-openjdk-headless-fastdebug-1.8.0.462.b08-3.el9.x86_64.rpm 05eaf767e2e964f6bb64b8d17f9d03d5b77b29ed3ac744f89d85322f8c828145 java-1.8.0-openjdk-devel-fastdebug-1.8.0.462.b08-3.el9.x86_64.rpm 097255eb9a330831e1ec2c2983c2fa54249681062fb3eed53c1d2a2c269cd8d4 java-1.8.0-openjdk-demo-slowdebug-1.8.0.462.b08-3.el9.x86_64.rpm 7dd79e2a67b01d55c2ba6bb332a2d66c74dacad17c4ffa1916fef048573c9764 java-1.8.0-openjdk-src-fastdebug-1.8.0.462.b08-3.el9.x86_64.rpm 8cc1af622078ad5d3b74416dd292daf44c2a37838a4dd52d6c69f0380816f5bf java-1.8.0-openjdk-fastdebug-1.8.0.462.b08-3.el9.x86_64.rpm 98b0cd958220b28ff5a0c99a9a68169be67d33ab7d2392d0bfbc73be5a9f0458 java-1.8.0-openjdk-headless-slowdebug-1.8.0.462.b08-3.el9.x86_64.rpm bdd2764529953ff6171533de31275e1738b02fc85a949a0a28aa19064911937f java-1.8.0-openjdk-src-slowdebug-1.8.0.462.b08-3.el9.x86_64.rpm d597438a1596d3775f18616689d0dd6476ac3288585630d795147cd334067fef java-1.8.0-openjdk-slowdebug-1.8.0.462.b08-3.el9.x86_64.rpm db71125c65fb322fdf8d762d691d4245694fe1cd83f0ee243700bd7117117c79 java-1.8.0-openjdk-demo-fastdebug-1.8.0.462.b08-3.el9.x86_64.rpm e3cfde9c5a0606e0c4fe876832eed6db8dc5a2429f60759ba81867e2d48e8a6e java-1.8.0-openjdk-devel-slowdebug-1.8.0.462.b08-3.el9.x86_64.rpm ff18d137b5bd4ec4d926e68ec118ac1a8cac1955cf469a0c595693409e225ddf ALSA-2025:10867 Copyright 2025 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102668, AlmaLinux-102669, AlmaLinux-102670, AlmaLinux-102672) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-17-openjdk-demo-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 081c5c912029490ef2194f4599c1604368cb41e949e056d4325212cd9a85f86f java-17-openjdk-jmods-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 0e4a8eb4f587b414af917fdac709b83dce33b0863aef1377e69d024afc7eba3c java-17-openjdk-headless-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 2901a887a773a00bea897aa20a49b702a9f06093a6b7da0fb6f6e31414515bae java-17-openjdk-static-libs-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 34cdc7326f5d180ba0086eb5a6090f8f39d25ce89db52426ea9cd99cfbdf4d39 java-17-openjdk-demo-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 4b8ab7ec5b4be46c971d00fd639f98f70718a4f565daf3ba69fcbf73a09da05d java-17-openjdk-jmods-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 765bcb22918f8aeede94b3ed8f18ea237b85641ce42acfd5f17db36231557d99 java-17-openjdk-src-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 78ba35155f31f248aba6044c7d5437551f9c2953fdbfb28cb68f4819a0b900e6 java-17-openjdk-headless-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 7965c84c820ba9196cf775ac725e99c94b99e1d9a4db6256ca6cce8e7142f872 java-17-openjdk-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm 9964c1e9e63abff0adb61990f829e3843beac44530dbb20d69b49be3bb06275e java-17-openjdk-src-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm b21c3491105882349c37c34ffb0bec26519aa5b3c75a24825d91a24786725100 java-17-openjdk-devel-fastdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm bea2deba3558fde1a4de65567a8237a194a73da396807f2bff04494671f2c2d2 java-17-openjdk-devel-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm c5644e66e9faf95f58b2f419125152de3f9cb69be8a458add0f7b13e37bf7a69 java-17-openjdk-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm db4aa60c17abc9b7aa9c1374a29d29df386a5318911af835b2d8436c6c8f3348 java-17-openjdk-static-libs-slowdebug-17.0.16.0.8-2.el9.alma.1.x86_64.rpm f540f431bb4271ffb668d5a0ceb93bc2ee7ec704049dd0faaa9b799a559f7b8f ALSA-2025:10873 Copyright 2025 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better Glyph drawing (CVE-2025-30749) * JDK: Enhance TLS protocol support (CVE-2025-30754) * JDK: Improve HTTP client header handling (CVE-2025-50059) * JDK: Better Glyph drawing redux (CVE-2025-50106) Bug Fix(es): * In AlmaLinuxand AlmaLinux systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (AlmaLinux-102683, AlmaLinux-102684, AlmaLinux-102685) * On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (AlmaLinux-90307, AlmaLinux-90308, AlmaLinux-90311) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-21-openjdk-headless-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 070211d3a1c42f87de80f5ce474edb1b9d458b1535798abfb39ff1e3fe1b937a java-21-openjdk-headless-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 16ee1e42e319c03baff886532ddcb52bb6d4b999738c65917f4884f3b2e42d5c java-21-openjdk-devel-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 614a6238400acf25f7e5c2a4317db622eaa94d7b7ba506373b4d70448736f110 java-21-openjdk-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 67cdf294fbc103d338c1173f51d6c122ba430a88ad7c23d1af59d866725daa41 java-21-openjdk-src-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 71657c520fec5417901576cac1a7d364b128fab1042f09a922a71b8a7d1552b9 java-21-openjdk-static-libs-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 963854858d2141df112c94222d3bd6639757fd2ec3f1e7aa3009ea6c4bd73753 java-21-openjdk-jmods-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 98ec0e8b7f58915b1440f4959a00f3fde98dc7ecd61b3f4e24e7919f4dac4170 java-21-openjdk-demo-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm 9fe845aac9462f69d6e09f624c6b2341b1fd28875418a2046fe2c165b8d090ed java-21-openjdk-src-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm a7d0b51d708b804f9588653555826f2358b4be7a366b9b311144416d146f56fa java-21-openjdk-jmods-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm be03c6f257c4aeb541bd1e3e3f3f0294faf68a0841e874c2c82ffa34a39b8cd0 java-21-openjdk-devel-fastdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm c17b9ca350d53ae2cef4bbc7e3dc364baf35c796cb131a549963c072ec23383d java-21-openjdk-demo-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm d30f8cee201c256cd5e6bbe988f715e2adc7b80650a90fa97a456198339c5dc2 java-21-openjdk-static-libs-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm def9614ee3f8e617b4d6728d4826a5939f5b89cca10d91cb9115c9809ebe5099 java-21-openjdk-slowdebug-21.0.8.0.9-1.el9.alma.1.x86_64.rpm fc8467f3e52abc875241af444e32b963165b1aafdc668ccebdac67010503ecdf ALSA-2025:11140 Copyright 2025 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer overflow in set_connect_msg() (CVE-2024-52533) * glib: Buffer Underflow on GLib through glib/gstring.c via function g_string_insert_unichar (CVE-2025-4373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default glib2-static-2.68.4-16.el9_6.2.x86_64.rpm 6acfdcf55949c2caff0814b6a37256a7d07bd3486e82bb55a418acd9ff5db46c glib2-static-2.68.4-16.el9_6.2.i686.rpm d7bea87ba1ce390ec17290621d19101e0d7877787e755c2acca4904f3f19ea38 ALSA-2025:11411 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Remove dangling pointers (CVE-2024-58002) * kernel: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CVE-2025-38089) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.28.1.el9_6.x86_64.rpm 131f423d454005180ab8276e161f8c58c8e211e0011dd8dc43451c2e561b00de libperf-5.14.0-570.28.1.el9_6.x86_64.rpm 24af50283fe6bc7223515f91b827d1582418acbdf7c3ac601b2e1cce236380fc kernel-cross-headers-5.14.0-570.28.1.el9_6.x86_64.rpm 3eb99270790161daeab95b73edba461b901a52ca4da588fb4b9424e26b2a08b8 ALSA-2025:11849 Copyright 2025 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound Cache poisoning (CVE-2025-5994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default unbound-devel-1.16.2-19.el9_6.1.x86_64.rpm 2fc193c1f05456b1634693f50fff68f73245ca6e3d9aa332e9a7e3d61a9cd32b unbound-devel-1.16.2-19.el9_6.1.i686.rpm 4518668ccb9ddcacda2e74d3b1c6a46488f6b19533b503e3fcb44d60514b703e ALSA-2025:11861 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Fix double free in error path (CVE-2024-57980) * kernel: wifi: iwlwifi: limit printed string from FW file (CVE-2025-21905) * kernel: RDMA/mlx5: Fix page_size variable overflow (CVE-2025-22091) * kernel: ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CVE-2025-22121) * kernel: ext4: avoid journaling sb update on error if journal is destroying (CVE-2025-22113) * kernel: RDMA/core: Fix use-after-free when rename device name (CVE-2025-22085) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class handling (CVE-2025-37797) * kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry (CVE-2025-37958) * kernel: net: ch9200: fix uninitialised access during mii_nway_restart (CVE-2025-38086) * kernel: net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CVE-2025-38110) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.30.1.el9_6.x86_64.rpm 14da64d02d018ef7153eaf4183ec7db8fdafec28be8c71a58a9138bf36ef3f48 kernel-tools-libs-devel-5.14.0-570.30.1.el9_6.x86_64.rpm 189b95c7f8cea032171beadd3c36e81a63e77d4d8df7d29a690b64f3194e5078 kernel-cross-headers-5.14.0-570.30.1.el9_6.x86_64.rpm 9cdf864a72e6eda93c67db3117bcf42ebc1851706b7e1dc8ec035164a7559d74 ALSA-2025:1262 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-tools-libs-devel-5.14.0-503.23.2.el9_5.x86_64.rpm 29ebaab8ccd8ac674cf0c280b554af2313f66bb99c853212219196fdb045c124 kernel-cross-headers-5.14.0-503.23.2.el9_5.x86_64.rpm 29f8d335f5d4292383a1ba7b4c602ec68ea52b657b0b54e54d1b53d2986ed1da libperf-5.14.0-503.23.2.el9_5.x86_64.rpm 2f28ace352498c5542df89d021cd451ef1eb51f48190bdd6466eee9edfce6f5f ALSA-2025:12746 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: padata: fix UAF in padata_reorder (CVE-2025-21727) * kernel: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CVE-2025-21928) * kernel: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CVE-2025-21929) * kernel: cifs: Fix integer overflow while processing closetimeo mount option (CVE-2025-21962) * kernel: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CVE-2025-22020) * kernel: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CVE-2022-49788) * kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CVE-2025-37890) * kernel: net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CVE-2025-38052) * kernel: net/sched: fix use-after-free in taprio_dev_notifier (CVE-2025-38087) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.32.1.el9_6.x86_64.rpm 1f6bb44d32a32d90c424a3f119ae791b82f838f2ecbe8c28f49a9b2e8cc62fa4 kernel-cross-headers-5.14.0-570.32.1.el9_6.x86_64.rpm 666717a7de2fbae18029a4f1838dba70b0598106d1755cf72d3687ee38709913 kernel-tools-libs-devel-5.14.0-570.32.1.el9_6.x86_64.rpm 818e07e629f5ce30654522075f3e0b727f849b1a29ad989615bef13c710ac95f ALSA-2025:12834 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12-setuptools security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.12-setuptools-wheel-68.2.2-5.el9_6.noarch.rpm 83201e0efc35e4acac2f56109e56c0bfecd0dcf82c365da609724664ce30f19b ALSA-2025:1329 Copyright 2025 AlmaLinux OS 0 1 Moderate

doxygen security update

Doxygen can generate an online class browser (in HTML) and/or a reference manual (in LaTeX) from a set of documented source files. The documentation is extracted directly from the sources. Doxygen can also be configured to extract the code structure from undocumented source files. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default doxygen-doxywizard-1.9.1-12.el9_5.x86_64.rpm 125258800d371b061f43b5a4f436f88498c037bd71f90227cc6dfca7b12bd2a1 doxygen-1.9.1-12.el9_5.x86_64.rpm 1a3805714b10fda2306befbf02340993eba7999415c7865c746fafd82e391279 doxygen-latex-1.9.1-12.el9_5.x86_64.rpm ac280611b223d1d40dc3210577fa4758530b0054dde53c80533d56b63e6deb59 ALSA-2025:1346 Copyright 2025 AlmaLinux OS 0 1 Moderate

gcc security update

The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries. Security Fix(es): * jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default gcc-plugin-devel-11.5.0-5.el9_5.alma.1.x86_64.rpm 8e30bfd5da83fee789bbd84d13343459d4e14f86dd7d65ef95be500019c3ce96 gcc-plugin-devel-11.5.0-5.el9_5.alma.1.i686.rpm a84517333fe9767e45da814eaf023382d9256684bda718542fc484c1d954d331 libstdc++-static-11.5.0-5.el9_5.alma.1.x86_64.rpm b4f08d98b29ddf3ecaf03f238ee04866f1d7ffe2712549c57eddd887e21c82e2 libstdc++-static-11.5.0-5.el9_5.alma.1.i686.rpm e7371fdd1525ff3e7db6b12619827e3d506346ecb0f1d997c060e6b176b6b7ce ALSA-2025:13602 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): The kernel packages contain the Linux kernel, the core of any Linux operating system. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_hash - fix double free in hash_accept (CVE-2025-38079) * kernel: wifi: ath12k: fix invalid access to memory (CVE-2025-38292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.33.2.el9_6.x86_64.rpm 05895065966737a911bae35bc9d2487812cb45de148efac5e9aa0f79f90d0ba2 kernel-tools-libs-devel-5.14.0-570.33.2.el9_6.x86_64.rpm 38097b3251ff047ef4397e7d83b9aa5f3e539c4a709a83111a331867183b25b7 kernel-cross-headers-5.14.0-570.33.2.el9_6.x86_64.rpm 7c865443a1255e457471544104af504c72a20ec81722caea08ff898aec55b095 ALSA-2025:13962 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CVE-2025-21867) * microcode_ctl: From CVEorg collector (CVE-2024-28956) * kernel: mm/hugetlb: unshare page tables during VMA split, not before (CVE-2025-38084) * kernel: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (CVE-2025-38085) * kernel: net: fix udp gso skb_segment after pull from frag_list (CVE-2025-38124) * kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CVE-2025-38159) * kernel: Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CVE-2025-38250) * kernel: i2c/designware: Fix an initialization issue (CVE-2025-38380) * kernel: tls: always refresh the queue when reading sock (CVE-2025-38471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.35.1.el9_6.x86_64.rpm 2a9c182c2c653f75bd4659057d8ad4efac08e21f1748ed60aeff07a87f4d4290 kernel-tools-libs-devel-5.14.0-570.35.1.el9_6.x86_64.rpm 5a7591df4fed400cab07469fbfb657ee737592489ed40edcdd30c6c9f8a3a92e libperf-5.14.0-570.35.1.el9_6.x86_64.rpm f59c890db9d629bd38f156eda9a934e8e14a5ebb8502b96bf460a002050c4a7c ALSA-2025:14420 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Fix memory accounting leak. (CVE-2025-22058) * kernel: net_sched: ets: Fix double list add in class with netem as child qdisc (CVE-2025-37914) * kernel: ice: fix eswitch code memory leak in reset scenario (CVE-2025-38417) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.37.1.el9_6.x86_64.rpm 5a2449a723e888f6e51c5f1027af3235d6284ef6fc97821986d609a061510965 kernel-tools-libs-devel-5.14.0-570.37.1.el9_6.x86_64.rpm 93f3031243b3851250fa42a09049d60386501268ebdfaf4d434359d0ea00b6c7 libperf-5.14.0-570.37.1.el9_6.x86_64.rpm df2d20e92cd663f07dc0653293b4c7e43d0ff088bc5f43350433fcfd5c9a0b25 ALSA-2025:14878 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715) * postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default postgresql-static-13.22-1.el9_6.x86_64.rpm 1567d1ff5ccc7395ff361185183465a04fcd0f20fceaf523a2c5de1b9e83cdc7 postgresql-upgrade-devel-13.22-1.el9_6.x86_64.rpm 376d393cd9fb851c723847ebb10b0d2c01676020a3ddafcad5e67e1eaf502a54 postgresql-private-devel-13.22-1.el9_6.x86_64.rpm 867c79aea99f278ee264ac3dbbc0a1cbd96c10f4eea6b95378f32c99db0e85ce postgresql-test-rpm-macros-13.22-1.el9_6.noarch.rpm 88c18db9bf4a72203801e595dd0f50c658e931d0189ebe0d2fb782adc972a2bf postgresql-docs-13.22-1.el9_6.x86_64.rpm ace9809fdb2d23948afd5f75f58a55e957f11f07c900132144852a1ca123bb2a postgresql-server-devel-13.22-1.el9_6.x86_64.rpm cabb9ba0dfce761004358d037c7bc428f0632ea5ab9012666e42f80f2de69b53 postgresql-test-13.22-1.el9_6.x86_64.rpm eccb3f06a02f6f2198b9728cadfd5aecef678d81f48843a4a1836ed0d6a4bf79 ALSA-2025:15007 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.12-test-3.12.9-1.el9_6.2.i686.rpm 206c23ad83213dd64830a05adc52ee18e41607fc582ad4bb33cf14e5307558a1 python3.12-debug-3.12.9-1.el9_6.2.i686.rpm 335ee190ff6ae2c7e0bb91dc0f512ffc03d40112dd1abc1bef28286981970597 python3.12-tkinter-3.12.9-1.el9_6.2.i686.rpm 5baa2fb33fa859135d24dcde156e2802c1973628e1752fb386389832bb667f9e python3.12-test-3.12.9-1.el9_6.2.x86_64.rpm 98f7524b50b601716be239f559703082ef16e4489407643f061f4c6d4b1777d9 python3.12-debug-3.12.9-1.el9_6.2.x86_64.rpm 9a79538654fbf71ad43d5d05f4ca27224d6d7be4d18b4ff85e4012279de6d1c3 python3.12-idle-3.12.9-1.el9_6.2.i686.rpm bed352f29fb61df141122b9be746214c1171eefd33be7c20d907642f83943c70 python3.12-idle-3.12.9-1.el9_6.2.x86_64.rpm e8c8ca5a4e9cddb79ac468b89e72a31451117148bffcbcae0f1b9af2e6852163 python3.12-3.12.9-1.el9_6.2.i686.rpm e951bd065e0657f1bc00d4c9aeb1e35461cc3fc9da772b6bf41b0dc28f3845fd ALSA-2025:15010 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.11-debug-3.11.11-2.el9_6.2.x86_64.rpm 4185cdee497780c62c1a040c2f377b9606f110d1cc2238f3c39218a35d362606 python3.11-3.11.11-2.el9_6.2.i686.rpm 4943d3dbbb61c9054a9f14605d19ebd88c5c5aeb596e8f939487488c3dafcf47 python3.11-test-3.11.11-2.el9_6.2.i686.rpm 560e21d4ef3445606db7d20d8e7273bf00cd09144d93f4435ff2417a1f1d3595 python3.11-idle-3.11.11-2.el9_6.2.x86_64.rpm 809df6c76e69d7bedf87258cf978885f62685fa6fc4bd9384f0c6c7274067074 python3.11-test-3.11.11-2.el9_6.2.x86_64.rpm cd7b86d52f4bee382aeedc3ee337e39a4c9434d0057afcec37d3c830c60b8e4b python3.11-debug-3.11.11-2.el9_6.2.i686.rpm d1a063d6c659bc99fb71be9438e07977eebcdc09b617145ba75d5ac2d69673ef python3.11-idle-3.11.11-2.el9_6.2.i686.rpm e75afd8a2f0e421df0d84d7b681bf7b2b8b28b3480006830869ff7b2493d8ad1 python3.11-tkinter-3.11.11-2.el9_6.2.i686.rpm e7df3624448c8ac7a45b37475aa4871048f48734a2b4ce7695cbc45f6af7f352 ALSA-2025:15011 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CVE-2025-37823) * kernel: i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CVE-2025-38200) * kernel: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CVE-2025-38211) * kernel: net/sched: Always pass notifications when child class becomes empty (CVE-2025-38350) * kernel: tipc: Fix use-after-free in tipc_conn_close() (CVE-2025-38464) * kernel: vsock: Fix transport_* TOCTOU (CVE-2025-38461) * kernel: xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CVE-2025-38500) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.39.1.el9_6.x86_64.rpm 1235ce8a8137187ca4b499cb7bcce0e24fb2f4ed598e71711afebc2f6f1c9569 kernel-tools-libs-devel-5.14.0-570.39.1.el9_6.x86_64.rpm 5c7047266fbe0e4583c3f0e6c5b4aa909d8debe9a77e9811aa751dbda18abfff libperf-5.14.0-570.39.1.el9_6.x86_64.rpm 8b2f2b63f469b27ac0730271b30fbe834f3271f3405fe5d1c48fa6d55c153edb ALSA-2025:15018 Copyright 2025 AlmaLinux OS 0 1 Important

udisks2 security update

The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies. Security Fix(es): * udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libudisks2-devel-2.9.4-11.el9_6.1.i686.rpm 0cf2e6223edf6a54ef87f4324aea71107c582cb7d5479badcdc0dcabb806559e libudisks2-devel-2.9.4-11.el9_6.1.x86_64.rpm ea216f4fbfd71ae5e6263efba833b5122971088341f5db5ae95ced8f6b41143c ALSA-2025:15019 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Cpython infinite loop when parsing a tarfile (CVE-2025-8194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3-debug-3.9.21-2.el9_6.2.i686.rpm 0092c84135930ac567d168faa423ef4e0408d989390d1917ad64d1b6e2242569 python3-idle-3.9.21-2.el9_6.2.x86_64.rpm 20cbbcbc8e7e6b467d9834f07a0f69a024fa09ff2fc78af4112ac3708261aff8 python3-tkinter-3.9.21-2.el9_6.2.i686.rpm 441e3a0b983f479bf25ff72ff2d26fde02aeb3784080dcf2147a8e02c4ce3104 python3-debug-3.9.21-2.el9_6.2.x86_64.rpm 4b69779c7d6fb91ca0b8f18190b70e85d1e3979025d0a0dbd3b05489011aa956 python3-idle-3.9.21-2.el9_6.2.i686.rpm 7f0ee4c0f4691da89ee6808b422539375d7a61e3ac4bfa23ac8328e9b99f03a6 python3-3.9.21-2.el9_6.2.i686.rpm 9f17c8cacd830c163f15f73c91282e58297972dcefef51aba5a8480d1ea9df2d python3-test-3.9.21-2.el9_6.2.x86_64.rpm b4bb1d8d9d1d139f21d0c54f1f18c0393b8ed3c8e2fe6bbe5541cbb0ce6f96b9 python3-test-3.9.21-2.el9_6.2.i686.rpm cad8303e2b603ffcc95dfc38405dcaf7b6f1effb670c160cfe616c15a209923c ALSA-2025:15429 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udmabuf: fix a buf size overflow issue during udmabuf creation (CVE-2025-37803) * kernel: idpf: convert control queue mutex to a spinlock (CVE-2025-38392) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.41.1.el9_6.x86_64.rpm 4355d8fbc41685e97cabfc59ea4270473f4c06e000dd91cc7c8a9b0fb136e300 kernel-cross-headers-5.14.0-570.41.1.el9_6.x86_64.rpm 46c0955d5ad92cd4afbe0826279795f95c3b84bf0d65f2a403460e00bf23f24e libperf-5.14.0-570.41.1.el9_6.x86_64.rpm 7616b26e708b9b067f31238c56ab0de40f9bb6f5de3f53a357c26a02a87d16dd ALSA-2025:15661 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/vkms: Fix use after free and double free on init error (CVE-2025-22097) * kernel: scsi: lpfc: Use memcpy() for BIOS version (CVE-2025-38332) * kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CVE-2025-38352) * kernel: drm/gem: Acquire references on GEM handles for framebuffers (CVE-2025-38449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.42.2.el9_6.x86_64.rpm 37bc9d2d6e009983eb46500f5b7e0202f0e8e593f3957d45b7fda3656c5df52a kernel-cross-headers-5.14.0-570.42.2.el9_6.x86_64.rpm 6f526dfc56cf511c3ee6231cac4deff3dd66b958e8546902d9cf3de9a6f4bdd9 libperf-5.14.0-570.42.2.el9_6.x86_64.rpm ad7c880347e03063364a2c7fae5824c835e37e0f82da547814b5f2dff6dae298 ALSA-2025:15740 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CVE-2025-38550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.44.1.el9_6.x86_64.rpm 12e00c4bf819c9241b77753e10daaa6932d0bda89ea67bb0726c1f9d059db273 kernel-tools-libs-devel-5.14.0-570.44.1.el9_6.x86_64.rpm 4493c303e723fa2ac574238330adefe483e77cd3c2e9f855b7482c34362839f7 kernel-cross-headers-5.14.0-570.44.1.el9_6.x86_64.rpm 91149c5bf227d2fa7f03b84f29e76f5e96c2dfd03a6326737ee2f0e6e9882a54 ALSA-2025:16086 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688) * mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699) * mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687) * mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696) * mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705) * mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575) * mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685) * mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581) * mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) * mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584) * mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092) * mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077) * mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085) * mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082) * mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087) * mysql: Replication unspecified vulnerability (CPU Jul 2025) (CVE-2025-53023) * mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084) * mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100) * mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098) * mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096) * mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default mysql-devel-8.0.43-1.el9_6.x86_64.rpm 956ff7162e1d68319d1318bfe5159410e557c61b037b45d48da0d93d13db7aba mysql-libs-8.0.43-1.el9_6.x86_64.rpm a1589d64359134c6ae90838662bc5216dddd02d75feb1dde81dce5afcf5cac8d mysql-test-8.0.43-1.el9_6.x86_64.rpm fbb3a3edd7235afdf951af8f8e3167f816db7c94523c9a6ae9ad13af3cb9604c ALSA-2025:16398 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: usb: smsc75xx: Limit packet length to skb->len (CVE-2023-53125) * kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length (CVE-2025-37810) * kernel: do_change_type(): refuse to operate on unmounted/not ours mounts (CVE-2025-38498) * kernel: s390/sclp: Fix SCCB present check (CVE-2025-39694) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.46.1.el9_6.x86_64.rpm 0c6c01506ffa4757c58238159e166a34db138ff2026c591c84c713f85785c15b kernel-tools-libs-devel-5.14.0-570.46.1.el9_6.x86_64.rpm 57fec4cd0962bc66df8ce31f420998dc0f981efde86bb02ae38c7ef5c6cd3cc8 kernel-cross-headers-5.14.0-570.46.1.el9_6.x86_64.rpm 8fda291e9e1cd73eff0f42ec5a1e4cd65e2a7c10745e7beeab6466448425c2a6 ALSA-2025:1659 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: mm: migrate: fix getting incorrect page mapping during page migration (CVE-2023-52490) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.26.1.el9_5.x86_64.rpm 5e258af1c7e553fc7b1522d9fd0cba7b9b5d2c556f02fe097e917262e2a0b493 libperf-5.14.0-503.26.1.el9_5.x86_64.rpm b70740c4f3e85c6126e4feef3c1364fa6d92dfb126abd462b6856df576516c26 kernel-tools-libs-devel-5.14.0-503.26.1.el9_5.x86_64.rpm bc6a28c6cba9668df7d0a8b61e55725aaf2d7d61b8a071645f060199ad3d2a50 ALSA-2025:1670 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) * bind: bind9: DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (CVE-2024-12705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default bind9.18-devel-9.18.29-1.el9_5.1.x86_64.rpm 503159595bdb7f23db0745b4827135a3bca3b202f62986db3162f3d7f54a8f76 bind9.18-doc-9.18.29-1.el9_5.1.noarch.rpm 77c63238095876975f73c8eaaf24d184ac4b256cba65b144aebfaaff277235c2 bind9.18-devel-9.18.29-1.el9_5.1.i686.rpm e55d00af0263df5cf6cfeedac00525d9c0e2f0aa85c0799f8d81b61ad9aede05 bind9.18-libs-9.18.29-1.el9_5.1.i686.rpm e7b2c5c85f9f11b9f2b8e94d14025fb667f6be5ddbdc67997c1bed960f76f686 ALSA-2025:1671 Copyright 2025 AlmaLinux OS 0 1 Important

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * openssl: SSL_select_next_proto buffer overread (CVE-2024-5535) * krb5: GSS message token handling (CVE-2024-37371) * curl: libcurl: ASN.1 date parser overread (CVE-2024-7264) * mysql: Thread Pooling unspecified vulnerability (CPU Oct 2024) (CVE-2024-21238) * mysql: X Plugin unspecified vulnerability (CPU Oct 2024) (CVE-2024-21196) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21241) * mysql: Client programs unspecified vulnerability (CPU Oct 2024) (CVE-2024-21231) * mysql: Information Schema unspecified vulnerability (CPU Oct 2024) (CVE-2024-21197) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21218) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21201) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21236) * mysql: Group Replication GCS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21237) * mysql: FTS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21203) * mysql: Health Monitor unspecified vulnerability (CPU Oct 2024) (CVE-2024-21212) * mysql: DML unspecified vulnerability (CPU Oct 2024) (CVE-2024-21219) * mysql: Optimizer unspecified vulnerability (CPU Oct 2024) (CVE-2024-21230) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21213) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21194) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21199) * mysql: PS unspecified vulnerability (CPU Oct 2024) (CVE-2024-21193) * mysql: DDL unspecified vulnerability (CPU Oct 2024) (CVE-2024-21198) * mysql: mysqldump unspecified vulnerability (CPU Oct 2024) (CVE-2024-21247) * mysql: InnoDB unspecified vulnerability (CPU Oct 2024) (CVE-2024-21239) * curl: curl netrc password leak (CVE-2024-11053) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21497) * mysql: MySQL Server Options Vulnerability (CVE-2025-21520) * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mysql: Information Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21529) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21531) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21504) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21540) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21555) * mysql: Packaging unspecified vulnerability (CPU Jan 2025) (CVE-2025-21543) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21491) * mysql: DDL unspecified vulnerability (CPU Jan 2025) (CVE-2025-21525) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21536) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2025) (CVE-2025-21521) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21501) * mysql: Performance Schema unspecified vulnerability (CPU Jan 2025) (CVE-2025-21534) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21494) * mysql: Privileges unspecified vulnerability (CPU Jan 2025) (CVE-2025-21519) * mysql: Parser unspecified vulnerability (CPU Jan 2025) (CVE-2025-21522) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21503) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21518) * mysql: MySQL Server InnoDB Denial of Service and Unauthorized Data Modification Vulnerability (CVE-2025-21559) * mysql: Privilege Misuse in MySQL Server Security Component (CVE-2025-21546) * mysql: Optimizer unspecified vulnerability (CPU Jan 2025) (CVE-2025-21500) * mysql: InnoDB unspecified vulnerability (CPU Jan 2025) (CVE-2025-21523) * mysql: Components Services unspecified vulnerability (CPU Jan 2025) (CVE-2025-21505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default mysql-devel-8.0.41-2.el9_5.x86_64.rpm 5244f97c5ae51272ab3b8fc3bca747ebaa69dc5bfe347121b464a33930807728 mysql-libs-8.0.41-2.el9_5.x86_64.rpm b401075a379a99ed69a6ea73ddd8dcc26147711ffcf3b9367de4a07593e6816e mysql-test-8.0.41-2.el9_5.x86_64.rpm c5cfd224ff1476aa49501795be03b3245779cfba36a9e2f69950a3564402c370 ALSA-2025:1681 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: Many records in the additional section cause CPU exhaustion (CVE-2024-11187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default bind-doc-9.16.23-24.el9_5.3.noarch.rpm 045097af79111a6f6690a054d83f198561c6696a82ba817f9b4b1ca59004895a bind-devel-9.16.23-24.el9_5.3.i686.rpm 395c5cb205d49a47be6f778f9dc03edf462ab647d5b8a9c990e3baa82b780d1f bind-devel-9.16.23-24.el9_5.3.x86_64.rpm 6d1dcdf990315263a8cf5ddd549ac61cc7063d60f32dfd3ff3d0e4860c35f337 bind-libs-9.16.23-24.el9_5.3.i686.rpm b8d7a7b9269757b5dff71dc3a2238407e6deebda0c49ca9e79b054f584a9a729 ALSA-2025:16880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CVE-2025-38472) * kernel: smb: client: fix use-after-free in cifs_oplock_break (CVE-2025-38527) * kernel: sctp: linearize cloned gso packets in sctp_rcv (CVE-2025-38718) * kernel: tls: fix handling of zero-length records on the rx_list (CVE-2025-39682) * kernel: io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CVE-2025-39698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.49.1.el9_6.x86_64.rpm 339e09bb742818b4b15ce3885800f1396f7c8865923d99599fa19f39247ce712 libperf-5.14.0-570.49.1.el9_6.x86_64.rpm 6a6b7ef38b69eb45f54b90f3aef33c175d7c0635c5735f9ca8fbba8d7b4bd713 kernel-tools-libs-devel-5.14.0-570.49.1.el9_6.x86_64.rpm 98c8c4d92ed4a2e659ba6cc9c26302287c6431efa52031b9684623879c39ce85 ALSA-2025:17084 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.5.noarch.rpm f11bab0e5d897b89c5f9cda819ac846db881e4a46077033f48563660e1fc9dd3 ALSA-2025:17162 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fix(es): * JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON (CVE-2025-40928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default perl-JSON-XS-4.04-1.el9_6.x86_64.rpm 006141aff190c02b3ba9ec690468d22a79e8cfc29a1821a8046d122516b11929 ALSA-2025:17377 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: security/keys: fix slab-out-of-bounds in key_task_permission (CVE-2024-50301) * kernel: KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CVE-2025-38351) * kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVE-2025-39761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.51.1.el9_6.x86_64.rpm 02ec8f0e6252c88db230367afc73d3626ae440827d5087a511e37cd80d43eb1d kernel-cross-headers-5.14.0-570.51.1.el9_6.x86_64.rpm 4155a9b31570283bdfe7178982556b0b2c6e90b992a6f5f8dd81f2b7dde517d0 libperf-5.14.0-570.51.1.el9_6.x86_64.rpm 534a5e5df45a833cea3d56d55ce0c23326757481e5305a459dad9a3d731fc9bd ALSA-2025:1742 Copyright 2025 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVE-2025-1094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default postgresql-server-devel-13.20-1.el9_5.x86_64.rpm 14b850bea40be22af0b5a654ea4e553605444fd12a6e5bbfa25e055570f034d3 postgresql-test-rpm-macros-13.20-1.el9_5.noarch.rpm 167bf6673ce0e88f70019e49d0937948c321511b6c62d9f015003e4796450bab postgresql-private-devel-13.20-1.el9_5.x86_64.rpm 2dd8d2bdc36374637c792fbd18e5fa219e557b3a995d6154acf261f45bb1138c postgresql-test-13.20-1.el9_5.x86_64.rpm 367ad51b0fb3136b9a0a8e27cfda0af7d1b531f4e7986ea4c5c5796d14d0a542 postgresql-static-13.20-1.el9_5.x86_64.rpm 7e07ff7adb89bd69d9e1392e37965f62dd610adfbffe03b593f4b8634c426d01 postgresql-docs-13.20-1.el9_5.x86_64.rpm 83bd72a86c6a3b27f494db7219264f333cc1319fb128c557a363797dd7f691c3 postgresql-upgrade-devel-13.20-1.el9_5.x86_64.rpm da707d464e7d5da0590185a9ff2f0538ee69b60769ab23cde752af7dec85a011 ALSA-2025:17760 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: core: Harden s32ton() against conversion to 0 bits (CVE-2025-38556) * kernel: eventpoll: Fix semi-unbounded recursion (CVE-2025-38614) * kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757) * kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.52.1.el9_6.x86_64.rpm 0cd9ff00f99fc9be375193db1f6d1f19c830dd41c3fd6175da6a437392fe3ccb libperf-5.14.0-570.52.1.el9_6.x86_64.rpm 70dbb90f3e01440b0bc1ef58162eb2c295e1dc1853c9c173a028754035438375 kernel-tools-libs-devel-5.14.0-570.52.1.el9_6.x86_64.rpm da1cb2fcf21d536036cf3039ffef247af4bb6cffb5811c1b754a28844733a3d2 ALSA-2025:18149 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.121-1.el9_6.x86_64.rpm 3b20ca41e78294eafa01d69383dbe31f6f4ac22ccbb985ce9775dcd8c91ed6c0 ALSA-2025:18151 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es): * dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315) * dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.111-1.el9_6.x86_64.rpm 357394aa83b12f3d58b9b047cb09f97099b696108ebfa74855064853001a148f ALSA-2025:18281 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: don't ignore the return code of svc_proc_register() (CVE-2025-22026) * kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (CVE-2022-50087) * kernel: sunrpc: fix client side handling of tls alerts (CVE-2025-38571) * kernel: sunrpc: fix handling of server side tls alerts (CVE-2025-38566) * kernel: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CVE-2025-39817) * kernel: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CVE-2025-39849) * kernel: scsi: lpfc: Fix buffer free/clear order in deferred receive path (CVE-2025-39841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.55.1.el9_6.x86_64.rpm 269e2658980b4c643cfc01d1542867022490f96d5de3376d992fb99954311157 kernel-cross-headers-5.14.0-570.55.1.el9_6.x86_64.rpm 7e7298ec6ac8f97d8172dbfe71f880fedefecb5a85cbdf6546980cd456776896 libperf-5.14.0-570.55.1.el9_6.x86_64.rpm bdcde0fd73a0812eeb89644538957aeaabbe2df0b0048a84df20ee622e7805c1 ALSA-2025:18815 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) Bug Fix(es): * Since the 8.8 release of AlmaLinuxand the 9.2 release of AlmaLinux OpenJDK 8 has used a single build repackaged for each major AlmaLinux release. With this release, this same build is now also used by the following older releases: 8.2, 8.4, 8.6, and 9.0. On AlmaLinux systems, this means that OpenJDK's FIPS mode will now be enabled by default when the system is in FIPS mode. To revert to the previous behaviour, use -Dcom.AlmaLinux.fips=false (AlmaLinux-118777, AlmaLinux-118778, AlmaLinux-118779, AlmaLinux-118782) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-1.8.0-openjdk-fastdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 019e5cd67c5504bb7ae2a0430200fa38f0f569ac9de332e0829aa04265954e19 java-1.8.0-openjdk-devel-fastdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 478590ae8809439657407856a7e29f9adc164311cf0bc812b6da36a8f7b717e9 java-1.8.0-openjdk-slowdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 691e3d163085aee6f3311d9744d5ca055d8a9476a5b6f1ff8ab1700e41787f11 java-1.8.0-openjdk-demo-fastdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 76f5cce1566e4217a31c4af3ef87a4d495fd682b39566ea555c6cddc4b9af4e1 java-1.8.0-openjdk-src-fastdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 7cde14cf088625a29802184f65358adb13bfce673805e1acfb694f0732bc3102 java-1.8.0-openjdk-demo-slowdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm 8688ec396e0ba9a44c74f6eb4b18add4e63f60768bedef8f965e3a91bd765b85 java-1.8.0-openjdk-headless-fastdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm c90baa9514ee78c6c93db9f7ba4a6fb25b76addbb21c7eb4d206bad2315e9daa java-1.8.0-openjdk-headless-slowdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm dfdb5af4755220e9baa137a0c28ba2a493191995b5f9f500bd1599bec300480d java-1.8.0-openjdk-devel-slowdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm e24d547dd0a05a403a81cf50dcf071739c67d5a5667f3aedb08d0f2a41807aab java-1.8.0-openjdk-src-slowdebug-1.8.0.472.b08-1.el9.alma.1.x86_64.rpm fa977ace2bd0c357cd1629c49f5a3dc5bc841547e68bebf71c9654909dad3c41 ALSA-2025:18821 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) Bug Fix(es): * Since the 8.8 release of AlmaLinuxand the 9.2 release of AlmaLinux OpenJDK 17 has used a single build repackaged for each major AlmaLinux release. With this release, this same build is now also used by the following older releases: 8.4, 8.6 and 9.0 (AlmaLinux-118788, AlmaLinux-118789, AlmaLinux-118792) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-17-openjdk-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 087a9113260e3a157ded3d61526514033970987e6d07dd7cef27216c339c686c java-17-openjdk-static-libs-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 24cfceba8e0e409d9d9080c0879502a21af01b2e23222881b21b0ef1ba7ffa41 java-17-openjdk-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 24e96779fb117e97a677f52c1b728b76d93f102deb1d94aaf02842c4368c86bf java-17-openjdk-demo-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 289ca72351a0c6f504fbb0af4f63f7eda745dac8e01f0d1a4ff7322454748a5d java-17-openjdk-devel-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 2e0c11b5a80d3f84435b9710685395bc136ef7806b942c55a5808dff69a455f5 java-17-openjdk-jmods-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 456749fd5a0ddab5cb734a2a3341b89f5b1f07348122a11dd140e0f2dde71b44 java-17-openjdk-headless-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 52e843399677fc3909643c60da284ebdb8739fa3ea0ae540bab7eeee9f5bfac9 java-17-openjdk-static-libs-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 5305b813bbac2458a813b38d5da60bfd805632d081081405fb82e3b61dc56331 java-17-openjdk-src-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 8ae73d46bbb2333f3109f32b099523d241761e5f0cc82a20044960641cb99c0e java-17-openjdk-src-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm 9f82124b636a4f60b3072ec11d6da56dc0dc78ddf5f2ef6a28d063d3687feb40 java-17-openjdk-jmods-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm bf5ed4356f2e621f8d4262c5100c87877f55b245313a21b99ae48cf90bbef7f5 java-17-openjdk-devel-fastdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm d03931c9d935f1fa8d14f6015309076ff99e6b7f0461243846a7b417135e96a3 java-17-openjdk-headless-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm d75e1425bf35663b0d40a80a3331340b0e12945bdd6878f2b38d31481cafaf42 java-17-openjdk-demo-slowdebug-17.0.17.0.10-1.el9.alma.1.x86_64.rpm e36b74c97bac2e0acfa9921c644d90f4d8d4c38c3bd9f03a25743a085d5227f0 ALSA-2025:18824 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance Path Factories (CVE-2025-53066) * JDK: Enhance Certificate Handling (CVE-2025-53057) * JDK: Enhance String Handling (CVE-2025-61748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default java-21-openjdk-jmods-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 070b644b0fa822deeaeb490df701a65038884ad011aec8da323466f5741d0286 java-21-openjdk-demo-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 0caf166ef4dfbc3cd7f7101e4a31e5521af1b5f979d5ef705d7a9beef40cc34b java-21-openjdk-headless-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 1f2d4071c652a9993091e0a2f4c16cb0ad6ca8a8b65973877b9867e045064256 java-21-openjdk-src-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 206761a0cc557712edddfc86388dfb71a317f665f0091731d8941844279e1b31 java-21-openjdk-src-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 2968d87cf15e98888c9dd95fb02b897752f3b7be4239234ba04362aeecbfa372 java-21-openjdk-static-libs-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 2cd474e957cd7654770ea2367352058113cd6d57af35161f18695df95a40fa17 java-21-openjdk-demo-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 4bd75559f9236a80c879660580f0c4a7a55f72f71b9244ffc4eaa6c124df61fc java-21-openjdk-devel-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 56b4dabaebcc9bc671c380810bdf88f037f1dbcd5165fa4136d6f76028013c62 java-21-openjdk-headless-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 5a2fc2d5c3f6683e4ce4262375e31d047d8a32f2ccbe1aeaf5b5d54c02cd212c java-21-openjdk-devel-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 5b403878b03b10fbb69a9ff706192a707c658b54e0cf39bbb82b74e86acd5ffd java-21-openjdk-static-libs-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 82ff120e2b8c0c7a7dc2164c5d26a3ecec0a647dd6e0637e4a6d96d4a21a9d86 java-21-openjdk-fastdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 909acbd55838023efc531119755258213c7669bf911c345dc4b5180ed353825f java-21-openjdk-jmods-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm 9b8677f1154932905e949e4ba79b650a2aa98c272aec6ab3a58e2f9ab5c89513 java-21-openjdk-slowdebug-21.0.9.0.10-1.el9.alma.1.x86_64.rpm e9755fa46fd8ab452a4cfd991bb3d0039e64bf62e2b98336d3339cc28af043c0 ALSA-2025:19113 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libtiff-tools-4.4.0-13.el9_6.2.x86_64.rpm 9904ee894ebdf320f4afbc47a790914ade10d21c7fa2063ca3285a726b7c17db ALSA-2025:19409 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: Fix MAC comparison to be constant-time (CVE-2025-39702) * kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy (CVE-2022-50367) * kernel: crypto: xts - Handle EBUSY correctly (CVE-2023-53494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.60.1.el9_6.x86_64.rpm 241a56a545baf2850faad5515d8d7d8680e468de8b9b85f2df12b51b4f9582b1 kernel-cross-headers-5.14.0-570.60.1.el9_6.x86_64.rpm 4da5e9337b55903a11b95812e0948163f8cbf15c35778eef7a0b6879e104ba37 libperf-5.14.0-570.60.1.el9_6.x86_64.rpm ae581a12c3ffe366ac96c04be13ae4fb44e91af52dab40b261df33081920bbbd ALSA-2025:19584 Copyright 2025 AlmaLinux OS 0 1 Moderate

galera and mariadb security update

Galera is a fast synchronous multimaster wsrep provider (replication engine) for transactional databases and similar applications. For more information about wsrep API see <https://github.com/codership/wsrep-API> repository. For a description of Galera replication engine see <https://www.galeracluster.com> web. Security Fix(es): * mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490) * mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969) * mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970) * mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722) * mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default mariadb-embedded-devel-10.5.29-2.el9_6.x86_64.rpm c4c5d37e97afae0b97dde06ee1c1d831ce9b25011e31ed782c1f0e6b6678370d mariadb-test-10.5.29-2.el9_6.x86_64.rpm c7d5ed653a4e74f82a05ca8186fe005ebd04ff3b734e3fc11c16e5ad49d61cec mariadb-devel-10.5.29-2.el9_6.x86_64.rpm f5d2d5638092ae2a5551147057788b44c7ac33ecb52a2d20e9b52ceefe30c5f1 ALSA-2025:19930 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: x86/vmscape: Add conditional IBPB mitigation (CVE-2025-40300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-570.62.1.el9_6.x86_64.rpm 5207b96e9e607643690f583c63191438cfcebe6fa1f4cf9965baefa4bb0f4337 kernel-cross-headers-5.14.0-570.62.1.el9_6.x86_64.rpm 573bf9ef7110913c3f0fd877ecdbb37e6140f6ff85d95f8d876e709dd1f33cf7 libperf-5.14.0-570.62.1.el9_6.x86_64.rpm 851ec6261774f4aaed422cddc6906f78683ba2b0e8be8513230441b4af37f9d3 ALSA-2025:19950 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default bind9.18-devel-9.18.29-4.el9_6.2.x86_64.rpm 0a13cdf697e1a03e208347f6e86fa780617794b7b249b07d621093f30cc5318f bind9.18-doc-9.18.29-4.el9_6.2.noarch.rpm 96d3c97bb463ee4e457f2ba7e81f71eac1d9181a66f082476952e3305244b877 bind9.18-libs-9.18.29-4.el9_6.2.i686.rpm b38d4bd2b0a60136981a0e2d346f9dad6c43e48f68d18624ea8af9417c9cc907 bind9.18-devel-9.18.29-4.el9_6.2.i686.rpm d282ce314cd3827c64912e7e07e245c3a022382b6fa779781cef4bea54f303e4 ALSA-2025:20518 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix potential CAN frame reception race in isotp_rcv() (CVE-2022-48830) * kernel: soc: qcom: cmd-db: Map shared memory as WC, not WB (CVE-2024-46689) * kernel: Squashfs: sanity check symbolic link size (CVE-2024-46744) * kernel: vfs: fix race between evice_inodes() and find_inode()&#38;iput() (CVE-2024-47679) * kernel: x86/tdx: Fix "in-kernel MMIO" check (CVE-2024-47727) * kernel: rxrpc: Fix a race between socket set up and I/O thread creation (CVE-2024-49864) * kernel: io_uring: check if we need to reschedule during overflow flush (CVE-2024-50060) * kernel: can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (CVE-2022-49024) * kernel: posix-clock: Fix missing timespec64 check in pc_clock_settime() (CVE-2024-50195) * kernel: rxrpc: Fix missing locking causing hanging calls (CVE-2024-50294) * kernel: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write (CVE-2024-53052) * kernel: afs: Fix lock recursion (CVE-2024-53090) * kernel: virtio/vsock: Fix accept_queue memory leak (CVE-2024-53119) * kernel: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN (CVE-2024-53135) * kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466) (CVE-2024-53241) * kernel: RDMA/rxe: Fix the qp flush warnings in req (CVE-2024-53229) * kernel: block: fix uaf for flush rq while iterating tags (CVE-2024-53170) * kernel: nfsd: release svc_expkey/svc_export with rcu_work (CVE-2024-53216) * kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603) * kernel: blk-cgroup: Fix UAF in blkcg_unpin_online() (CVE-2024-56672) * kernel: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl (CVE-2024-56662) * kernel: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors (CVE-2024-56675) * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY (CVE-2024-56690) * kernel: io_uring: check if iowq is killed before queuing (CVE-2024-56709) * kernel: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() (CVE-2024-56739) * kernel: bpf: put bpf_link's program when link is safe to be deallocated (CVE-2024-56786) * kernel: igb: Fix potential invalid memory access in igb_init_module() (CVE-2024-52332) * kernel: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (CVE-2024-53680) * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648) * kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts (CVE-2025-21647) * kernel: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() (CVE-2025-21631) * kernel: zram: fix potential UAF of zram table (CVE-2025-21671) * kernel: afs: Fix merge preference rule failure condition (CVE-2025-21672) * kernel: mm: zswap: properly synchronize freeing resources during CPU hotunplug (CVE-2025-21693) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: mm: clear uffd-wp PTE/PMD state on mremap() (CVE-2025-21696) * kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (CVE-2025-21702) * kernel: usbnet: fix memory leak in error case (CVE-2022-49657) * kernel: powerpc/xics: fix refcount leak in icp_opal_init() (CVE-2022-49432) * kernel: net: tun: unlink NAPI from device on destruction (CVE-2022-49672) * kernel: powerpc/papr_scm: don't requests stats with '0' sized stats buffer (CVE-2022-49353) * kernel: powerpc/xive: Fix refcount leak in xive_spapr_init (CVE-2022-49437) * kernel: ima: Fix potential memory leak in ima_init_crypto() (CVE-2022-49627) * kernel: linux/dim: Fix divide by 0 in RDMA DIM (CVE-2022-49670) * kernel: can: isotp: sanitize CAN ID checks in isotp_bind() (CVE-2022-49269) * kernel: ima: Fix a potential integer overflow in ima_appraise_measurement (CVE-2022-49643) * kernel: powerpc/xive/spapr: correct bitmap allocation size (CVE-2022-49623) * kernel: efi: Do not import certificates from UEFI Secure Boot for T2 Macs (CVE-2022-49357) * kernel: list: fix a data-race around ep->rdllist (CVE-2022-49443) * kernel: tracing/histograms: Fix memory leak problem (CVE-2022-49648) * kernel: Input: synaptics - fix crash when enabling pass-through port (CVE-2025-21746) * kernel: NFSD: fix hang in nfsd4_shutdown_callback (CVE-2025-21795) * kernel: bpf: Send signals asynchronously if !preemptible (CVE-2025-21728) * kernel: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CVE-2024-54456) * kernel: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() (CVE-2024-57987) * kernel: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (CVE-2024-58014) * kernel: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() (CVE-2024-57988) * kernel: RDMA/mlx5: Fix implicit ODP use after free (CVE-2025-21714) * kernel: drm/xe/tracing: Fix a potential TP_printk UAF (CVE-2024-49570) * kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check (CVE-2024-57993) * kernel: wifi: rtw89: fix race between cancel_hw_scan and hw_scan completion (CVE-2025-21729) * kernel: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links (CVE-2024-57989) * kernel: wifi: ath12k: Fix for out-of bound access error (CVE-2024-58015) * kernel: OPP: add index check to assert to avoid buffer overflow in _read_freq() (CVE-2024-57998) * kernel: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() (CVE-2024-57995) * kernel: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) * kernel: scsi: ufs: core: Fix use-after free in init error and remove paths (CVE-2025-21739) * kernel: workqueue: Put the pwq after detaching the rescuer from the pool (CVE-2025-21786) * kernel: ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVE-2025-21738) * kernel: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVE-2024-57986) * kernel: padata: avoid UAF for reorder_work (CVE-2025-21726) * kernel: vrf: use RCU protection in l3mdev_l3_out() (CVE-2025-21791) * kernel: team: better TEAM_OPTION_TYPE_STRING validation (CVE-2025-21787) * kernel: usb: xhci: Fix NULL pointer dereference on certain command aborts (CVE-2024-57981) * kernel: vxlan: check vxlan_vnigroup_init() return value (CVE-2025-21790) * kernel: wifi: mt76: mt7925: fix off by one in mt7925_load_clc() (CVE-2024-57990) * kernel: ipv6: use RCU protection in ip6_default_advmss() (CVE-2025-21765) * kernel: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVE-2024-58012) * kernel: blk-cgroup: Fix class @block_class's subsystem refcount leakage (CVE-2025-21745) * kernel: net: let net.core.dev_weight always be non-zero (CVE-2025-21806) * kernel: wifi: rtlwifi: remove unused check_buddy_priv (CVE-2024-58072) * kernel: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized (CVE-2024-58068) * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-58062) * kernel: idpf: convert workqueues to unbound (CVE-2024-58057) * kernel: wifi: mac80211: don't flush non-uploaded STAs (CVE-2025-21828) * kernel: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (CVE-2024-58083) * kernel: netfilter: nf_tables: reject mismatching sum of field_len with set key length (CVE-2025-21826) * kernel: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback (CVE-2024-58077) * kernel: crypto: tegra - do not transfer req when tegra init fails (CVE-2024-58075) * kernel: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" (CVE-2025-21829) * kernel: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop (CVE-2025-21839) * kernel: io_uring/uring_cmd: unconditionally copy SQEs at prep time (CVE-2025-21837) * kernel: information leak via transient execution vulnerability in some AMD processors (CVE-2024-36350) * kernel: transient execution vulnerability in some AMD processors (CVE-2024-36357) * kernel: bpf: Fix softlockup in arena_map_free on 64k page kernel (CVE-2025-21851) * kernel: ibmvnic: Don't reference skb after sending to VIOS (CVE-2025-21855) * kernel: smb: client: Add check for next_buffer in receive_encrypted_standard() (CVE-2025-21844) * kernel: bpf: avoid holding freeze_mutex during mmap operation (CVE-2025-21853) * kernel: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() (CVE-2025-21847) * kernel: tcp: drop secpath at the same time as we currently drop dst (CVE-2025-21864) * kernel: bpf: Fix deadlock when freeing cgroup storage (CVE-2024-58088) * kernel: acct: perform last write from workqueue (CVE-2025-21846) * kernel: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() (CVE-2025-21861) * kernel: io_uring: prevent opcode speculation (CVE-2025-21863) * kernel: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (CVE-2025-21848) * kernel: netfilter: nft_tunnel: fix geneve_opt type confusion addition (CVE-2025-22056) * kernel: can: j1939: j1939_send_one(): fix missing CAN header initialization (CVE-2022-49845) * kernel: usb: typec: ucsi: displayport: Fix NULL pointer access (CVE-2025-37994) * kernel: wifi: ath12k: fix uaf in ath12k_core_init() (CVE-2025-38116) * kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (CVE-2025-38396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.5.1.el9_7.x86_64.rpm a67de8ea2bf582c6c3c43e9c412bdb33c57449b8c3d2e3039e86e25c8a0ad2c2 kernel-tools-libs-devel-5.14.0-611.5.1.el9_7.x86_64.rpm b54064b30c79973caa6a351d446c0d141eb5fe834e65191ca6c3142eb5b70799 kernel-cross-headers-5.14.0-611.5.1.el9_7.x86_64.rpm ceb8d4bbeb146b3bba7d49f8c579860a477b5dadb3090f4bebce811081a6a059 ALSA-2025:20559 Copyright 2025 AlmaLinux OS 0 1 Low

shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise (CVE-2024-56433) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default shadow-utils-subid-devel-4.9-15.el9.i686.rpm 57e83456d52e0ff09d2dc07fff5a5300c605655c08dbab09a7ab11372412495a shadow-utils-subid-devel-4.9-15.el9.x86_64.rpm 9419a8ccfb8756f9f82c369de6a8a2030bcde511097ffea677bebd77584e7597 ALSA-2025:20838 Copyright 2025 AlmaLinux OS 0 1 Moderate

zziplib security update

The zziplib is a lightweight library to easily extract data from zip files. Security Fix(es): * zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default zziplib-devel-0.13.71-12.el9.i686.rpm 0248f804fd706cbbeb9487a9f6f4d6ea8ffb99edaff185df653cf095e776812a zziplib-devel-0.13.71-12.el9.x86_64.rpm ae83487b66ffb1f3bc23f8700d482ca5a33dd829fffcfb9c94ee6eb094ee9b2b ALSA-2025:20928 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-ipatests-4.12.2-22.el9_7.1.noarch.rpm 73735cb3f9e7836a82214b31eebc711a3dab45d846b482e539c88ccd41cc2083 ALSA-2025:20954 Copyright 2025 AlmaLinux OS 0 1 Important

sssd security update

The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems (CVE-2025-11561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libsss_nss_idmap-devel-2.9.7-4.el9_7.1.x86_64.rpm 494bdc75b639c918c3b0815189a025824e103ab5fa101b504f6e790a49f56112 libsss_nss_idmap-devel-2.9.7-4.el9_7.1.i686.rpm 4dab7b370305eb122728b3b56b79a2333cd8f9885cee4a2ca04ffda99cb1f34b ALSA-2025:20956 Copyright 2025 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: LibTIFF Use-After-Free Vulnerability (CVE-2025-8176) * libtiff: Libtiff Write-What-Where (CVE-2025-9900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.2.x86_64.rpm 54dcc4eb1155efb767664851487ed17c36e167c0feaa17d01292801c88490ed4 ALSA-2025:20960 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-5.el9_7.i686.rpm 216d155c2f6c440efdb07997067b7988de44b00ccaaa04bc554039f02f80aaa9 xorg-x11-server-Xwayland-devel-23.2.7-5.el9_7.x86_64.rpm 2f833e439957202c882bf1f06d127f4881b7eef2219febd42ef6a67d078cc48f xorg-x11-server-Xwayland-23.2.7-5.el9_7.i686.rpm afc0ccc008088e09831af4efa994c5bd180bf40c22e2e29cd4d06ce646fd30bf ALSA-2025:20961 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default xorg-x11-server-devel-1.20.11-32.el9_7.i686.rpm 75a95779ca9dce6457f81fbf8c2c87ac50c22f4c217cc4aeaa7828315cf3793d xorg-x11-server-source-1.20.11-32.el9_7.noarch.rpm 95e1253a06af7d378305502d5dbb69dbe4f15e3169d304ac2956aa023e59f083 xorg-x11-server-devel-1.20.11-32.el9_7.x86_64.rpm cd7e61a677203550053323cf8a41ca783ba40b7068681c8845bc08b511dd5c7c ALSA-2025:21110 Copyright 2025 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default bind-devel-9.16.23-34.el9_7.1.x86_64.rpm 34f2c175f470dc88e9243c8e7c0f5d0577ab68843793ab3060ad72379b6c0003 bind-devel-9.16.23-34.el9_7.1.i686.rpm c50823126e1b3f01213c109561ed43b200683cbc00aac1be707feb3c9b2fedce bind-doc-9.16.23-34.el9_7.1.noarch.rpm d5fe5e92ce924c40cfb8e5ffee39962cc0864de759ade57a74b9aeafe5b15352 bind-libs-9.16.23-34.el9_7.1.i686.rpm d77dba22fe7cfcd5e05dc8282f4478b75d57382325f7646540c064dc331c8a65 ALSA-2025:21111 Copyright 2025 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778) * bind: Cache poisoning due to weak PRNG (CVE-2025-40780) * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default bind9.18-devel-9.18.29-5.el9_7.2.i686.rpm 13c38a9451de3c270d2b19a5071bbb20bab60b51c12f244daac39669b3466085 bind9.18-libs-9.18.29-5.el9_7.2.i686.rpm 2a229b04ec9d1d0ba72823b91013ff6c6e4152e612554afdb29b4a0c2f574485 bind9.18-doc-9.18.29-5.el9_7.2.noarch.rpm 3e89b39addd198c4c8835a6dd4053f4cd2690e3e639cf581ebcd64478a751bd8 bind9.18-devel-9.18.29-5.el9_7.2.x86_64.rpm b8a0dea8b756d86e3ec853c7ac6ed1b1343e334f432c641bea75e0a3c10997a8 ALSA-2025:21462 Copyright 2025 AlmaLinux OS 0 1 Critical

lasso security update

The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fix(es): * lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default lasso-devel-2.7.0-11.el9_7.3.i686.rpm a245121f30205942c85dff0cccf5b5dce99b1d55d022a9dd48d0177ad6eb9771 lasso-devel-2.7.0-11.el9_7.3.x86_64.rpm b3947ffc43b82dbf0486bd803317029ee357c4365a5e9d1b304fd73daa1e1957 ALSA-2025:22405 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CVE-2025-38724) * kernel: wifi: cfg80211: fix use-after-free in cmp_bss() (CVE-2025-39864) * kernel: e1000e: fix heap overflow in e1000_set_eeprom (CVE-2025-39898) * kernel: wifi: mt76: fix linked list corruption (CVE-2025-39918) * kernel: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect() (CVE-2025-39955) * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: iommu/vt-d: Disallow dirty tracking if incoherent page walk (CVE-2025-40058) * kernel: ice: ice_adapter: release xa entry on adapter allocation failure (CVE-2025-40185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.11.1.el9_7.x86_64.rpm c11fd6cbdb66b2fa4938bd2b60e4f12df11eda1a0521cba7f1f0321ada1e4fe9 kernel-cross-headers-5.14.0-611.11.1.el9_7.x86_64.rpm ce4cd611ca0848133b0411083c9b966be8ae852bbff1b3495bfa87c1b4695446 libperf-5.14.0-611.11.1.el9_7.x86_64.rpm f39b50b68f918d622f190ba2ded54abbcb28a35883d1ac083454798fff173ee1 ALSA-2025:22865 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: implement NETDEV_UNREGISTER notification handler (CVE-2025-39925) * kernel: net/mlx5: fs, fix UAF in flow counter release (CVE-2025-39979) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.13.1.el9_7.x86_64.rpm 46ae681b07630ecb64b3d73104aee4de553cf3fda2fe237041ad20232592f04c kernel-tools-libs-devel-5.14.0-611.13.1.el9_7.x86_64.rpm aa6b90657da802baa01c069b4904f23e4b06972e8680ae8c3e0e932ccd6f37ec libperf-5.14.0-611.13.1.el9_7.x86_64.rpm c4df730c8b69b1033f545783f3194b721d591878a3ba6150251344a5687e9c7f ALSA-2025:23109 Copyright 2025 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054) * mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040) * mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069) * mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default mysql-test-8.0.44-1.el9_7.x86_64.rpm 99ac4e872edff3d0fef6866006053adde54ca7dcd0057781c6b0eb5dd8875fd6 mysql-devel-8.0.44-1.el9_7.x86_64.rpm f7e3ea6850b525b7b40716d46c58c2bcaeef48435889e2da4095b3b49e500cf7 ALSA-2025:23142 Copyright 2025 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default wireshark-devel-3.4.10-8.el9_7.1.i686.rpm 435beecb7c175bc0d8f727c4abf199acf10e7e06fa123cc63b40076a77b53b40 wireshark-devel-3.4.10-8.el9_7.1.x86_64.rpm a48692ff08cbf304f1bfdf8620726dbf61e78e90c0589dbd798d39bd46b3c684 ALSA-2025:23241 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (CVE-2025-38499) * kernel: iommufd: Fix race during abort for file descriptors (CVE-2025-39966) * kernel: tls: wait for pending async decryptions if tls_strp_msg_hold fails (CVE-2025-40176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.16.1.el9_7.x86_64.rpm 23311ceb43e0459ef66229f719e5902518f6682d68fcc803d58448b701146990 kernel-cross-headers-5.14.0-611.16.1.el9_7.x86_64.rpm 984a7df9471269277e63ee7f756897bddca7e9afced88831bddd8120621d7316 libperf-5.14.0-611.16.1.el9_7.x86_64.rpm b3a312809f42dbf3f8147674a4f08a280198c7c424e8460cf8271ee1d89de202 ALSA-2025:23323 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-idle-3.12.12-1.el9_7.x86_64.rpm 3e3e8efa32e65a3937a5d7c77c9ca3611c323dd96f71d5b2322307e817fbcbf8 python3.12-3.12.12-1.el9_7.i686.rpm 63ed470a679e5e0ae140d0c16c83579e298a8ee9487abc0ae2b62afbe92e9575 python3.12-tkinter-3.12.12-1.el9_7.i686.rpm 6b4da25831d470f7c81fa00f6bc242b223d0348b7e750c06e6b942baf6622913 python3.12-test-3.12.12-1.el9_7.i686.rpm 8c6b14079b2bbd1e9358962a4b96de03dae56156e43f432a5952ecaf0c3ca4bf python3.12-idle-3.12.12-1.el9_7.i686.rpm a5ac075ee5dbe7453a32263b8ba58c3f6f56c4261719f082297f3026e44f6493 python3.12-test-3.12.12-1.el9_7.x86_64.rpm ba73acfc8161eac70135540e5a94eeef305d218012615d96ebb982c4dca8cf65 python3.12-debug-3.12.12-1.el9_7.x86_64.rpm c1dda3d78834a692f2746a2d9bbe511b13f1e32a9ebb703e54298c3166b812ee python3.12-debug-3.12.12-1.el9_7.i686.rpm e55596f93be9bab3bc3e9536501f98e460fb9e88d61d31acf90e7a17fe0a5c93 ALSA-2025:23342 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used (CVE-2024-5642) * cpython: Python HTMLParser quadratic complexity (CVE-2025-6069) * cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-test-3.9.25-2.el9_7.x86_64.rpm 421e3ef59fa5bb4fcce1a8e1a16bd013b6998c53148105c566439bea879d37d6 python3-idle-3.9.25-2.el9_7.x86_64.rpm a545c78ba28779c956b28b351409dc5a001614c386922b1010b2dcfcce2e7665 python3-tkinter-3.9.25-2.el9_7.i686.rpm b1849692122ac4ab4f39ec6ac5a1487c1b63c5afb86458f6254c64cb1bacfabd python3-debug-3.9.25-2.el9_7.x86_64.rpm b40e1f244acbc6fcc8b93393a57efae4dba01649aeeff83e2ad9a9f334177ce7 python3-test-3.9.25-2.el9_7.i686.rpm c3848de77283e5c4b1e0da773577503190692db248a94b8f9fae097628afabd1 python3-idle-3.9.25-2.el9_7.i686.rpm c38be7b79e439bbddd07dffea045c8d5f3116d6a1bc235ce8fa51ab6db943990 python3-debug-3.9.25-2.el9_7.i686.rpm caca919a4023f99343bded7068cad4e120bead315c8bfdbe711ba9547ac1d8e1 python3-3.9.25-2.el9_7.i686.rpm edd9e4ea4488f04f7c655f1a616995c1247141c0ac42157d87a3d3436a3dd183 ALSA-2025:2627 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ACPI: extlog: fix NULL pointer dereference check (CVE-2023-52605) * kernel: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (CVE-2024-50264) * kernel: HID: core: zero-initialize the report buffer (CVE-2024-50302) * kernel: can: bcm: Fix UAF in bcm_proc_show() (CVE-2023-52922) * kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof (CVE-2024-53113) * kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVE-2024-53197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default libperf-5.14.0-503.31.1.el9_5.x86_64.rpm 2ecaa380338c70be499ebfad6c891d01d48e44113d923142c1db81c0e3905d20 kernel-tools-libs-devel-5.14.0-503.31.1.el9_5.x86_64.rpm c9215985cf1f3d3541586ff8db7098c736e20a238cdcc2eff4ea51d6e5de93a5 kernel-cross-headers-5.14.0-503.31.1.el9_5.x86_64.rpm f6ebd91ac547715c26ed5192d653d3ae6cfd4edeaa47aaa158d26e6be533f92d ALSA-2025:2668 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.104 and .NET Runtime 9.0.3.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default dotnet-sdk-9.0-source-built-artifacts-9.0.104-1.el9_5.x86_64.rpm 39aef344095bc024e1479e1b230536eee4576bc69007212d01de7c2edf699112 ALSA-2025:2669 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.114 and .NET Runtime 8.0.14.Security Fix(es): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (CVE-2025-24070) Bug Fix(es) and Enhancement(s): * dotnet: Privilege Escalation Vulnerability in .NET SignInManager.RefreshSignInAsync Method (BZ#2349733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default dotnet-sdk-8.0-source-built-artifacts-8.0.114-1.el9_5.x86_64.rpm bf554e7656d1ea9a870e5579737b199ab1dc027dffccee922d943ee1268760f3 ALSA-2025:3631 Copyright 2025 AlmaLinux OS 0 1 Low

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3.12-3.12.5-2.el9_5.3.i686.rpm 08470a3e1fe67cae0112f6ced0eabea56fce17f2cb9f84b6296fa5271e0288f0 python3.12-idle-3.12.5-2.el9_5.3.x86_64.rpm 439be749de31eb6dbae02f86bad718ea039d67397c09f4c5a83a1ed4f2d1684f python3.12-debug-3.12.5-2.el9_5.3.i686.rpm 45eeb1342167869836e1d63f60b5876bccbd9d6cf7dc843349f5d229149339eb python3.12-tkinter-3.12.5-2.el9_5.3.i686.rpm 59f7a4f39d09a8eefa844e53f90ce577866084670cc23f8a3445e14687744e42 python3.12-test-3.12.5-2.el9_5.3.x86_64.rpm 6cf54ec779f0d06fedc50f51b7c12ca2b7f061da3f1444a4e912ac5a14dc9a84 python3.12-idle-3.12.5-2.el9_5.3.i686.rpm 7379ab6b9dec8b0fbecce50fd89f225c409ecaaa07720943d0deaddc739f5da6 python3.12-debug-3.12.5-2.el9_5.3.x86_64.rpm 97a09d643917589be829273af631f65b60797c5d66bb3be3d37fe3a2e4183d89 python3.12-test-3.12.5-2.el9_5.3.i686.rpm a3b6a98c01447b80dc955fd42a5d631086627aa6f7ba2c6799d2f3b55aa13a3c ALSA-2025:3634 Copyright 2025 AlmaLinux OS 0 1 Low

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: Uncontrolled CPU resource consumption when in http.cookies module (CVE-2024-7592) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default python3.11-debug-3.11.9-7.el9_5.3.x86_64.rpm 06bbd78bc40ba852b19b51a4cfdfe1b8713cfa53abdab33c2683e784cd15df59 python3.11-debug-3.11.9-7.el9_5.3.i686.rpm 1e64d70a9e7a22a603b2b6f57d378c57ee8e043c16db2ef05abe0249c93a66e1 python3.11-test-3.11.9-7.el9_5.3.i686.rpm 2f74cfbb72c96ba166a0fbdc43010b7813787329b3f9ad4d36baba8e5b27e5bf python3.11-idle-3.11.9-7.el9_5.3.i686.rpm 66c20735f7ecfcf504c982dd12eba990167b25148a8c68019fd02146057f653d python3.11-3.11.9-7.el9_5.3.i686.rpm 759c3d05ccab0232d3fdd213a58c40e5c2eee590bc60435aa0412c0fac771225 python3.11-test-3.11.9-7.el9_5.3.x86_64.rpm ac9233ba144e02844b7fb13375a3418a70a366020979451924272dbd2bce0575 python3.11-idle-3.11.9-7.el9_5.3.x86_64.rpm f68b604c81b3e95ad29b46d72b72970db3a80dc273124a0a8b17f93c88d84a98 python3.11-tkinter-3.11.9-7.el9_5.3.i686.rpm fe1b89980f5322ece6ecdd749e020534e009aba011e71e2a1137bf38440b937b ALSA-2025:3845 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default java-1.8.0-openjdk-devel-fastdebug-1.8.0.452.b09-2.el9.x86_64.rpm 00e34f3f5a1d8aeeb0d1886010b2ee129fbcf3e28f78285097ac1eef60e103d2 java-1.8.0-openjdk-demo-fastdebug-1.8.0.452.b09-2.el9.x86_64.rpm 110a94596a748bd874849180903f850591c08f7919c66f55e1a79f11a10cf9f2 java-1.8.0-openjdk-headless-fastdebug-1.8.0.452.b09-2.el9.x86_64.rpm 343de807c7fdcbec8ab754fc1239f6a906de8c02f3e5126747e791c09111b9f0 java-1.8.0-openjdk-src-slowdebug-1.8.0.452.b09-2.el9.x86_64.rpm 3b06ad2987bb40daa8b73228e5eba3f28d31eff6ac12d6da6ca96d40bf6caaf4 java-1.8.0-openjdk-demo-slowdebug-1.8.0.452.b09-2.el9.x86_64.rpm 6425ef302e052914cb84e6b3a56fac2107d5b6a1c23f6c6d0357ef7ee1942301 java-1.8.0-openjdk-fastdebug-1.8.0.452.b09-2.el9.x86_64.rpm 8feebf4bee7c0e5f695411cfae83615a064394c86698db349762e1674352871e java-1.8.0-openjdk-headless-slowdebug-1.8.0.452.b09-2.el9.x86_64.rpm d68b53296cf7922f4318e509cd58ccddc57430270763d3d9b4f354b46a0596fc java-1.8.0-openjdk-devel-slowdebug-1.8.0.452.b09-2.el9.x86_64.rpm ea47b1d69e4bc0d4e4bee95e570532ffa3ff53a9280f1fd57ea8edd031640b20 java-1.8.0-openjdk-src-fastdebug-1.8.0.452.b09-2.el9.x86_64.rpm f1cd145d178b33b252fa02a7937dc76d43420d1a03a6ad0aef42780b780abafd java-1.8.0-openjdk-slowdebug-1.8.0.452.b09-2.el9.x86_64.rpm ff5619d704245bad5cb5250d270e7b0c3591826b42e78285b06bcf71f17e1fea ALSA-2025:3852 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default java-17-openjdk-devel-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 0e750f091c343da0e5ddf9e2397deaa8b0240eeab3e270d026c6e9e5a5dac40b java-17-openjdk-demo-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 48018edb5e249ac340f5f4d94d248bbdff39361524c7e22f6cc50ae82044be4f java-17-openjdk-jmods-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 54e0fecd434eea8e999465492e5bcc8ebe958d8467eec395dc899349ae7df6b8 java-17-openjdk-src-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 8c3872457a29b1c079d07b5825db75793bdfa84f300010e54c7870c599fbb673 java-17-openjdk-static-libs-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 8f71f01587adb7d3baa53b528fb5256a8914227ef4a2deae698555a6d2a01ba9 java-17-openjdk-headless-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm 8f9ffa291117f8dda59ba35ee05336c15c07cf6592e37dccc574c75023fc0c84 java-17-openjdk-static-libs-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm b0baf728238ac1849d5644fffa97324609d94460989ac526629d6a55279fda20 java-17-openjdk-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm b8c213bff930d374a6a87b58738cf94b697563ce64c7954291ef9075db8472b4 java-17-openjdk-headless-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm c5ca35a4d12375477cd44647564f6aaba6dc3c8ee7537c35c382fcae054b7c27 java-17-openjdk-jmods-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm e48ac07ebc6bfcbbc4b47a840d42817b47377cb28f00b8a821a2aa888eb5d89d java-17-openjdk-demo-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm ea52c26df1be086b771017bd728ab5b0ab3061093880e8456bbbf3395248139c java-17-openjdk-src-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm f049b3024391b3235ddf9a59e079da6086f47c975799a87ff163b3e87926260d java-17-openjdk-devel-fastdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm f86fc32bf77ec0d46c91f891754d290870852b57a87db0eddb4970da1fe86c01 java-17-openjdk-slowdebug-17.0.15.0.6-2.el9.alma.1.x86_64.rpm f9745a134971acfd96cef2c3197da49d4e97ced9a1cd9018b5a31a5218e1d66c ALSA-2025:3855 Copyright 2025 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Better TLS connection support (CVE-2025-21587) * JDK: Improve compiler transformations (CVE-2025-30691) * JDK: Enhance Buffered Image handling (CVE-2025-30698) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default java-21-openjdk-src-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 051eddad5005745d68a316b7b9d00822ae3a429565636eec510a529c51ffe894 java-21-openjdk-src-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 30cd86886619e524828ad6beae5b43826c08af09777063153e13eea92f5f8de6 java-21-openjdk-devel-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 476eeecd87dea0eb69dc3a326b4742e1d84d187490db03bbddca1486c1c1e0f0 java-21-openjdk-headless-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 48b4b7ace8e57c6edf37229bac62f95271cb5d61d707adce76615eadf8208823 java-21-openjdk-jmods-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 556d5ccf27c2e19f5dc3633c2569eb66760f95ba7b7c05447089a0f76ba0acde java-21-openjdk-jmods-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 5c6f0935d8af18bb9250e46dc96d9bf8f0e4b0719fb46e7d6df942c4e65bc4d8 java-21-openjdk-demo-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 70d97eafc15d3087fec39179be0ac2b9adb37063fd3936bb595fe3078dafa038 java-21-openjdk-static-libs-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 84d722a82223683d521b78770f7025e4453c710b9e22f1a4165b0a2fd19b49e9 java-21-openjdk-devel-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm 9a790d8f69528fd87805a7fe9bba252536841dae594aa1b882b8161fd6931b20 java-21-openjdk-fastdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm b5bc18dd5bce27c419b8364d7c52b08fe7d3510e23107e5c1f59a513010abfbd java-21-openjdk-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm bd4fe0d7a267cded73baf8513982c48093a237360ab09b7c3694edcdf75dadeb java-21-openjdk-headless-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm cf8a995ecfc1bdc5a07d2649d798f3fa056cd6eeaeb11a23953f076e9a4e8dd4 java-21-openjdk-static-libs-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm e12a3e65bfa2321fe9d2f2f1cbe3bda1417c9cd1e18071f7aea64b2b6e5a7661 java-21-openjdk-demo-slowdebug-21.0.7.0.6-1.el9.alma.1.x86_64.rpm f49e88782f6b790d7d063b82018b99c79bd244c59d9459abdbc2d7d726333d25 ALSA-2025:3937 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CVE-2024-53150) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default kernel-cross-headers-5.14.0-503.38.1.el9_5.x86_64.rpm 061b0aa7eaba41be36e7df8604ed3763d65ee530b364b9e83425a74c2901c484 kernel-tools-libs-devel-5.14.0-503.38.1.el9_5.x86_64.rpm da7ae9c84aaf651c7f09ca070f002f39491d14e56f27ee998d3bbde7ef5f7eb7 libperf-5.14.0-503.38.1.el9_5.x86_64.rpm f2e066b847d8762bc00dfe37a01c2354f093cbad31351cb059d37f48ec1295f5 ALSA-2025:4244 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: buffer overflow in the GNU C Library's assert() (CVE-2025-0395) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default glibc-nss-devel-2.34-125.el9_5.8.alma.1.i686.rpm 068606b82ee5d170a5dab806f0bb7789d2cd26838950c2aa59d77d61bef6e650 glibc-benchtests-2.34-125.el9_5.8.alma.1.x86_64.rpm 09c7ca556a11c81673dd39cff87090c232d8dfa03d9d2ffaf40369dda31c704e nss_db-2.34-125.el9_5.8.alma.1.i686.rpm 0e83c930e5c99a3c0d82f0565d8a520118088823f480e84a175954621d98aa88 glibc-static-2.34-125.el9_5.8.alma.1.x86_64.rpm 25a5b3547626c2d255a2f54333558b5d2e8054f305bbf8a2da85e11b187faec9 glibc-static-2.34-125.el9_5.8.alma.1.i686.rpm 84f56e201791a1dca33728307e0f5c263fabc02a5cb4122ae0434747bbf62379 nss_hesiod-2.34-125.el9_5.8.alma.1.x86_64.rpm 8e29d11ea11bc2c8b13526247dc6ef29b70d803a41faa25f99aa36205eb0aa8c glibc-nss-devel-2.34-125.el9_5.8.alma.1.x86_64.rpm bc23972baa70e06a018ced458ec1951c252e04b18ccd392840f933e172eff86c nss_db-2.34-125.el9_5.8.alma.1.x86_64.rpm f7743573a04c0676504e9cbc2298bf4607f8cc104e2ab92f1cc4ef7f8407add2 nss_hesiod-2.34-125.el9_5.8.alma.1.i686.rpm f82d8cbd5e5d97e52da1ae99d229348bff9036746301649d98dd4664c5f2cec8 ALSA-2025:4491 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_5_default 389-ds-base-devel-2.5.2-9.el9_5.x86_64.rpm 278b8630634f7059cff3ea808a0a9a346055ab8c26f6387791d62bc94abb6355 ALSA-2025:6977 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3-idle-3.9.21-2.el9.i686.rpm 011f6ca40b506865b33ba644c83291b78d8dcde55ede4614fada8c132c79c583 python3-debug-3.9.21-2.el9.x86_64.rpm 1ae5098bf165521e51495893ebea98a731feeab93d2f7a3f2129ccfaf66ea1c8 python3-idle-3.9.21-2.el9.x86_64.rpm 1f09be170af9d907592f858ff5076673a74c96201e77899a20ab5b9f08d3cc8e python3-test-3.9.21-2.el9.x86_64.rpm 4e2087b5d2ce55d1be49eda36014a32485d484d75ef55d05a90c27c4768655cb python3-tkinter-3.9.21-2.el9.i686.rpm 565f6f0c9ec8512b12af5c3165d0e1868b2c124435283dbe27a78c82150078a6 python3-test-3.9.21-2.el9.i686.rpm 6aab6c70d2cdaae42dddd8451fa38e63a79cfbd4734b8485694b9afcdf17dc29 python3-3.9.21-2.el9.i686.rpm b0c1a087b430556f2e5d7d5d64e072bc6d087cd6b4e3f71504ea81bf30e7e1ea python3-debug-3.9.21-2.el9.i686.rpm f51f9f265c23f3edb2430cd16943ee414857b229eb56f2f56f812067fad0234c ALSA-2025:7107 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.12-debug-3.12.9-1.el9.i686.rpm 0887455e1108d182a78f5035d48abce82ba5b523be93bf1927f61ad3afcb6886 python3.12-tkinter-3.12.9-1.el9.i686.rpm 1ffa78a9ef85f3a53d596625a639937acaa2c097fc10d03bbdd49f490a9466e3 python3.12-idle-3.12.9-1.el9.i686.rpm 404b851f1bfc49e8f8744fdf1d1803778fe64590805663ebd397c93755bb95ae python3.12-test-3.12.9-1.el9.x86_64.rpm 861aca04cc333ccc08de70f003e25ee3f327a09c5e69e9d896f8977852b6c693 python3.12-3.12.9-1.el9.i686.rpm cd633bd569d700be95ca1fe7bfe4d5514f757de8f7cbf66816956141f8589117 python3.12-debug-3.12.9-1.el9.x86_64.rpm ce99748a2e6cfbc3e6cba635437b33271e58356e207806c0ee6a6b12f043882a python3.12-idle-3.12.9-1.el9.x86_64.rpm e4f7fbab6fdccb44c2113c4ea1b789460fca1dff2a6c7f208eae8185f2a4e678 python3.12-test-3.12.9-1.el9.i686.rpm faf168af9b5770b109e54635901e25a34f09ccad61d0194452cd78ed4bb296bb ALSA-2025:7109 Copyright 2025 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: URL parser allowed square brackets in domain names (CVE-2025-0938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3.11-idle-3.11.11-2.el9.i686.rpm 3b04d7cf50167467f9df5b7f81dd9f8086d27948ef3a412603e2021da959c253 python3.11-test-3.11.11-2.el9.i686.rpm 4260831ada68c247ee92360d4b23d1fe9c96d1ece3a1d4a1b5544bee612198be python3.11-tkinter-3.11.11-2.el9.i686.rpm 565e0f1f1f937e970620c283f4584ab00bad6be411098dc5fddeb0a19d707065 python3.11-idle-3.11.11-2.el9.x86_64.rpm 639323343afdb3c33647bb3bc451a1af6cd98ad45d0e81bdb4f273abca71ea6a python3.11-debug-3.11.11-2.el9.i686.rpm 955480dd61e8cbba86c2114c18effe4c09de119944c971779fb5fc8c86291b16 python3.11-test-3.11.11-2.el9.x86_64.rpm d943994f2079fc3a1242b04630d709c7ef6d8eb51f113f0a3cc4c70ce003fa77 python3.11-3.11.11-2.el9.i686.rpm e597c0b1419ec4ba217ce6ed7c14395e9b1433250ec51cc4a767e7f9691aaa67 python3.11-debug-3.11.11-2.el9.x86_64.rpm e8842d1f5d4bbfca69e0c212b0ba30828e215d0af0f5849da2ce3939b40af45b ALSA-2025:7138 Copyright 2025 AlmaLinux OS 0 1 Moderate

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: message parsing vulnerability in ProtocolBuffers (CVE-2022-1941) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default protobuf-lite-devel-3.14.0-16.el9.x86_64.rpm 0a63fd6f79a6ae381bb9dc44e95d6fc7c9eee305b098d0052a0fcbf52d5ba49f protobuf-compiler-3.14.0-16.el9.i686.rpm 1279cb1f2bdec43609e9e5f0fee51f66f45c4e89a9845f79a334fbc6bb93a7b5 protobuf-devel-3.14.0-16.el9.i686.rpm 1adfbd24779aaf9f7bc3c4ad381e7eb283adbd013f1072691a66678648619153 protobuf-devel-3.14.0-16.el9.x86_64.rpm 41d535188ca64ddbc6aa86ec02f89d9ba576194c8d731b838a0038903d833238 protobuf-compiler-3.14.0-16.el9.x86_64.rpm e1919f3cfaf1ae4c8fff42f3efd88718de8fc6144e3be9dddf0f21802296cca2 protobuf-lite-devel-3.14.0-16.el9.i686.rpm f1d276cf46de542524ff26d9b85b922d7cc01feadc2034ee26ad188436f128bf ALSA-2025:7163 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default xorg-x11-server-source-1.20.11-28.el9_6.noarch.rpm 3b5bd53a2a3f676acc5de9d501d20df93aa48d19e1ee9f9f51594d08563b468b xorg-x11-server-devel-1.20.11-28.el9_6.i686.rpm 7a3cf9635c23b6d3afbb0e1ee1dd5e31b27c61908a32007704bc203dbb115a8b xorg-x11-server-devel-1.20.11-28.el9_6.x86_64.rpm f077f472424d057855706609cf29f776facb171ec39b70d2c4a3f87f5642dd4e ALSA-2025:7165 Copyright 2025 AlmaLinux OS 0 1 Moderate

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default xorg-x11-server-Xwayland-devel-23.2.7-3.el9_6.i686.rpm 90c10c76c57c26896acc8f1f3ae13a391f48b46a5bccf1c417b71e7b100d3b40 xorg-x11-server-Xwayland-23.2.7-3.el9_6.i686.rpm b146d6875ab01879300483c8b26991d2200cfc005398c25bbeddc13620cfa35e xorg-x11-server-Xwayland-devel-23.2.7-3.el9_6.x86_64.rpm c8d58881a20eca09d56bb9544185b084257029d1ec3fd77767cb0c9d951c0367 ALSA-2025:7178 Copyright 2025 AlmaLinux OS 0 1 Moderate

gstreamer1, gstreamer1-plugins-bad-free, gstreamer1-plugins-ugly-free, and gstreamer1-rtsp-server security update

The gstreamer1 packages contain a streaming media framework, based on graphs of filters which operate on media data. Security Fix(es): * gstreamer: EXIF Metadata Parsing Integer Overflow (CVE-2024-4453) * gstreamer: AV1 Video Parsing Stack-based Buffer Overflow (CVE-2024-0444) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-3.el9.i686.rpm adebf95e601f4133c36b45d1af4006f9421a5b5abca40e3b9b77fb0a256c5718 gstreamer1-plugins-bad-free-devel-1.22.12-3.el9.x86_64.rpm c80ad162b5a229ad48c69be57ce9647981bd0a713b1c90c0d799c0920345dd47 ALSA-2025:7201 Copyright 2025 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default corosync-vqsim-3.1.9-2.el9_6.x86_64.rpm a590511064a304a22fdffab9093dfcfecabe8af788da8b63fef8693d5b81542a ALSA-2025:7309 Copyright 2025 AlmaLinux OS 0 1 Moderate

openjpeg2 security update

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: heap buffer overflow in bin/common/color.c (CVE-2024-56826) * openjpeg: heap buffer overflow in lib/openjp2/j2k.c (CVE-2024-56827) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default openjpeg2-tools-2.4.0-8.el9.i686.rpm 03e2f42fef39d20a47a0cff1a8c32a6f7edad97d8088c31ab13ca7172d4579b6 openjpeg2-devel-2.4.0-8.el9.x86_64.rpm 088c0265d2ea95019dcc54258139169600f0014c3fc4e202f74d44549cb4098a openjpeg2-devel-2.4.0-8.el9.i686.rpm 29cfa369caeb709ed65a434c815bf136d2ee8ab483cdb07694d316cad67e8c78 openjpeg2-tools-2.4.0-8.el9.x86_64.rpm 495e08531175beddc6e523c9621ee40a7ae19486508f41c6d5089c567d25dd53 ALSA-2025:7350 Copyright 2025 AlmaLinux OS 0 1 Moderate

perl-Module-ScanDeps security update

This module scans potential modules used by perl programs and returns a hash reference. Its keys are the module names as they appear in %INC (e.g. Test/More.pm). The values are hash references. Security Fix(es): * module-scandeps: local privilege escalation via unsanitized input (CVE-2024-10224) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default perl-Module-ScanDeps-1.30-6.el9.noarch.rpm 58e02999f61c36061ec35282d70735bc5f2aa26e5cd90232472bc3205b37ee54 ALSA-2025:7395 Copyright 2025 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: null pointer dereference leads to denial of service (CVE-2025-2487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default 389-ds-base-devel-2.6.1-8.el9_6.x86_64.rpm 062c63a1da53414105c4ec4233c911e7ef9a53bf2c01d29eddd68a4c83761186 ALSA-2025:7402 Copyright 2025 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Memory corruption in the ngx_http_mp4_module (CVE-2022-41741) * nginx: Memory disclosure in the ngx_http_mp4_module (CVE-2022-41742) * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default nginx-mod-devel-1.20.1-22.el9_6.2.alma.1.x86_64.rpm e4400f7410335dbf531e9a874c06b7eec38032dd023dcc33fdb81932ab7114d5 ALSA-2025:7422 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: dangling pointer in gdev_prn_open_printer_seekable() (CVE-2023-46751) * ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling (CVE-2024-46952) * ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space (CVE-2024-46951) * ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding (CVE-2024-46954) * ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript (CVE-2024-46953) * ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution (CVE-2024-46956) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default ghostscript-tools-fonts-9.54.0-18.el9_6.i686.rpm 173d64710ff5096c146fc779a758ea79d3b200c1543f8d5cdb5a80357f9c1bb8 libgs-devel-9.54.0-18.el9_6.i686.rpm 1b0e8da32a02b9fa54560617cc2d13e1a6192c8e986efcdde9dcc3c7367b7bc1 libgs-devel-9.54.0-18.el9_6.x86_64.rpm 2952a3ea2376c92a011a0abfc9a79dc6dc49e49825aa8f81ab76edb8299be50a ghostscript-tools-printing-9.54.0-18.el9_6.i686.rpm 3f5cabc84a76f40aeb260e4434a5e07109ac26bef55e15599112bdd6081b6374 ghostscript-9.54.0-18.el9_6.i686.rpm b7007b858a52f5745afe70161f0f4c07d89bfc019c32810bdb6b19a146b26bcb ALSA-2025:7423 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: io_uring/sqpoll: zero sqd->thread on tctx errors (CVE-2025-21633) * kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number (CVE-2024-58007) * kernel: tpm: Change to kvalloc() in eventlog/acpi.c (CVE-2024-58005) * kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVE-2024-58069) * kernel: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (CVE-2025-21927) * kernel: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CVE-2025-21993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.16.1.el9_6.x86_64.rpm 8a97747eb705e33fad2eef3327a86a81123d2209fa6d92bd4b587573c1924838 kernel-tools-libs-devel-5.14.0-570.16.1.el9_6.x86_64.rpm bb1f5dcce860e6df32bd94842406a0434a3bdd1bbb469dac15ae1c33fb227d8c kernel-cross-headers-5.14.0-570.16.1.el9_6.x86_64.rpm e6f26f938cde1c1b212d0927b74c03bd9f2bd7f54a5169753f2d7a353aec23e2 ALSA-2025:7430 Copyright 2025 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: Arbitrary file read (CVE-2025-3155) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default yelp-devel-40.3-2.el9_6.1.x86_64.rpm 36812e4fd2132f36a600d138d71fe0bb861e8c902cdb31e1ab1d83cf1008f663 yelp-devel-40.3-2.el9_6.1.i686.rpm 70967713115f03534a140cb92d1d3bbd4973da678a148f0c9988bedca291890d ALSA-2025:7437 Copyright 2025 AlmaLinux OS 0 1 Moderate

avahi security update

Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, view printers to print with, and find shared files on other computers. Security Fix(es): * avahi: Avahi Wide-Area DNS Predictable Transaction IDs (CVE-2024-52616) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default avahi-devel-0.8-22.el9_6.x86_64.rpm 1668a2a8c42d60798457ee267f32bcbdddee30e6372cc210dfd881421a232aff avahi-compat-howl-0.8-22.el9_6.i686.rpm 2514a74f7ab702968b568dcf591d33681d2d030727b57ad97f91df3765ab4ac6 avahi-glib-devel-0.8-22.el9_6.i686.rpm 3f4bbf62c13e25cf00a43b7c33b2dd60832ac6b0e395ebbd5ee045f0f345752e avahi-compat-libdns_sd-0.8-22.el9_6.x86_64.rpm 55a834eafc5ced555cd38bf1f2b738ac04ab1a2eaee51364a8dd41e06ba86d51 avahi-compat-libdns_sd-devel-0.8-22.el9_6.x86_64.rpm 65f02b4f5cb2db3a60aa05029076d2511d5be5b32cacb3f4eb13162bd48a2237 avahi-gobject-devel-0.8-22.el9_6.x86_64.rpm a02b3aa6e5e7ee8cb658ba86260dac24f4a87a783a3c64319caf28900372558a avahi-compat-libdns_sd-0.8-22.el9_6.i686.rpm a4a3adfbca3d71f1f6c196134b685b1d532da63edfd575cd1b929a94757548e1 avahi-gobject-devel-0.8-22.el9_6.i686.rpm a9c572ff66adfe4db0be9f572403a75373ec4473edd07a3d05015695d43fe502 avahi-compat-howl-0.8-22.el9_6.x86_64.rpm b2775aec4e5e28cbe92a9bd2e7722875e94c2e6f86c88751ea0fb55eaaebac8b avahi-gobject-0.8-22.el9_6.i686.rpm c1b875f6a966d810095ccdfa4e4bfe3bdfd13377947bc2aac5a3d62577e48907 avahi-compat-libdns_sd-devel-0.8-22.el9_6.i686.rpm cabd98b87ed43421b2acc4412e07e5ab7d881a6d25d4dee733ab8ee2d0aff55f avahi-glib-devel-0.8-22.el9_6.x86_64.rpm da3bea373f4d52b1620b1c280111ec112fe6674b03a0791809b54eb02eedaf03 avahi-compat-howl-devel-0.8-22.el9_6.x86_64.rpm e7a4aa27d34250c4a349b3c4a10d8929263bed4a3102fa52ef683fff46fc7505 avahi-gobject-0.8-22.el9_6.x86_64.rpm f46a0f269a3c1d35ca8baf762b9ecf71dbd1d05a64cab3716c74f6cb17c64e9b avahi-devel-0.8-22.el9_6.i686.rpm f730473001b70c38aae2eb3b7ab80e13da74eb89f6bd9af0e3a9fbe682216fed avahi-compat-howl-devel-0.8-22.el9_6.i686.rpm fb5502998ec8a57365c6ce6a221473e92ed12a988c998c47883bbd2c07f6b6f7 ALSA-2025:7586 Copyright 2025 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default ghostscript-tools-printing-9.54.0-19.el9_6.i686.rpm 0c05ffd22515d7ae264113a5230ffc3bc6913f6567b155bb48429c7ecdc148af libgs-devel-9.54.0-19.el9_6.x86_64.rpm 316ceb3d4c8cba2f33402dbb60dccab4aa791fbf8d7b6861239855f43d6dfbf6 ghostscript-tools-fonts-9.54.0-19.el9_6.i686.rpm b4c139abf2cc0982e37eb82a66548442b571d874909216b8e11b7c3b70847378 ghostscript-9.54.0-19.el9_6.i686.rpm cfa543635a4f01e16799711b035417be64a5350deb825b2d4ce9425e99cbe1db libgs-devel-9.54.0-19.el9_6.i686.rpm e07c980b66e01fa5362bb6c511aabbf6bcc7fa4dd8ba4a2adb565a4ed81901f6 ALSA-2025:7598 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.116-1.el9_6.x86_64.rpm dc5c3169216f3f5dcaec0a5f77e053f0f9ca99e83711cab20e2fd627a446b087 ALSA-2025:7600 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es): * dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.106-1.el9_6.x86_64.rpm 76af009a9fb75e05bc3a50578107ce6fdcfae1d55af9990c90ad88be57d80c43 ALSA-2025:7903 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vsock: Keep the binding until socket destruction (CVE-2025-21756) * kernel: dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CVE-2025-21966) * kernel: net: ppp: Add bound checking for skb data on ppp_sync_txmung (CVE-2025-37749) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.17.1.el9_6.x86_64.rpm 0f936e687fa0853dbcf1f5c94aa80fda70b784d014400728bf6d369b6a81db74 kernel-cross-headers-5.14.0-570.17.1.el9_6.x86_64.rpm 5033d259d932a2a3247303fbfdac80a58cac68635229add962b7ea318360e110 libperf-5.14.0-570.17.1.el9_6.x86_64.rpm e774a63756a28123443ff6aadf7cd2dba0d659a96b02407f8b79cb729920fe92 ALSA-2025:8142 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cifs: Fix integer overflow while processing acregmax mount option (CVE-2025-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.18.1.el9_6.x86_64.rpm 0c2563594f8a87374901f2338d231559c5ee8389d3e1099f633361bf6cc50465 kernel-tools-libs-devel-5.14.0-570.18.1.el9_6.x86_64.rpm 84b69514ccad0bd231110f37a32a7a0054ea098a78a783e5ed8c3814d676ae56 kernel-cross-headers-5.14.0-570.18.1.el9_6.x86_64.rpm e148c0bbac20604c2df8e99d0dc287c75cc00e1f3cab1e8ac4988d17f5638d40 ALSA-2025:8183 Copyright 2025 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default gstreamer1-plugins-bad-free-devel-1.22.12-4.el9_6.i686.rpm 4dc264132cfdf17551559437b042df33e0d69dfdf3ea769a2ee02309b640db88 gstreamer1-plugins-bad-free-devel-1.22.12-4.el9_6.x86_64.rpm d7ac06c1f936609b959a07ddcbe5b197fce94a13b185492f618f4907d7088017 ALSA-2025:8333 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Use after Free in gru_set_context_option leading to kernel panic (CVE-2022-3424) * kernel: ndisc: use RCU protection in ndisc_alloc_skb() (CVE-2025-21764) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.19.1.el9_6.x86_64.rpm 00e87921273d1e2f7b76b25caf220cb4f77318fe57903ad35a9bd7c8c3ef5462 libperf-5.14.0-570.19.1.el9_6.x86_64.rpm 21fac87e9bfd08a2de5a3735397f96dc35f248a0dcd90034f580c952ab47445a kernel-cross-headers-5.14.0-570.19.1.el9_6.x86_64.rpm 8f4590f319d70b5939550b29a2a296c176d84adcdbcfcfca156079efc9c72785 ALSA-2025:8337 Copyright 2025 AlmaLinux OS 0 1 Important

varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: request smuggling attacks (CVE-2025-47905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default varnish-devel-6.6.2-6.el9_6.1.i686.rpm 1407623b8507df19c2302e4cf0578a1afa7ab9f1cfa500b890e6326f3266c333 varnish-devel-6.6.2-6.el9_6.1.x86_64.rpm 7f9c762bfc878d0730db68162474f83e8800a3a15f68c31303595ed59ca3d3b0 ALSA-2025:8643 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: gso: fix ownership in __udp_gso_segment (CVE-2025-21926) * kernel: vlan: enforce underlying device type (CVE-2025-21920) * kernel: xsk: fix an integer overflow in xp_create_and_assign_umem() (CVE-2025-21997) * kernel: net: fix geneve_opt length integer overflow (CVE-2025-22055) * kernel: ext4: fix OOB read when checking dotdot dir (CVE-2025-37785) * kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CVE-2025-37943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-tools-libs-devel-5.14.0-570.21.1.el9_6.x86_64.rpm a302a96665d9ca6b19f8c1fc6b3fff951548a96fe3420b5382aeb9b9bc9bd47e kernel-cross-headers-5.14.0-570.21.1.el9_6.x86_64.rpm b5c210b243d3277bc35629a12a3d73ae35194abe3ea9ae9bd2d648da64b1acac libperf-5.14.0-570.21.1.el9_6.x86_64.rpm bf1991c7091c5b9ba5cb4f17e8a4c6c76dcf271aa57f97b80f3f1a6289a3e34d ALSA-2025:8655 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH (CVE-2025-4802) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default nss_db-2.34-168.el9_6.19.i686.rpm 0b951c30cc8b1716069ea99a0ceb6ef0f0ace2319bcb6a07d934e13385b43279 nss_hesiod-2.34-168.el9_6.19.i686.rpm 36a91fce39caecd69ba382cb5dddda3943db0133176e06fe9162b5ca240f0d02 glibc-benchtests-2.34-168.el9_6.19.x86_64.rpm 4b6ea986ba0e3aff8af7400faca34073db8bb268eb5e0e80bbf212cc0cc1bd35 glibc-static-2.34-168.el9_6.19.x86_64.rpm 5abe07803477f754a95f7464d64ab3323bdf8c13813fbd1a32d9fbcda0bbdba0 glibc-nss-devel-2.34-168.el9_6.19.i686.rpm 7cc2fc24b59c797c1d34ac7a58b195e6f436a8cee654611e2224f893a2defd56 glibc-static-2.34-168.el9_6.19.i686.rpm 88ded114e488468c3d6a99a5d513703d469ab5737ca3e39953109838e269491f nss_hesiod-2.34-168.el9_6.19.x86_64.rpm 93c0331c51f8d22b8f9da8ec33fbca3868648be9d82d8f0cbb995621d4b782b6 nss_db-2.34-168.el9_6.19.x86_64.rpm d28b3abd5215d9da3744d8c3ec5c441cc5809cc653db3fba41436741a4a34bae glibc-nss-devel-2.34-168.el9_6.19.x86_64.rpm dafc0e176d0255772fd31e4751501c4b076e3090ee8e5fe4b13ef5b6a2697939 ALSA-2025:8813 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-8.0-source-built-artifacts-8.0.117-1.el9_6.x86_64.rpm 117318334ac2de37665c00ece0ddf15b32232a90bc88ff9f8f9be729aae8c2de ALSA-2025:8817 Copyright 2025 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es): * dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default dotnet-sdk-9.0-source-built-artifacts-9.0.107-1.el9_6.x86_64.rpm 42fd4f0e27695cf3ca53bb327980b8d95c9bdcd10839525d02c3da2b0fab4b2a ALSA-2025:9080 Copyright 2025 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eth: bnxt: fix truesize for mb-xdp-pass case (CVE-2025-21961) * kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (CVE-2025-21969) * kernel: cifs: Fix integer overflow while processing acdirmax mount option (CVE-2025-21963) * kernel: wifi: cfg80211: cancel wiphy_work before freeing wiphy (CVE-2025-21979) * kernel: proc: fix UAF in proc_get_inode() (CVE-2025-21999) * kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126) * kernel: smb: client: fix UAF in decryption with multichannel (CVE-2025-37750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default kernel-cross-headers-5.14.0-570.22.1.el9_6.x86_64.rpm 7dbd004b1784d72414d43a99c5cf37c826f55ef10a7c35ca3b764289e0544f5f kernel-tools-libs-devel-5.14.0-570.22.1.el9_6.x86_64.rpm b54b5244b3d57932a1d1d0aec55846a049905b31c4a766967a4d13ed073b269f libperf-5.14.0-570.22.1.el9_6.x86_64.rpm c507159cb7517a7fa3219d224ceafcbb0b70a051a00e70ad93094cb2502d70a9 ALSA-2025:9114 Copyright 2025 AlmaLinux OS 0 1 Important

apache-commons-beanutils security update

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans. Security Fix(es): * commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default (CVE-2025-48734) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default apache-commons-beanutils-1.9.4-10.el9_6.noarch.rpm d5abbee0a7923ce4b894aea8eec8e6a87711d651ce8d72837dcad10c7084c5ca ALSA-2025:9118 Copyright 2025 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Double-free in libvpx encoder (CVE-2025-5283) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libvpx-devel-1.9.0-9.el9_6.x86_64.rpm 61987c13238f2aa180f03fff1bd49ccafdc4eacd44b678cc973948dff08aaa89 libvpx-devel-1.9.0-9.el9_6.i686.rpm c8a23e1ae246f08ad92d64b7d09657a67974d9ddbcd6e4f09fb59d58dbe7b04d ALSA-2025:9184 Copyright 2025 AlmaLinux OS 0 1 Important

ipa security update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default python3-ipatests-4.12.2-14.el9_6.1.noarch.rpm 331040804a9215b0f5fbcec70e7f800344c4d1f1a1394413916a202c09c06a91 ALSA-2025:9302 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ice: Fix deinitializing VF in error path (CVE-2025-21883) * kernel: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CVE-2025-21919) * kernel: ibmvnic: Use kernel helpers for hex dumps (CVE-2025-22104) * kernel: ext4: fix off-by-one error in do_split (CVE-2025-23150) * kernel: ext4: ignore xattrs past end (CVE-2025-37738) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.23.1.el9_6.x86_64.rpm 84e126012c8efa459f9184ed419a07bad3d3303d13890d99fefe8837b4ff3390 kernel-cross-headers-5.14.0-570.23.1.el9_6.x86_64.rpm af60030b7c306352b8af0a204d68b568ed369f7c5017a4130758447be76a36e2 kernel-tools-libs-devel-5.14.0-570.23.1.el9_6.x86_64.rpm f41790fce2862d6de7d092962c9307fd2ac26bca7b796ff2a32cace15dc36a21 ALSA-2025:9303 Copyright 2025 AlmaLinux OS 0 1 Important

xorg-x11-server and xorg-x11-server-Xwayland security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default xorg-x11-server-Xwayland-devel-23.2.7-4.el9_6.x86_64.rpm 46717c1b384d2c6b8a3fb6b27d7db688c6951fe412b21a6adeabee5d16ecc05c xorg-x11-server-Xwayland-devel-23.2.7-4.el9_6.i686.rpm 6bd29b98e3089db1f9c53124933c54956d5984d2913100b086e3bfdf6c6dd9ec xorg-x11-server-devel-1.20.11-31.el9_6.i686.rpm 89fa57d055b3cdd26e3b6cc9a73262bb99bdf5c840cd63852178fd2f1a08e291 xorg-x11-server-source-1.20.11-31.el9_6.noarch.rpm d0597aa66c866770c5ea810962474f4c55c86264f84a5f75b4e92f416e1c22a3 xorg-x11-server-Xwayland-23.2.7-4.el9_6.i686.rpm e0db68a8079370c597f0d7f63e72aa45b7e59c0543b9d903ba052d1292c8b96c xorg-x11-server-devel-1.20.11-31.el9_6.x86_64.rpm eb14b1bd6630619b59e781c0cf6209b544e10734f943f777c1dfb3937573dc7b ALSA-2025:9330 Copyright 2025 AlmaLinux OS 0 1 Important

perl-YAML-LibYAML security update

Kirill Siminov's "libyaml" is arguably the best YAML implementation. The C library is written precisely to the YAML 1.1 specification. It was originally bound to Python and was later bound to Ruby. Security Fix(es): * yaml-libyaml: LibYAML Perl File Modification Vulnerability (CVE-2025-40908) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default perl-YAML-LibYAML-0.82-6.1.el9_6.x86_64.rpm c17e2d63be6d8eea1ab859f99ec6b81dc62587a4d53594d52b16482d717b5480 ALSA-2025:9462 Copyright 2025 AlmaLinux OS 0 1 Moderate

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default qt5-qtbase-static-5.15.9-11.el9_6.i686.rpm 20f906ede6d0e36d0c9d2549dfa70b771650b19086746bc01e55b4011731b1cc qt5-qtbase-static-5.15.9-11.el9_6.x86_64.rpm a7ed03ac4a5777ceee49f8ee9688519092b7049e9e1f48965e110e7c7c4be2b9 ALSA-2025:9517 Copyright 2025 AlmaLinux OS 0 1 Important

perl-File-Find-Rule security update

File::Find::Rule is a friendlier interface to File::Find. It allows you to build rules which specify the desired files and directories. Security Fix(es): * perl-file-find-rule: File::Find::Rule Arbitrary Code Execution (CVE-2011-10007) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default perl-File-Find-Rule-0.34-19.1.el9_6.noarch.rpm 6e134185b9d45a1f2b199fbad1e1785420082f93ed527bddb5aa6eb456432605 ALSA-2025:9877 Copyright 2025 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Vector register overwrite bug in glibc (CVE-2025-5702) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default glibc-benchtests-2.34-168.el9_6.20.x86_64.rpm 176409c6017166113d71a14cea8a2d1eb09a9b2ae2f9098af96d810b8a60e7d9 glibc-static-2.34-168.el9_6.20.x86_64.rpm 2323a756e8b39a4b2b08111aa4b3e83e2c05296360152b5c36c4a35fb890c66d nss_db-2.34-168.el9_6.20.x86_64.rpm 482fd8a57f3492f90161abefe663f4ee1e479f885712629d5656aa41f414b61d glibc-static-2.34-168.el9_6.20.i686.rpm 523d1c2f247f76fc40c0d0fd18f1a3cab8f584f003dead548afff8f5fdd1e9d3 nss_db-2.34-168.el9_6.20.i686.rpm 533d4900ddcb4fe76c7d69e28b38fd641941ed432dad459899cf432a6ee90008 nss_hesiod-2.34-168.el9_6.20.i686.rpm 5a7e8dfab9a6b00a81937a9d9bbdf333d1c42b74d11f24023fb2db80770cee9a glibc-nss-devel-2.34-168.el9_6.20.x86_64.rpm 6d7b0e847c03c96664b314da045246eda533c4e348a0895dccd67f61f0bf298b glibc-nss-devel-2.34-168.el9_6.20.i686.rpm 87b05d9fc37a5f382429c25db1edaa634a7dfd5913bbf41f11778cd3762c4d1a nss_hesiod-2.34-168.el9_6.20.x86_64.rpm 97557afead88da30ba3c76a3447d97ad312732f965b1df3cc16c5c2d2d2dda45 ALSA-2025:9880 Copyright 2025 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Squashfs: fix handling and sanity checking of xattr_ids count (CVE-2023-52933) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_6_default libperf-5.14.0-570.24.1.el9_6.x86_64.rpm 023cb62233d4af34871d1cf29982646a9dbb33d5d4120993158c7a9eef82b5a3 kernel-cross-headers-5.14.0-570.24.1.el9_6.x86_64.rpm 62615d6aa9b7409a05146f6b1df833e3a3c2881eb2ad0fb5245dfc7bef0c855c kernel-tools-libs-devel-5.14.0-570.24.1.el9_6.x86_64.rpm eaff46fdc977fb78b8a7f6781d63e8929b2d3c8c2750ad1ba3872a74b29dedbe ALSA-2026:0126 Copyright 2026 AlmaLinux OS 0 1 Moderate

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default poppler-cpp-devel-21.01.0-23.el9_7.i686.rpm 13228279c26bee20737da2ef8fb829846cc9ec82cf7f9eeb64984c9547de3435 poppler-cpp-devel-21.01.0-23.el9_7.x86_64.rpm 2243dae40f087b795795ecacbe0bc9f176cb8720bbbd1ddccd19faf0e2dc3516 poppler-glib-doc-21.01.0-23.el9_7.noarch.rpm 2361e9dc4e8e5d5f1179ab44710407d24f216ee1d6c884ac602529632cff4d39 poppler-qt5-devel-21.01.0-23.el9_7.i686.rpm 4299835404f0fb322e6fa8b977adafcad6b1da54bc3de352ef3e386e395d625f poppler-devel-21.01.0-23.el9_7.x86_64.rpm 4aaa41ddfaa3dc0d693bdf0e602c573c0316667502a8825da9441b555bf9ecc7 poppler-qt5-devel-21.01.0-23.el9_7.x86_64.rpm 8c01886011c594608199bd7347c0baa4833fc27c8fda2b1f88447e3c504d7adf poppler-devel-21.01.0-23.el9_7.i686.rpm 9ce6deace771feea91516af567ac4eeebd9103e7b0d52be0fa0bd0253fe07f80 poppler-glib-devel-21.01.0-23.el9_7.x86_64.rpm aecab69cf1fac7fdf9314b0ea6ad2bbdacabdcaaabe41e147abdbcfa8748f6ff poppler-glib-devel-21.01.0-23.el9_7.i686.rpm dfefc302573721fddee36dac20dd9538665c8d47256b8a5389283f8700530f40 ALSA-2026:0137 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb security update

MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. Security Fix(es): * mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default mariadb-devel-10.5.29-3.el9_7.x86_64.rpm 86c422cd15fa28d889ce7c6dd56830b3d5696dd114fc4a11b56ccc6607e0feb6 mariadb-embedded-devel-10.5.29-3.el9_7.x86_64.rpm bd5bcf94bc16b371a2ebf0eaa748ede225319d5b634b1fe10392a83592ec1966 mariadb-test-10.5.29-3.el9_7.x86_64.rpm ca15542a2ac3343b69abaf96fe38f9cc492152640a224d3ab748b114d9a650a4 ALSA-2026:0445 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CVE-2025-39806) * kernel: audit: fix out-of-bounds read in audit_compare_dname_path() (CVE-2025-39840) * kernel: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CVE-2025-39883) * kernel: sctp: avoid NULL dereference when chunk data buffer is missing (CVE-2025-40240) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.20.1.el9_7.x86_64.rpm 21f19a01381f5694abe2e818174f51dedbd7e17b338523e1db825b6076540064 kernel-tools-libs-devel-5.14.0-611.20.1.el9_7.x86_64.rpm 4752b977fab7107b85e7504df429b775125ba1b11ee7930fff3726991a8a9053 kernel-cross-headers-5.14.0-611.20.1.el9_7.x86_64.rpm 6531b48f789f8365ec44d58e5ba40e240c75b5915593952a95f729a6ebcea4b4 ALSA-2026:0491 Copyright 2026 AlmaLinux OS 0 1 Moderate

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: CREATE STATISTICS does not check for schema CREATE privilege (CVE-2025-12817) * postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default postgresql-docs-13.23-1.el9_7.x86_64.rpm 1b2db538af9ebbb84cf903188e51a964585ecebead63ce86078f718f91c6f7cf postgresql-test-13.23-1.el9_7.x86_64.rpm 1becfad2c66a2165a8fec56e21c23c96b8590a78f81062e261272b8d42473a96 postgresql-static-13.23-1.el9_7.x86_64.rpm 1c612dac0ca2d4a7203bfe64e68e5cca3facfb180bb76bf9d6282defeb6391cf postgresql-server-devel-13.23-1.el9_7.x86_64.rpm 3da57b5b36808f2c40b1278800553e2d7a102a47594c6324d51569ab02ab48aa postgresql-test-rpm-macros-13.23-1.el9_7.noarch.rpm 8a5cd0ac240429ef34bfd5533793e0653bf11ce77496984eca7ac903213ae11d postgresql-private-devel-13.23-1.el9_7.x86_64.rpm 9580fc5f1ee024ab850dedc78df1b32df0a2c3879ff521dd9a45f33cdb08dc7b postgresql-upgrade-devel-13.23-1.el9_7.x86_64.rpm fc692a3fa7ee4201a92a06e24a1d0f71c67785c8acfa047b00e816d9f6b29666 ALSA-2026:0700 Copyright 2026 AlmaLinux OS 0 1 Moderate

transfig security update

The transfig utility creates a makefile which translates FIG (created by xfig) or PIC figures into a specified LaTeX graphics language (for example, PostScript(TM)). Transfig is used to create TeX documents which are portable (i.e., they can be printed in a wide variety of environments). Install transfig if you need a utility for translating FIG or PIC figures into certain graphics languages. Security Fix(es): * xfig: xfig: Stack-overflow allows possible code execution via local input manipulation (CVE-2025-46397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default transfig-3.2.7b-11.el9_7.x86_64.rpm 749058414c417dbe393d864c9fde8e6578ea0f8d7198836cced210eba5fc99d5 ALSA-2026:0752 Copyright 2026 AlmaLinux OS 0 1 Important

jmc security update

JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments. Security Fix(es): * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default jmc-8.2.0-18.el9_7.2.x86_64.rpm 461f3528aebf7a5f3a797da615400eadb1ef0ee944fe89a749ea8ea36262c542 ALSA-2026:0793 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/xe: Make dma-fences compliant with the safe access rules (CVE-2025-38703) * kernel: smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CVE-2025-39933) * kernel: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CVE-2025-40277) * kernel: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CVE-2025-68287) * kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() (CVE-2025-68285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.24.1.el9_7.x86_64.rpm 258d3805a99f4559c7de444303e3aa4a692b05e390d7400069d2942d4244661c kernel-tools-libs-devel-5.14.0-611.24.1.el9_7.x86_64.rpm 6f546d35380f568f8e08df9c7992b6946b364b46917c93c3f876121a18c4fad8 kernel-cross-headers-5.14.0-611.24.1.el9_7.x86_64.rpm e41d9ac66f05cbb1a2ea007b9a4c0025e35e92c4d2f867b5b82dbf7c1fc1adfc ALSA-2026:0927 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142862, AlmaLinux-142881, AlmaLinux-142882, AlmaLinux-142883, AlmaLinux-142884, AlmaLinux-142885, AlmaLinux-142886, AlmaLinux-142887, AlmaLinux-142888) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-17-openjdk-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 0830b55612c92deb1a9305ebd420d606a65eaa329a9fff900a0cad3992a1991a java-17-openjdk-jmods-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 1e1f084d388f753b5df740d54e9d894403bd27ad8185715b3b47365e6d244f71 java-17-openjdk-devel-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 2080de6590732ce50b25fb60a8c780e4700dd0ab97fb1a4b65115f54b129c0bd java-17-openjdk-demo-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 2c3fca942ba140658aa60c6c72a544ff210492cff50c64de4511788192d40736 java-17-openjdk-src-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 3a347ca86cec882b1e5ddeb59dc81d0224a095d9ee560db1f56d3d821e08bff8 java-17-openjdk-src-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 4103e7c4440714f2d9dcb2e690eb4ef4558f8950eb53823aa1c821bc09406bee java-17-openjdk-devel-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 6f974538c8de243b0fe8ce7a953b576221ee4ff005cd2b58c034b0938b43ceb9 java-17-openjdk-headless-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 9835c1c4433f3d62214be8fb96dd118174aa26a3431cc98cdf3cc38ade6f5b1f java-17-openjdk-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm 9b2e2501a0443f719f0b9892d47fda7fb0e4528faffb7692bc1caad1b0bc9d53 java-17-openjdk-demo-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm a0955969bbc870c0cffbb5742860ddf574c6cee68a4fc54e73d33d27b08ade2e java-17-openjdk-static-libs-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm a91f5112b74271c09ad567e9bd716b4c1c26cec0182fc0e0553bcbac7f30b5e9 java-17-openjdk-jmods-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm ab942e676676360acf08c21624f57b2b1072cc1bcd6417fcd35a8520af5d3868 java-17-openjdk-static-libs-slowdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm bd3dbecde72d36236ec30b785f7086ad586d47fdde938aa41408e96971ff5ecc java-17-openjdk-headless-fastdebug-17.0.18.0.8-1.el9.alma.1.x86_64.rpm df885d7c4a4858379a14f92c5eb3270105ab4585ae0f243971ff2e2f8103bc2e ALSA-2026:0928 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142860, AlmaLinux-142876, AlmaLinux-142877, AlmaLinux-142878, AlmaLinux-142879, AlmaLinux-142880) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-21-openjdk-headless-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 11b65e2024109df95f6d57440674ec946d65a6a09f3925663de9c287d1fa6b7d java-21-openjdk-jmods-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 11fb0c1a07c76cf87f190d890a8c0bd1d494c07535e13305ef9a4e4fe9dd63db java-21-openjdk-static-libs-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 1326426f5d229b1aae8981c0e5637a6e5a536b3418cd6a51701fdffc3ab7c5c9 java-21-openjdk-jmods-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 2318eb82890a251d88690f2a8451ba6531522f3cf33877ea9cf81c4045d2854f java-21-openjdk-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 571e601c645622d2af00405e781289d0daae8a95dbe3456dda4a407900c4f3d9 java-21-openjdk-demo-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 6b9dcf7c00922095ded755cb72c89734441b84d26f5c93a6aa399355a080b0a3 java-21-openjdk-demo-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 7eb312a9008c3ff80e3a9558d05d1822e40526929669ff9943cbab3680487b63 java-21-openjdk-static-libs-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 7eb76cb3a86d37a3798a8b96ada648830aeb8b30e81c33998f0f35fda45b4b78 java-21-openjdk-headless-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm 8fee02d6243646efb4581717bc150b99811d445336aa6b9df0d19172eece6dde java-21-openjdk-devel-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm ab0ac1fd32af38a91dbcb78a3e55ef43ee1db075ad8a6f54a4fdd52e34e0567b java-21-openjdk-src-slowdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm b965ff1a938d36b75cc04123cc4c7df36e8ca2423d212bcab996bfb0a1e2ac1e java-21-openjdk-src-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm bf9f1fd6a22e9142c05209a2ef68918a77e54c28aa7e155b85d309157b80ad52 java-21-openjdk-devel-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm e21228dcfd01456c0256e6d90de158335df09279036748c38081a26423f63dec java-21-openjdk-fastdebug-21.0.10.0.7-1.el9.alma.1.x86_64.rpm e7f726bb64695f5645f289b5a3ee5675cceb3d7ead816c4410a20aa7203fba08 ALSA-2026:0932 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) Bug Fix(es): * When using a P11SecretKey for both signing and encryption in FIPS mode, the FIPS PKCS11 provider would fail with a CKR_ATTRIBUTE_VALUE_INVALID error. This was due to the default configuration not applying the CKA_ENCRYPT=true attribute to the key. The configuration in this release is updated to include this attribute. (AlmaLinux-142865, AlmaLinux-142866, AlmaLinux-142867, AlmaLinux-142868, AlmaLinux-142869, AlmaLinux-142870, AlmaLinux-142871, AlmaLinux-142872, AlmaLinux-142873, AlmaLinux-142874) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-1.8.0-openjdk-src-fastdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 277b4747724bdf6ec307ead02ab5875e725da71187404512622784d9d17ea8b5 java-1.8.0-openjdk-devel-fastdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 2e29c4166af15387c96362403e3b2b9115822144e421082d454f80c3435efb38 java-1.8.0-openjdk-devel-slowdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 492f45c86919e9766495d0cf3abeb70153575786817aaaf4dce358205958260a java-1.8.0-openjdk-fastdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 53732f5ec75d296736afbd636a0eae741e8b1c85f299291575815308487818e6 java-1.8.0-openjdk-demo-slowdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 5d9009c0ea249269dc89556fd39a44ddb0d37726dc959b375f471190a07dfa61 java-1.8.0-openjdk-slowdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 8c5666e97e2b0d8e115540e74af667e7539715b5a722202851e40fca6336ee81 java-1.8.0-openjdk-src-slowdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 8d76cc9fa6dc3fdad7218af92ead3454c2bc2653ec29a5dda8bcd7d7b2a295e2 java-1.8.0-openjdk-headless-slowdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm 9997ac941cfbfca4a63e982cfbd580d61e460ac7ce2974c25a458dbb9a0edbd9 java-1.8.0-openjdk-headless-fastdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm a45d9eafc8a637d75ca720e72c840a6233e896b0defe84372c0e5d6b954005bd java-1.8.0-openjdk-demo-fastdebug-1.8.0.482.b08-1.el9.alma.1.x86_64.rpm b619120e857b556156f02976f9ee935c0be11ed2fe57f2ef969d77e90d8a22ff ALSA-2026:0933 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve JMX connections (CVE-2026-21925) * JDK: Improve HttpServer Request handling (CVE-2026-21933) * JDK: Enhance Certificate Checking (CVE-2026-21945) * libpng: LIBPNG buffer overflow (CVE-2025-64720) * libpng: LIBPNG heap buffer overflow (CVE-2025-65018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-25-openjdk-devel-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 09a370e016895e4f7e0080a3e01083136b6aa5bba11fec595086a63a97c74fed java-25-openjdk-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 3446811f99aa8d880b5ef7b7386b38051f008a4c20f1d47340abd15c25626e06 java-25-openjdk-crypto-adapter-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 4775c17d3b9bf263cb06e3f2de992dab58eb89aed46048f397296415e27d394d java-25-openjdk-headless-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 6301e2999a706072e804c32e6e7ac3e5ed0aebb7b29dacede336285f5b6cf9e6 java-25-openjdk-devel-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 755207766d2cc4a371ac059b538642e5bb4455926a031fbfebb5447b5661983a java-25-openjdk-src-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 79c351770ac8f27ea95fc4a568fbae12905de236aea78a975a1f7b0160ee4459 java-25-openjdk-src-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 7e8944d433607e68568fec7fc01021bd7b0881927abb30032a1860f5fbb004bf java-25-openjdk-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 8bd240b0ca4050f7b5cc8ea7fd763fd88bdae6c08de03dfc612cb158ca97aa41 java-25-openjdk-demo-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 8f5de129b22ce6cf1e9eb263de88e271fc86264d17cef9deff14fbcaca256650 java-25-openjdk-crypto-adapter-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm 9c458eca772c64391e92e2b107b92a40ba371a171e2cbaf497b739a05b2a037d java-25-openjdk-static-libs-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm ac23c6254b1021698c0f23ea2d64a67456e0527f7578cc9278c29edef03cb97a java-25-openjdk-jmods-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm b61892a32eadaa219604b8fd7cb320c1143e53242086c2f52f3acf113ee41ad7 java-25-openjdk-static-libs-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm c00c1a658092870cee036b469dcc967e8eb22284ddf723191936c05caf0bd73a java-25-openjdk-demo-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm c23412ab488513ea3df59bac0bcc0870faa6d98de9fd9dbe607c4734007cb194 java-25-openjdk-jmods-slowdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm ce60882d398248b6158d056a4e41a1bcca63826e1d3de31c75758ecb23ac08f4 java-25-openjdk-headless-fastdebug-25.0.2.0.10-1.el9.alma.1.x86_64.rpm da72cecaa0f5d73b9c3599faacc39dfd8e36a926f668619d2933f4e46f859d47 ALSA-2026:0936 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.1.i686.rpm 502b3b766edf2238f03d06db430371956dc3ac74745f6fca82f92be1cb75f6fa glib2-static-2.68.4-18.el9_7.1.x86_64.rpm ae32f26222d742e11be52ecba8573e403f0221fdeafbefdaf8c253bba9e59f44 ALSA-2026:10745 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-idle-3.12.12-4.el9_7.3.i686.rpm 36ba7ff33ee50139151f2630921fd13c3af4adf9814d19af48fbb6ed6985db29 python3.12-debug-3.12.12-4.el9_7.3.x86_64.rpm 3d06b5d6f5f76cec66589ae58cbcfacc08a7bc16f3d3b21b2e85a8efa1f461d7 python3.12-debug-3.12.12-4.el9_7.3.i686.rpm 700d5f2412ef19ffb748a13064efd016652ca933e412db1426bb5d665d1c6f96 python3.12-idle-3.12.12-4.el9_7.3.x86_64.rpm 7c097ab82b8095c96c627a6e9f970da8879387070a5e107b0c6b93088841f9dc python3.12-test-3.12.12-4.el9_7.3.x86_64.rpm 80cf51140e2fa1eaedb86dcae655f4561b13c497fa8a120cc76b531174ece652 python3.12-test-3.12.12-4.el9_7.3.i686.rpm 8eea5ac8f2617d72f48fba79edb26f3f75a8dad1b63ea90ed560abd2095834df python3.12-tkinter-3.12.12-4.el9_7.3.i686.rpm 97ff4893163dfdd2e5ce6af4897d4a3c59a664022c8a0a6577ff7ae8742dcd6c python3.12-3.12.12-4.el9_7.3.i686.rpm ba907bc046f428d72a4f649d876352230d1b0edac2cd3e167fe7645adfa28787 ALSA-2026:10774 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.11-debug-3.11.13-5.3.el9_7.x86_64.rpm 2e1bfce9cb56e918152ec064ca4afd0ee5d0762f58d7021c9cc13649c040d3b7 python3.11-idle-3.11.13-5.3.el9_7.i686.rpm 729f5680d9ac0df454363afe0ff1806dcd8108bf5d0d08a66ac784ee83577f2d python3.11-test-3.11.13-5.3.el9_7.i686.rpm 850cd47c23b3b5f57d621cbfae084d7b5bde0a4caf0f68206da9a0c4a947bff8 python3.11-3.11.13-5.3.el9_7.i686.rpm cfc5818a45b7340ba60ee8cecd62a7b5202751a04e64c077b43021240230fe2b python3.11-test-3.11.13-5.3.el9_7.x86_64.rpm d3378a9f34647424e3144a190e8ecd1b59ea207bf1b82dcedad09101c8dfd658 python3.11-idle-3.11.13-5.3.el9_7.x86_64.rpm e43eb2bb8771eee44d3eb44bf1b85ce2c8059632355244d6c457baf48713beb7 python3.11-tkinter-3.11.13-5.3.el9_7.i686.rpm f4fa1bf427a17b21a128a24f2052a6757023bfd914728303033b521f6eac1619 python3.11-debug-3.11.13-5.3.el9_7.i686.rpm fdc8e079e0aa6e0955cb4c2ae1b8b9b4958efa6db95a9c048fc060ae56590460 ALSA-2026:10949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-tkinter-3.9.25-3.el9_7.3.i686.rpm 0f063f9ce40f458f50bb4921fdc4b18e883a3df8b062284cdcda0dcb2d9769e2 python3-test-3.9.25-3.el9_7.3.i686.rpm 24f34bcb32445a1a327a3a896f67cd4b3f1d351ec8defa52f7c0056f69cfb534 python3-idle-3.9.25-3.el9_7.3.i686.rpm 6e4524f60a3a44f4093918282898277bba5c64f2c64415bdcb5d36881ea9d6cd python3-debug-3.9.25-3.el9_7.3.i686.rpm 77c3e54a8fa4e3dd513c65f6ebf74187231ae77687c635775ece4edc382cfc07 python3-debug-3.9.25-3.el9_7.3.x86_64.rpm 79dbfb2acf2c4c71f60170c1c40c11f20f4ea6eb7177dcb591d37dfd79c4c58a python3-idle-3.9.25-3.el9_7.3.x86_64.rpm 8553aff01a5fbce960ea6efaad13c09c32d1d9ca899775f5c9fef4d6279a1bc9 python3-test-3.9.25-3.el9_7.3.x86_64.rpm e3230f0474632e4113c40f201b0ba3f7978309ce25efa2615e681ffec603ec40 python3-3.9.25-3.el9_7.3.i686.rpm eb3c53dbd45e67a95cf9a2bc901130dd63cb5a0367ad350f17cf26e3c8092144 ALSA-2026:11360 Copyright 2026 AlmaLinux OS 0 1 Important

LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file (CVE-2026-24450) * LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default LibRaw-devel-0.21.1-2.el9_7.i686.rpm a50d568cb3e5755b912bd122ba5bd21e5568c5f66169cd574f9c8581343b2186 LibRaw-devel-0.21.1-2.el9_7.x86_64.rpm fea1423a45ea437c91c05c85e9de7a576390e20ed8b0cf125e7f0025b7ae5701 ALSA-2026:11369 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default xorg-x11-server-Xwayland-devel-23.2.7-6.el9_7.i686.rpm 751a261084e3ef22322e49a37708c7c154a22508ead508f85417fc7ce3b7cb6f xorg-x11-server-Xwayland-devel-23.2.7-6.el9_7.x86_64.rpm c9976024892013a78cccde63150c9bccb59e469b33b821befcad26d2dd757284 xorg-x11-server-Xwayland-23.2.7-6.el9_7.i686.rpm eb68b7299d74c1c6ba8685797cc46823b4265a5f512344bfe517a5c14431c38a ALSA-2026:11388 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default xorg-x11-server-devel-1.20.11-33.el9_7.i686.rpm 5353b779371d476035c91d56fa68ca851a729e8d8536607e6e3623db34fe1b7d xorg-x11-server-source-1.20.11-33.el9_7.noarch.rpm 7977bc9d7b343335f336cba8f279e8bdf48d3f7f820fe02724c0c96b17777138 xorg-x11-server-devel-1.20.11-33.el9_7.x86_64.rpm bafcf7facb6891f9fe89ad8556521e83458087a2c4f240a79cf256f80ed85479 ALSA-2026:1143 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in device mapper due to race condition in zone reporting (CVE-2025-38141) * kernel: Linux kernel use-after-free in eventpoll (CVE-2025-38349) * kernel: drm/xe: Fix vm_bind_ioctl double free bug (CVE-2025-38731) * kernel: Linux kernel: vsock vulnerability may lead to memory corruption (CVE-2025-40248) * kernel: mptcp: fix race condition in mptcp_schedule_work() (CVE-2025-40258) * kernel: Linux kernel: Out-of-bounds write in Bluetooth MGMT can lead to information disclosure and denial of service (CVE-2025-40294) * kernel: net: atlantic: fix fragment overflow handling in RX path (CVE-2025-68301) * kernel: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CVE-2025-68305) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.26.1.el9_7.x86_64.rpm 363bef07c0d1ca52fc76027094c8b9a0e5e12c3cbd9961c2b1ed8f3632e009da kernel-tools-libs-devel-5.14.0-611.26.1.el9_7.x86_64.rpm 6257bcb94345dcad3a05ddfab35b32127ecc8f00818793e3a713d1dfded7c307 libperf-5.14.0-611.26.1.el9_7.x86_64.rpm b39eff7f5f11943210188bf84dc4d912ce24c1d4f86aae7f01f286ad65049c51 ALSA-2026:11504 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default PackageKit-glib-devel-1.2.6-2.el9_7.i686.rpm c76846e542eeb20ff4f9f62cdbd21a26f067bba53a6d1b21ad4e08a787382657 PackageKit-glib-devel-1.2.6-2.el9_7.x86_64.rpm f25bd047b52dd64819dc24a43b10c9dccbbecc2002776731f01e1662883a9cb8 ALSA-2026:12271 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libtiff-tools-4.4.0-15.el9_7.3.x86_64.rpm 6a039e157f271b8f1da92e92041dfc4e36946f9985f9b050b818840604ec6ee9 ALSA-2026:13565 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.54.1.el9_7.x86_64.rpm 29954b21a39d7e5885699d98c178ff70522fc4a3210d248f1fc6e919748db2ce kernel-tools-libs-devel-5.14.0-611.54.1.el9_7.x86_64.rpm 91356b636317241d953830e9bb3e74649a62c624888a23ee6ed508802a18137c kernel-cross-headers-5.14.0-611.54.1.el9_7.x86_64.rpm 98610dc40ebc7bacd2957b4058b85a270569f70c439c2323d92b81c381b59d21 ALSA-2026:13673 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default corosync-vqsim-3.1.9-2.el9_7.1.x86_64.rpm c84be6ebc51ff3c2910364f61ff067492c62808559a48612c537802076fdb466 ALSA-2026:13857 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default dovecot-devel-2.3.16-15.el9_7.1.i686.rpm 4ca0074f32992db1e8c8762ebfab4c3381c9d27949f613d8baaeccc50d807e83 dovecot-devel-2.3.16-15.el9_7.1.x86_64.rpm ad39763b6681a892141a7a7a74b259afa69e02641963ce1508c7e87268bf296a dovecot-2.3.16-15.el9_7.1.i686.rpm db4f6927165f93c7fbfd3470cd23f9018a836c0deeb8308d871771533d8f51f8 ALSA-2026:1408 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-debug-3.12.12-4.el9_7.x86_64.rpm 41ee0a00eba6e1a69af324b84daff613d4d904e8350bdb3f1b4d148ee1b23a45 python3.12-tkinter-3.12.12-4.el9_7.i686.rpm 58212f0c258508fc8aee4de2c593f61548ceb549ed573fd2371d95fdd36e5bfb python3.12-test-3.12.12-4.el9_7.x86_64.rpm 610c2e0c387635ca4b883a2242c0aa63f1255613ce1bf3ef2f34c8702622304e python3.12-3.12.12-4.el9_7.i686.rpm 6713479ad770cdc457634f7b3409e9fe0e36f27757f80b1d2479c4f00f5e6d45 python3.12-idle-3.12.12-4.el9_7.x86_64.rpm 7540ec7e7a51d671b01aab8f02786a850252b3381f2f7ad8568ab554ad09b203 python3.12-test-3.12.12-4.el9_7.i686.rpm 8a92da9e0010bf3d86ecbe2c1adac933439b401f852d53ab343d33b28ddac3d7 python3.12-idle-3.12.12-4.el9_7.i686.rpm 8b0a267682f9e8b5ce5f081f0149c19772839c1a9161fc625b3836e6d63b8f51 python3.12-debug-3.12.12-4.el9_7.i686.rpm 9e598a361cfd24688a7f98cf889a33b1f3c8f8179a60d567910808e4b0696729 ALSA-2026:1410 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: Excessive read buffering DoS in http.client (CVE-2025-13836) * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.11-idle-3.11.13-5.el9_7.x86_64.rpm 03a42c7fd31159acde5f4069bdb9b3cca31a0b975b6c896349b71352d139cc40 python3.11-test-3.11.13-5.el9_7.x86_64.rpm 45dc4f503c7f563a1104491edd435ecc9dc11be57dcc2faa64a29814c6ca8854 python3.11-3.11.13-5.el9_7.i686.rpm 5c883cae8d3ba5682669417f5979a69753260205ff209f6e1628446f445268ed python3.11-test-3.11.13-5.el9_7.i686.rpm 73d4ca45bd23e98a5841f98506c52e522110568b9cbd95c1d43403d96b5ce3b2 python3.11-debug-3.11.13-5.el9_7.i686.rpm 8594539e467a2067dfc6e145657f5b71272430d3a852ecceda78fc109bc003aa python3.11-tkinter-3.11.13-5.el9_7.i686.rpm 96a4bdcb04e38ad127847725e2580f9b58580ed4a68e2dcb4e3eca18e71ef991 python3.11-idle-3.11.13-5.el9_7.i686.rpm bc5a6da52cd8f04f1f68622672204de417783c750f9b333e7dc5202ef9ecac46 python3.11-debug-3.11.13-5.el9_7.x86_64.rpm ca652f03126658a3117e25838d65b74b9c1c037a73409fd3fcb6d9a73734206f ALSA-2026:1478 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial of service (CVE-2025-12084) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-debug-3.9.25-3.el9_7.i686.rpm 4974c346bb0e8eb645f92c95ab1ab98dedeae7c24f8d899487ec5091e3879191 python3-3.9.25-3.el9_7.i686.rpm 4c3a753f2f5735989d60577fa6d40d16e241873ef1fa746c8db4b2010ac1c9b1 python3-test-3.9.25-3.el9_7.x86_64.rpm 7777537faac9205d800fa6d5a33b642c4256d7f6f5a7e515ba62af879fc95665 python3-idle-3.9.25-3.el9_7.i686.rpm 88b3b572c13aa9293c4a0106e038878783882577c0370c218965ec7f484f337b python3-debug-3.9.25-3.el9_7.x86_64.rpm c78b0f3b888573f566d6aff64ebae872d21b088e8720c58c681d74b738692984 python3-tkinter-3.9.25-3.el9_7.i686.rpm e7b9b590c3d42ed3c4f5f9f8fbc9b3f6e1cefe6560b44e10ec0cda66bd18e246 python3-test-3.9.25-3.el9_7.i686.rpm e7e8e120245c2b628d80682843891627c1c36603618a01c2051b7ee0dae2e54e python3-idle-3.9.25-3.el9_7.x86_64.rpm fa464940b613369a765a5b1a61992d9afcacbfdbc86c5768cc62aa8cbe82bcce ALSA-2026:14819 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default freeipmi-devel-1.6.17-1.el9_7.x86_64.rpm 72bcd45b41e16041a93305a4939bfbfeb75a32e03de6f559c607aaa4cdabc455 freeipmi-devel-1.6.17-1.el9_7.i686.rpm b171506b106af74b172261689c3c639f1619d1767b6a2ede5ccc680a4575a5c0 ALSA-2026:15887 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.2.i686.rpm 4b5205654cdab1311002fa566096a96ba92fab9015a917cf4e921df9baa37acf openexr-devel-3.1.1-3.el9_7.2.x86_64.rpm e6eaf2147f18e4967825247bf2bb280bdf46be60f0f87527248756ef6ece018b ALSA-2026:15971 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default glib2-static-2.68.4-18.el9_7.2.i686.rpm 42b3af2132ffe007684a232bdcc2bde32de6c9b29e1a931c3bc154f0111962d8 glib2-static-2.68.4-18.el9_7.2.x86_64.rpm 67bd9a77ac6f81f5899c90dd9bcd3e5d79f505aea43ae62de5b42cd8f3021db1 ALSA-2026:1617 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CVE-2025-38568) * kernel: ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CVE-2025-40154) * kernel: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CVE-2025-40251) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.27.1.el9_7.x86_64.rpm 50322b5ec6b030c57d861cabb7bd46e9887b0b042b3ecba5b3e546233cea4110 kernel-cross-headers-5.14.0-611.27.1.el9_7.x86_64.rpm c0561d083cf9c44900837da78b82f2fae8568019146756d58e88d68d9e683902 kernel-tools-libs-devel-5.14.0-611.27.1.el9_7.x86_64.rpm c2dec29fe8c722bd2015815fd2069dffeb3cdea1f4efedfb1b0539130e5252bc ALSA-2026:16206 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-611.55.1.el9_7.x86_64.rpm 2472a408dc1d07c67bfa7f1e8e57948a9023e4ecc758c5e1f23ed156a9762ebb libperf-5.14.0-611.55.1.el9_7.x86_64.rpm 306ba976a6acf1548db618124c8762fe9e6cfafc20233bd1ca33fde1e2124bc8 kernel-tools-libs-devel-5.14.0-611.55.1.el9_7.x86_64.rpm d53bb78a35eb84f7ea8b76ac63a4f425f9ae9727d4e1382e945345b0269e5c76 ALSA-2026:16482 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.7.i686.rpm 1ec24d932fb47bb0c8d0d90f58e9e9ecdd23bfd33ca87e34af276633170fb21f freerdp-devel-2.11.7-1.el9_7.7.x86_64.rpm 661031718af72d9dd48b09bad7979f16e196364b14cf3899b2a8e443700e6877 libwinpr-devel-2.11.7-1.el9_7.7.x86_64.rpm ec822104b938ca04440b337f3a7e2e28ac4b5e81b0abaa0335d55e7180beeee5 freerdp-devel-2.11.7-1.el9_7.7.i686.rpm fcc63505a26c06704293a30f8cd3fb4b706c6c0716cf11592ad5e8e3b62bc0f1 ALSA-2026:16693 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default jq-devel-1.6-19.el9_7.0.2.x86_64.rpm 7ab57c865fbf372b01c4a4bb06eb2a3292cf339f042363b19262810acc0a7498 jq-devel-1.6-19.el9_7.0.2.i686.rpm ae824f56fd0c286b4607cbd9b1b631b871fcd66fb50503afb40266f799cb5619 ALSA-2026:18029 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.3.alma.1.x86_64.rpm 5d8a0530bcda8762197ba8686b7673a0ad76eaa0f5869357e76afe1c0ce7e135 ALSA-2026:18039 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default ruby-doc-3.0.7-166.el9_7.noarch.rpm dc441426fb8f8b1808179658f6ed2f8315c547c138f967c0ed5905c8f7bc328e ALSA-2026:18587 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: bonding: check xdp prog when set bond mode (CVE-2025-22105) * kernel: block: fix resource leak in blk_register_queue() error path (CVE-2025-37980) * kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc (CVE-2025-38015) * kernel: espintcp: remove encap socket caching to avoid reference leak (CVE-2025-38097) * kernel: bpf: fix ktls panic with sockmap (CVE-2025-38166) * kernel: bpf: Do not include stack ptr register in precision backtracking bookkeeping (CVE-2025-38279) * kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails (CVE-2025-38400) * kernel: nvmet: fix memory leak of bio integrity (CVE-2025-38405) * kernel: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() (CVE-2025-38441) * kernel: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime (CVE-2025-38470) * kernel: fs: writeback: fix use-after-free in __mark_inode_dirty() (CVE-2025-39866) * kernel: dm: fix NULL pointer dereference in __dm_suspend() (CVE-2025-40134) * kernel: wifi: mac80211_hwsim: fix typo in frequency notification (CVE-2026-23040) * kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.5.1.el9_8.x86_64.rpm 89799d49ac28d41a9ba10e68494a96e9fb442309660d26f7bc19f5ae69b103e8 libperf-5.14.0-687.5.1.el9_8.x86_64.rpm a549d8f000a076e02dc4505686165b467d2a1f9a5d205b24979c8d2e5a7382da kernel-cross-headers-5.14.0-687.5.1.el9_8.x86_64.rpm b4fadf2018a5c725792ced8ec263294c35508ceab3fe90fea8110ba7d87ff263 ALSA-2026:18597 Copyright 2026 AlmaLinux OS 0 1 Low

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * networkmanagr: NetworkManager File Access (CVE-2025-9615) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-2.el9.i686.rpm 0666ffa405e37a80f78c259fb158d3760cb09e58387e677ca6b82d915c9665cc NetworkManager-libnm-devel-1.54.3-2.el9.x86_64.rpm b6025c41afacc15a9818c1b11cd6460883a18c3197e9e6a9443419a98ae70c7e ALSA-2026:18705 Copyright 2026 AlmaLinux OS 0 1 Moderate

mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default mingw32-glib2-static-2.78.6-3.el9.noarch.rpm 427345ab6bb853ed43bbeaeee61e3fe8ac7f3b3e5043ed079af88d2c7d6951ca mingw32-glib2-2.78.6-3.el9.noarch.rpm 8be95294a8c5b9b9bdcce963edc08c58882242f8a0fb25d3960d1e90ec8f98c0 mingw64-glib2-static-2.78.6-3.el9.noarch.rpm 9b06851a94f4f4658c2bc2d356be455a7ddd0fb44da48a832592b39c84ae4fba mingw64-glib2-2.78.6-3.el9.noarch.rpm a6b316346aa4440804f86f107147dcdd1a26e9a03c2525509d47114de9ada502 ALSA-2026:18748 Copyright 2026 AlmaLinux OS 0 1 Moderate

libvirt security update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems. Security Fix(es): * libvirt: Denial of service in XML parsing (CVE-2025-12748) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libvirt-devel-11.10.0-12.el9_8.alma.1.x86_64.rpm 54bb1c4caab892f8ad3c109ba24f6236ef1eddc33a991ea0d965f11be6ef90e7 libvirt-daemon-plugin-sanlock-11.10.0-12.el9_8.alma.1.x86_64.rpm 5c915db74cb250fb5378f0b39c988168e8c87f32d3d61c0f6fb7d5e2174f0027 libvirt-docs-11.10.0-12.el9_8.alma.1.x86_64.rpm 8ae7d221e84d4d054badd628541c756e7920c56961b9f257b1241b4bede4463d ALSA-2026:18786 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind-libs-9.16.23-40.el9_8.1.i686.rpm 1fadf9e748e30e714928fc5d14167b035e95ed60bad58cb0efd8c6711e7d4833 bind-doc-9.16.23-40.el9_8.1.noarch.rpm 7a708ea0e5ade26de56d37e766f45520e410ae5dad31b2b35508a727f6a1907b bind-devel-9.16.23-40.el9_8.1.i686.rpm b5ffaa1a965ece62e95158d6df489072b96cd523c9687ecf8920a0a08c368225 bind-devel-9.16.23-40.el9_8.1.x86_64.rpm cfc31457a9875b7323b7ab3601ef38c610585dab1020078bf4cb55e170c19290 ALSA-2026:18824 Copyright 2026 AlmaLinux OS 0 1 Moderate

luksmeta security update

LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux. Security Fix(es): * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libluksmeta-devel-10-1.el9.x86_64.rpm 4b83f0c4235897d8ed5abeec9b7769a3d625d33db44518a5899803144586266e libluksmeta-devel-10-1.el9.i686.rpm e4fe717afb8be13734f71e6d9885ff65acfef95ae944aabf291882d54bec544c ALSA-2026:18931 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: DNSBomb vulnerability (CVE-2024-33655) * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-2.el9.x86_64.rpm 92d355adce32c44c99543f3155e6f4af0d28be647273f4ceff07a88bf5864a3d unbound-devel-1.24.2-2.el9.i686.rpm b58d53ed99a09daf964f237ece28f02063ded34e659a426b926918077974bff7 ALSA-2026:1913 Copyright 2026 AlmaLinux OS 0 1 Moderate

util-linux security update

The util-linux packages contain a large variety of low-level system utilities that are necessary for a Linux system to function. Among others, these include the fdisk configuration tool and the login program. Security Fix(es): * util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames (CVE-2025-14104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libsmartcols-devel-2.37.4-21.el9_7.i686.rpm 0552380b5803f3db0ea125ee996a305d1f1a4cb5bb63c0cb56f4ff381712e599 libfdisk-devel-2.37.4-21.el9_7.x86_64.rpm 25fd9876827fca2341ec5a9c9af08cd5ec69e337fd03e7b494535989817aeb1b libsmartcols-devel-2.37.4-21.el9_7.x86_64.rpm 5f29076c99dfa86936145e876199b94be89ba8570157d21d21527a9d3e1f68d5 libfdisk-devel-2.37.4-21.el9_7.i686.rpm c6a754edd30eeea82e585b461f4802e3d356bee59dc8406e01adf7f4d6d08ac2 ALSA-2026:19175 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.11-test-3.11.13-9.el9_8.x86_64.rpm 4f289d6fbbbc643cccc6d9ab38030f9a8d4c84fc84672862e87dbb50dfb84d41 python3.11-tkinter-3.11.13-9.el9_8.i686.rpm 5233ec4538117fab579630e241eaaf1193b79439799937276859390199bd9fa5 python3.11-idle-3.11.13-9.el9_8.i686.rpm 6a60e513d5ce0068a77773c243f62c99b9c7f2d7d9b3927ea08b036ed059df17 python3.11-debug-3.11.13-9.el9_8.x86_64.rpm 9f0bc56cd122b01fb444248c82aaa208c3449eb750d14f20fd5099e2028fd248 python3.11-idle-3.11.13-9.el9_8.x86_64.rpm ad21b3f48b91c172372b51a91f5c180bb41a26f13dffc242f0099a5f97edadca python3.11-debug-3.11.13-9.el9_8.i686.rpm be042482078446fc5d29b0e30fde4f3f529eca7dd12f8622ae1ead03c6b4e896 python3.11-test-3.11.13-9.el9_8.i686.rpm d736182a8532bfab7a7ed9d72b6cc2b2e9dd4c804ea7338d4d5b1ba11002ceb1 python3.11-3.11.13-9.el9_8.i686.rpm da12ae877337a4c45367db7559e27e85a923f6f31d992e663b857c9be12fc34d ALSA-2026:19176 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.14-freethreading-devel-3.14.4-2.el9_8.i686.rpm 0b9998532fb69d7137095b1bbcd278f2d0eb245771d71b2c8954d63a7898e003 python3.14-test-3.14.4-2.el9_8.x86_64.rpm 27e508257d63495dee6c7dcc8bae7413687a89dff89b70d6065c402b3a841812 python3.14-freethreading-tkinter-3.14.4-2.el9_8.x86_64.rpm 2b4cc59e27523fe25ee945151d86eb65c2ab327780841e503f3547e5176b0fec python3.14-freethreading-3.14.4-2.el9_8.x86_64.rpm 2dce79284e084d2309ca2b2ad8099b7d5bff7020fb0735315480787da8af4883 python3.14-freethreading-debug-3.14.4-2.el9_8.i686.rpm 36af814511207ec535da565b675505b64b4540ff2a0a6cb66656dc9dbb750e2d python3.14-freethreading-test-3.14.4-2.el9_8.x86_64.rpm 40f750ea1dc9cfd05289f1dee33369d7b743c1d757bbfa0d7e08d762ca0d3d69 python3.14-freethreading-idle-3.14.4-2.el9_8.x86_64.rpm 41b7c47e565f1dec4ef2217b00756696d4fd9eef0614c51abb92459c5a76dd52 python3.14-tkinter-3.14.4-2.el9_8.i686.rpm 50e9506ec008bd8d6a683669d185b811c79803893c82d6e89d89a47355c4a70e python3.14-3.14.4-2.el9_8.i686.rpm 52d0d2f12b67cf2594871d38a8955bbf6ee8a597fc6d73aea48594b9919b7379 python3.14-freethreading-devel-3.14.4-2.el9_8.x86_64.rpm 7a38d69ee142273cb171aa0bc1750db1a22742341a513cfc2852aa1fb73babe3 python3.14-debug-3.14.4-2.el9_8.i686.rpm 86633ad5c1c4a19c96ef09854568274ab3c09c672b20df1ef2dcb68682e2a31e python3.14-freethreading-libs-3.14.4-2.el9_8.i686.rpm 87981b1020775b5e16931c5d7f25e11b25820dc2b364ccbf23bd36bff4d79fde python3.14-idle-3.14.4-2.el9_8.x86_64.rpm 8940cabb520125eec3dbfdec01647deeddd440d443109ec1280d97117a5b6073 python3.14-freethreading-idle-3.14.4-2.el9_8.i686.rpm 93da55fec34ebc44091e5f63c0cba392f5a06510a3c62be426fddaf6074c0f86 python3.14-freethreading-test-3.14.4-2.el9_8.i686.rpm a3a96f4e21133c2df54c21ef7e8954feadca377dcd4433917d0c7e4a02a6e41f python3.14-freethreading-3.14.4-2.el9_8.i686.rpm b319f4987f3571ca40757652809ab0b482d74f05c8e7dac975e11e079c277efa python3.14-freethreading-debug-3.14.4-2.el9_8.x86_64.rpm d69fa58c81d84b4cc1511e02d657f7dd1a13036c72aa8ad475894c3ed576715f python3.14-debug-3.14.4-2.el9_8.x86_64.rpm d8b2ec94d2a99306f553e0d329cc0169604b1d3bc009d15994ab48b0b5d7938f python3.14-idle-3.14.4-2.el9_8.i686.rpm e0132a14fabd1d35475a3f5b064c85f40a2f057db2c9be01323aa13a2b8c526d python3.14-freethreading-libs-3.14.4-2.el9_8.x86_64.rpm ec0a9350f91508e23fe2ba0fcabcd23d1cf1937006f42a2be99a0bbef0260fab python3.14-freethreading-tkinter-3.14.4-2.el9_8.i686.rpm f49f1b0276bcbab4d6f8736facee963a243654faea0c61aaee791ef623fc06d9 python3.14-test-3.14.4-2.el9_8.i686.rpm f92634e8a43df10cd254b72937cad95ea275cb3ef8791e17cf023593288a97e9 ALSA-2026:19177 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075) * cpython: Out-of-memory when loading Plist (CVE-2025-13837) * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282) * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.12-test-3.12.13-2.el9_8.i686.rpm 02e1576c43c59747e1c748007aef02c557dd83bd41f7f6a9036e749d53cc8f6f python3.12-tkinter-3.12.13-2.el9_8.i686.rpm 0ccb9cb0d01a4ac40433350beff069f584cc870073ee43737dc6667dfeb0be72 python3.12-3.12.13-2.el9_8.i686.rpm 49b0c5b0d32d4b6eabdea085b3c1e1db5ebf234f392c77630fefb1efbd1b709d python3.12-idle-3.12.13-2.el9_8.x86_64.rpm 661f64b34ac6d1cd350564e89a1fe250a54fe70eb9cc878464640b4a8f89ff1d python3.12-test-3.12.13-2.el9_8.x86_64.rpm 8d1cefd0756a04a29be47ecf2478b3376da679ce434bbebbbde208ff316dbedf python3.12-idle-3.12.13-2.el9_8.i686.rpm 9963bc39fe571616e09e2b6056766e1b8d30ed0d90c0bd9656e1e25e93eec42e python3.12-debug-3.12.13-2.el9_8.i686.rpm b0b3a66d2c5279fe219456c622cba0c5cb05f56daea1c3810faf44cc98f1919e python3.12-debug-3.12.13-2.el9_8.x86_64.rpm b3d0ce54c29bb34219ac6792a5d78bc0ca377b3be4ca14e1f002be6301a01d86 ALSA-2026:19180 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.x86_64.rpm db46c52f67960b5d2e86ac171072910f64e9c3c408e0da414a25d89a04a687d0 ALSA-2026:19200 Copyright 2026 AlmaLinux OS 0 1 Moderate

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091) * corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.1.x86_64.rpm fe731e4cc6ebbffebb145f4ab367865a07e6c0b5b0f05b7dbed66da013537a85 ALSA-2026:19208 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freeipmi-devel-1.6.17-1.el9_8.i686.rpm 14985e9d88bfb81b6a129a1c0780de5b38cb647ef47d2f2489505a8ff9564230 freeipmi-devel-1.6.17-1.el9_8.x86_64.rpm 7af8a7c29a59ac52651a83d273129f68f668d1a5837aefa7fba8d1b61b61c12a ALSA-2026:19216 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-tkinter-3.9.25-7.el9_8.i686.rpm 0593791c6069e178968355b8d965f02f01e47787014aa5b51332a7188e6649f0 python3-debug-3.9.25-7.el9_8.i686.rpm 1217fe891e4d8bcccaae5efd554b48b1e46a96d2d4107dd47193767faaf5c376 python3-idle-3.9.25-7.el9_8.x86_64.rpm 4999b32d0e89b7975add3fcfeca380de50173641a265d5e9c471e266877baf00 python3-idle-3.9.25-7.el9_8.i686.rpm 5c339b6237c5d9a0134f7dabdeb6f5b0b07d9c384ab4c508d37d6036f13aeb60 python3-3.9.25-7.el9_8.i686.rpm 60a60de45a6a3864abd3eb4d5977afff34f6e1ec31fe081866028e9cbd62f704 python3-debug-3.9.25-7.el9_8.x86_64.rpm 6cfb81e5198f24e8bd492a046f34b1f7f29cbaf7a2eff9e7a216aef5d05c2dc6 python3-test-3.9.25-7.el9_8.x86_64.rpm 937a55be6a317ec7a1767c56bf3dd17b8b0b0246bc19c3ee6c801dd8fafe95ba python3-test-3.9.25-7.el9_8.i686.rpm d5f2f3da10d0a30bfa010de5b77930067d66feacfcdb0922da09d39d590b656b ALSA-2026:19225 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060) * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677) * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.5.3.el9_8.x86_64.rpm b804b370023deef1e7bac656275ed9805fb13e30586c2aedc5bab2bef82c4781 kernel-tools-libs-devel-5.14.0-687.5.3.el9_8.x86_64.rpm e5e6cd4c2fbffb4ce2f7476e41a37328d57d6cce1d122758571ec438c9083b03 libperf-5.14.0-687.5.3.el9_8.x86_64.rpm f2ccc96536b9d2b8a6c8b8cc1e85135903effdba1b03ab90635dd7cf9fac838d ALSA-2026:19343 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.i686.rpm 2dcfc6c88e8a30d6e686f68a65448bd6f736495fede50d5ae1926b64eec0f582 xorg-x11-server-devel-1.20.11-34.el9_8.x86_64.rpm 825e8fbc3a7cf0d7d66629046634bf700093d87973b4a5daa5126d6df6960160 xorg-x11-server-source-1.20.11-34.el9_8.noarch.rpm bb78b968af0f2f81e05afecea1ae46d98b6de0d70d3568bef2d7a8d1c64117a1 ALSA-2026:19344 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999) * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001) * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-Xwayland-24.1.9-4.el9_8.i686.rpm 87295b0240d28a7265c3a7ac29df4c0c4c28fb39264173f5d16c8625294c05c4 xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.x86_64.rpm e05b6759e71545a91f32b26464ccdb3165d7b53fc52795d8b0519064f68ca717 xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.i686.rpm e834b81f1dec898f760eb7dcf4d85c8f225743e4b3882a50465da6cde501b98c ALSA-2026:19345 Copyright 2026 AlmaLinux OS 0 1 Important

LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: LibRaw: Arbitrary code execution via a specially crafted malicious file (CVE-2026-24450) * LibRaw: LibRaw: Arbitrary code execution via heap-based buffer overflow in lossless JPEG loading (CVE-2026-21413) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default LibRaw-devel-0.21.1-2.el9_8.i686.rpm 2fad67d7124166fda110eb24cf8f4b9186115e1f3286938691caaf7cbac5b862 LibRaw-devel-0.21.1-2.el9_8.x86_64.rpm cadbb2ae1284d91e144d29b5a16da9bcfdb23dd8e37697d458f68a13b5d76774 ALSA-2026:19354 Copyright 2026 AlmaLinux OS 0 1 Important

PackageKit security update

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API. Security Fix(es): * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default PackageKit-glib-devel-1.2.6-2.el9_8.i686.rpm 7c14d96d71f8211872b0c5d981a2b487b3129ebf1a2be22763064ab51c2da0d6 PackageKit-glib-devel-1.2.6-2.el9_8.x86_64.rpm 88edc14fa31ba5e54ee14251eb9f30ac2291f74baec89180dbd40312eb1ca24d ALSA-2026:19358 Copyright 2026 AlmaLinux OS 0 1 Moderate

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952) * freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986) * freerdp: FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity (CVE-2026-27951) * freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775) * freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885) * freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884) * freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883) * FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.3.x86_64.rpm 898e48146a2ab97692d63b0887543b95b8c74642c2bf6b08244e21429dec7f0b libwinpr-devel-2.11.7-7.el9_8.3.i686.rpm 9e7cb7cf1e40b12eeef4e21d54968e2513f9eca938ad8cca4bc87a18d594a09f freerdp-devel-2.11.7-7.el9_8.3.x86_64.rpm cd9633cbe4ae58a38f0a5111d32020bf3cd694d32bda7cab93e8aac1a9f51a26 freerdp-devel-2.11.7-7.el9_8.3.i686.rpm eb4a161af6faaa4f343cc3f69ee1778cd1aaa863043ee82406ad2a16c6766fcf ALSA-2026:19359 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.2.i686.rpm ad192d414bf3c3ee1deb6ba7f1bce0e7a36c88e2b9812d8b0a2ca91b6c08a6ba openexr-devel-3.1.1-3.el9_8.2.x86_64.rpm c2367450b68fd5abb8093bad6774105f912b606c19f3cd164cf5b95af422eb5c ALSA-2026:19361 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087) * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.1.i686.rpm 5a5d5214cb30270ebca165b1a72b44af91e3376bee276653e49a78425f38d3fc glib2-static-2.68.4-19.el9_8.1.x86_64.rpm ec7c88566e1ecf01da2f3f9c8e663b38389e1bdeab1c6ef42b0d92fba0b5e0de ALSA-2026:19363 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.x86_64.rpm 8b35e76bddd73aadc9e0071ecbb61bccaaa9d93901da01cbc961567fa1fa76d4 ALSA-2026:19364 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032) * dovecot: denial of service via crafted message before authentication (CVE-2026-27858) * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.x86_64.rpm 07c05a77a9e3ec220cf9114253d341662dbb078999fcca3b6245f4a3b9352ab0 dovecot-devel-2.3.16-18.el9_8.i686.rpm d8c51aef6d29c4f50b7d7c4368fd82d1a37144b8aecfa7eaf408aa581d87bb38 dovecot-2.3.16-18.el9_8.i686.rpm eddfad6e0e60cc0516e6c0124400c29f4483da9adca853516854933ed9c106b2 ALSA-2026:19365 Copyright 2026 AlmaLinux OS 0 1 Important

jq security update

jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text. Security Fix(es): * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979) * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default jq-devel-1.6-19.el9_8.2.x86_64.rpm 005944df9ca3eb8fb0dcfad35d0577ac857bc0f5a03375e658694c17f3552ab3 jq-devel-1.6-19.el9_8.2.i686.rpm f6928d8cd047f9264c3c48574c7d9ec8f73048c7484a83eb87d428ad98ac5241 ALSA-2026:19367 Copyright 2026 AlmaLinux OS 0 1 Important

giflib update

Please update For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.1.i686.rpm 171946fdf42e71991a8371ef796bb54a89e10533fc65bf9e9969f618e170c92f giflib-devel-5.2.1-10.el9_8.1.x86_64.rpm 28d5738e39364b4d132f5b5dd24d37bb85886527ccdeb2f830cce3364b0eb114 ALSA-2026:19374 Copyright 2026 AlmaLinux OS 0 1 Critical

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.2.alma.1.x86_64.rpm e00be1d44a29e4e10735ff26af5be88f51c77908fabccaa71725bfb3a036594f ALSA-2026:1939 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12-wheel security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking (CVE-2026-24049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-wheel-wheel-0.41.2-3.el9_7.1.noarch.rpm 436b6074dfdf7f27a4a5213aa406d06839c5599bd4ffee848fcac89755ee127a ALSA-2026:19568 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() (CVE-2026-22984) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state (CVE-2026-23136) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401) * kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402) * kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532) * kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607) * kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) * kernel: Read root-owned files as an unprivileged user (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.10.1.el9_8.x86_64.rpm 4a33af01dbce4102901dd70d3fa255c0053fc0a7d892f4047c562941e8d85263 kernel-tools-libs-devel-5.14.0-687.10.1.el9_8.x86_64.rpm 695f9915e36d2da8c0ef9b5f9d233a46fccd21c984fdd7841dbf234780f101b5 libperf-5.14.0-687.10.1.el9_8.x86_64.rpm d18574f0220de906c1676b7cd5ba1b216c6113e3fe1122630879c6ff3b1ab1c2 ALSA-2026:19610 Copyright 2026 AlmaLinux OS 0 1 Important

libsndfile security update

libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fix(es): * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libsndfile-devel-1.0.31-9.el9_8.1.x86_64.rpm 619508b0fbc75e4d0847d92c6a856eed40e70e262adeda0a8f27777a3653e802 libsndfile-devel-1.0.31-9.el9_8.1.i686.rpm e948629fc15e13b5cbbc3f9696874a0c1652c3d3dc43caaad4b8c0aa0ae2b090 ALSA-2026:2039 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via heap-based buffer overflow in BMP file parsing (CVE-2025-15279) * fontforge: FontForge: Remote Code Execution via Use-After-Free in SFD file parsing (CVE-2025-15269) * fontforge: FontForge: Arbitrary code execution via SFD file parsing buffer overflow (CVE-2025-15275) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default fontforge-20201107-7.el9_7.x86_64.rpm 5011d874eb13f44496980d79ae0b8cd9bfa004db13120c468575164c2a263041 fontforge-20201107-7.el9_7.i686.rpm c1f3fd59015f233656f63bd6bf43515adcb1fb56dc579e67cc671bb3ab09f8af ALSA-2026:2048 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530) * freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884) * freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883) * freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533) * freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531) * freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534) * freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.1.i686.rpm 3e746c4ee8c13e842852588cf61b68cc9cacafa4cc2012dd09b746a58a56c4a0 libwinpr-devel-2.11.7-1.el9_7.1.x86_64.rpm 8c804e1492c1e51df78211b27937bc8ab9e36364b214b688bd13ae9f63f06db1 libwinpr-devel-2.11.7-1.el9_7.1.i686.rpm a4d227b4b0017cac5cec123f6a61f22442758234a10d486b7037c936431008c9 freerdp-devel-2.11.7-1.el9_7.1.x86_64.rpm aae037fc7fd9e1eccf6e9ca7a8440d4f0736a615a0744a83ac47deef65938d43 ALSA-2026:20568 Copyright 2026 AlmaLinux OS 0 1 Important

jmc security update

JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments. Security Fix(es): * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) * org.eclipse.jetty/jetty-[http:](http:) HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default jmc-8.2.0-19.el9_8.2.x86_64.rpm 6d3900910dc3a1ba60b3899eb9f2cbd8db74b34e9a969c60bee289a2120aff1d ALSA-2026:20597 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437) * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438) * glibc: glibc: Denial of Service via iconv() function with specific character sets (CVE-2026-4046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glibc-static-2.34-270.el9_8.i686.rpm 06138378214776d30aaed7cf5cacf0011be030831243813f05ab563d7cee4f90 nss_hesiod-2.34-270.el9_8.i686.rpm 16b601ed53ed8c13b8c44554700476f1837bdbb2d12f80a6de30cc5bab9c937e glibc-nss-devel-2.34-270.el9_8.x86_64.rpm 352fdbe51875eae557a6f9b48fc6466db5a380244abd1b4fd22fcc767672690a nss_db-2.34-270.el9_8.i686.rpm 401e5ef60281afbe9a6a98ec73ae1388d31da273c5b438415e0963092920c316 glibc-benchtests-2.34-270.el9_8.x86_64.rpm 58c0868d9441770793c053202cf652443d04a1d3cb94b79ed6a8abbd70b30dc5 nss_db-2.34-270.el9_8.x86_64.rpm 6a5488e4c0c9f2f5e8d7c9a9360dcc4b0ef546d94b6591bc1f3de18992941487 glibc-nss-devel-2.34-270.el9_8.i686.rpm 968bd288b604fceba71a208c33dd355988b962722629b2fc72fc2d86310a1e9d glibc-static-2.34-270.el9_8.x86_64.rpm 9e3019c66a42430ef78656a593b9a142f3ec0729836dbc55bcd25ecf4aa87a9b nss_hesiod-2.34-270.el9_8.x86_64.rpm ad5079c2f46582dd71f5a2092103c8ca73df10edf7a82f5be1055774f7ce2338 ALSA-2026:21293 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es): * serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043) * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.127-1.el9_8.x86_64.rpm af473344d68cc3ecfb2ab7341598a75fc0339007474b089d88aab87e1a4974b5 ALSA-2026:21296 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.117-1.el9_8.x86_64.rpm 0216c99a73c72823d8da2ad8143ff42fe9240fec041ecdacef595bc7603b1997 ALSA-2026:21297 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es): * dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.108-1.el9_8.x86_64.rpm d370e70607a0488ac4a94ee25a87eec102c380a07c0009669230edb9084137c7 ALSA-2026:21556 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183) * kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366) * kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724) * kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089) * kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408) * kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684) * kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020) * kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051) * kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709) * kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023) * kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110) * kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190) * kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158) * kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.12.1.el9_8.x86_64.rpm 533c97ec47752a61bfb160d35b52621a48f3eb006750960eb932351f2c2998f2 libperf-5.14.0-687.12.1.el9_8.x86_64.rpm 698f5c7e184c3e2cab54f6ef3c90bacaf61d2853630c5e93fdad405248080b3c kernel-cross-headers-5.14.0-687.12.1.el9_8.x86_64.rpm b6e13821829b2821f8621710df2c11bebd85c201798ee62e193cd912a64910a1 ALSA-2026:21755 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.1.i686.rpm 1174f389eccd85436dc8940a458c2075227e2f149bcd2d9dd484070f4704202d flatpak-1.12.9-4.el9_8.1.i686.rpm 6a66da68efcb9e6f79643e9ead12b6668310efee8713ae2d949bc2bf035274b4 flatpak-session-helper-1.12.9-4.el9_8.1.i686.rpm cd01d8a06b1b08a7847e4745d3a776b358a7ecd8159860417bc41d0933e495e8 flatpak-devel-1.12.9-4.el9_8.1.x86_64.rpm d700fcddc9e2eed17f1690d8faf99ce09351eab2e8eaeb22c66efc7d11bb1284 ALSA-2026:2212 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: openvswitch: fix nested key length validation in the set() action (CVE-2025-37789) * kernel: Linux kernel: irqchip/gic-v2m use-after-free vulnerability (CVE-2025-37819) * kernel: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CVE-2025-38022) * kernel: Linux kernel: RDMA/rxe use-after-free vulnerability leading to potential arbitrary code execution (CVE-2025-38024) * kernel: Linux kernel: Memory corruption in Squashfs due to incorrect block size calculation (CVE-2025-38415) * kernel: vsock/vmci: Clear the vmci transport packet properly when initializing it (CVE-2025-38403) * kernel: Linux kernel: Denial of Service in ATM CLIP module via infinite recursion (CVE-2025-38459) * kernel: Linux kernel: Data corruption and system instability due to improper io_uring/net buffer handling (CVE-2025-38730) * kernel: Linux kernel: Denial of Service via out-of-bounds read in USB configuration parsing (CVE-2025-39760) * kernel: net: use dst_dev_rcu() in sk_setup_caps() (CVE-2025-40170) * kernel: ipv6: use RCU in ip6_xmit() (CVE-2025-40135) * kernel: Bluetooth: ISO: Fix possible UAF on iso_conn_free (CVE-2025-40141) * kernel: ipv6: use RCU in ip6_output() (CVE-2025-40158) * kernel: Linux kernel: Use-after-free in proc_readdir_de() can lead to privilege escalation or denial of service. (CVE-2025-40271) * kernel: Linux kernel ALSA USB audio driver: Buffer overflow leading to information disclosure and denial of service (CVE-2025-40269) * kernel: Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CVE-2025-40318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.30.1.el9_7.x86_64.rpm 1347877356c774a108579229ccbd2f8b7bf9172881fb47c00c129ff7f2e3b4c3 kernel-cross-headers-5.14.0-611.30.1.el9_7.x86_64.rpm b8f978a341f1399e84d7988db154591f9764add896616c857a9d18ce64400f63 kernel-tools-libs-devel-5.14.0-611.30.1.el9_7.x86_64.rpm e6de27f08504ae5e60c8eeb74a7772b5439157b93757ab51259cd04a90b45bee ALSA-2026:22553 Copyright 2026 AlmaLinux OS 0 1 Moderate

libexif security update

The libexif packages provide a library for extracting extra information from image files. Security Fix(es): * libexif: libexif: Information disclosure and crashes via integer overflow in Nikon MakerNote handling (CVE-2026-40385) * libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libexif-devel-0.6.22-6.el9_8.1.x86_64.rpm b8b1802a8e4277a83e9952f18f76438adb20f0e0165ba1a2165f93edb534af3e libexif-devel-0.6.22-6.el9_8.1.i686.rpm c30b9e695a463e5440cb63b9969fe61a5fe1daf0c9ab0a30a49ed3dc6eb9165e ALSA-2026:23332 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236) * mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303) * mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-34293) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34267) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017) * mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304) * mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276) * mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270) * mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default mysql-test-8.0.46-1.el9_8.x86_64.rpm 8edf88a08e35d8f0a8324e7f16c23376f0bbfc2b83123628697f9e0ac2f02f66 mysql-devel-8.0.46-1.el9_8.x86_64.rpm b28ed3804800bcbe4243a85c29698d0e301c82f4fc00651633e78b35095c193e ALSA-2026:24367 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.2.x86_64.rpm 16ee7ae5e23972401dc27d3107d1738eba4b5dffcb6ea3b7963ba3ca1306c898 bind-doc-9.16.23-40.el9_8.2.noarch.rpm 61557bd6cb05170436252e5a32b80a4d838bbf099ce27f4a5fbaafc9065f9b18 bind-libs-9.16.23-40.el9_8.2.i686.rpm de0583c5ffcb98a68f99f2395b6b49a212992b0d51f7f1e5fcfe7635a201772d bind-devel-9.16.23-40.el9_8.2.i686.rpm f477a75e01cbf27ca0db2da84e2226cca016371bc39e9294f568efa6311d4272 ALSA-2026:24368 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind9.18-devel-9.18.29-14.el9_8.2.x86_64.rpm 5dda94e0eb4e43ed8e306596a363d7eadde459ff130af7a3b06da22d0d3b018a bind9.18-doc-9.18.29-14.el9_8.2.noarch.rpm 68a27d03850179ffcde06f989314cd19345ba7c77add31751ac85aa364d71405 bind9.18-libs-9.18.29-14.el9_8.2.i686.rpm c47222191b9561dee41b8863985e5834ae3436f89d9b9a2772e79ae024ea46f6 bind9.18-devel-9.18.29-14.el9_8.2.i686.rpm dc8a97a95ec7ffc977d4e36d622413880af6c6d70e72e5a5981ad2d01e444714 ALSA-2026:24369 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959) * unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.1.i686.rpm 3da1264d0032751dff287ccf29f26bc43a98e97377472e666de82ce4c2b29459 unbound-devel-1.24.2-3.el9_8.1.x86_64.rpm 872dbc55b9105a16a5877502a736a52a97468b8e069cad37215286199c3f4b8f ALSA-2026:24381 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786) * kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.13.1.el9_8.x86_64.rpm 4581d39d95680de0fe1e10dc9c78319634817d74aeb21217bb5b5e90e900d320 kernel-tools-libs-devel-5.14.0-687.13.1.el9_8.x86_64.rpm 57913697e98f3db9001c6da4464003c3d3813e45c184a46d384a4a796f57f8e3 kernel-cross-headers-5.14.0-687.13.1.el9_8.x86_64.rpm 625d041835189968a246bef5a3fc0a01d421a1119346960b2f17faf72ec0e621 ALSA-2026:25049 Copyright 2026 AlmaLinux OS 0 1 Critical

samba security update

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * samba: group policy certificate enrollment uses <http://> without validation (CVE-2026-3012) * samba: Samba: Remote Code Execution in printing subsystem via unescaped job description (CVE-2026-4480) * ngtcp2: ngtcp2: Denial of service via stack buffer overflow during QUIC handshake (CVE-2026-40170) * samba: Remote Code Execution in SAMR (CVE-2026-4408) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libwbclient-devel-4.23.5-10.el9_8.x86_64.rpm 409f6f83ddfd3dd1cd94fe1612df2c80652b4b4dff5b77ff0321dca5c106f13a libsmbclient-devel-4.23.5-10.el9_8.x86_64.rpm 455f41ed5290806256ff86970c50944912df2a4d184b0cced0c592f76b6becd3 samba-test-4.23.5-10.el9_8.x86_64.rpm 5ff083a368f62e2c74f9f6e89b7449f6167ac4e8299bdc8c28332b9d8b571a04 libwbclient-devel-4.23.5-10.el9_8.i686.rpm 7dad237b37196275170879417827e70e8fcd856c272d75b1969bcc2adc5625a9 samba-pidl-4.23.5-10.el9_8.noarch.rpm 82b6ede34ba8fb9ae0ea99f63c89050c550ba4960dcf6c895a11e28b43981c3a libnetapi-devel-4.23.5-10.el9_8.x86_64.rpm 8e47a711639174be415376930e0821757fc2abb3fa567499c0951071407078b3 samba-test-libs-4.23.5-10.el9_8.x86_64.rpm 94964d4a341a137d69d219d39e5f0d23206fef17776cd6bc3f6ad314bb9d7422 samba-devel-4.23.5-10.el9_8.i686.rpm af207fae60d48e397f70f96a5ef1f2f81ffe7df4b693d2e5e9c131fedfc950b6 python3-samba-test-4.23.5-10.el9_8.x86_64.rpm cf8437e173fa3ee964b7635365a61a6297b381d7ce5edfe91ce11bcf230681f2 samba-devel-4.23.5-10.el9_8.x86_64.rpm daacde61ff5043a5263dbdc0b9a4621d5731540d383c306d72828578a7e0f211 libldb-devel-4.23.5-10.el9_8.x86_64.rpm df2561130e18c52888f3b7b7bcc2fe298b837a6a4e75f06e9591ad62b4bc39fa libnetapi-devel-4.23.5-10.el9_8.i686.rpm e2911dfc732eb5bfabb3b9e1e3ca8a0253e40ec77113368608810f5e1f75269a libldb-devel-4.23.5-10.el9_8.i686.rpm f6b37191a315cda3c17667775d6154ac9c5cbd87bc970e9b7f85e5eb00ae8035 libsmbclient-devel-4.23.5-10.el9_8.i686.rpm fa5649e6bcef61eb28355a523d7be511bc82ea775ee39422dd1284af258600cd ALSA-2026:25051 Copyright 2026 AlmaLinux OS 0 1 Important

libyang security update

Libyang is YANG data modeling language parser and toolkit written (and providing API) in C. Security Fix(es): * libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libyang-devel-2.1.148-1.el9_8.1.i686.rpm 3b3f0f656835c40535bb141f8c49de18fa4dbc23b421398419029b87a58812de libyang-devel-2.1.148-1.el9_8.1.x86_64.rpm 4f2b2da07f92ed56c0fc5614388673adf48cc754af7710d3d7ec9a7b925ba0c1 libyang-devel-doc-2.1.148-1.el9_8.1.x86_64.rpm 6c1308dbf1708e47b8f8191bef99f57bb8f88615d413f817c9ddebd7ad8b4f41 ALSA-2026:25058 Copyright 2026 AlmaLinux OS 0 1 Important

poppler security update

Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default poppler-cpp-devel-21.01.0-24.el9_8.1.i686.rpm 1b954f5fd61b94af38ea3be39584217c59c2c49f5d241c006714f3bd4172b24f poppler-cpp-devel-21.01.0-24.el9_8.1.x86_64.rpm 1f72efc38e08dcde96bea7441c421fc0079ae2b697c67171992b04821a93ce31 poppler-devel-21.01.0-24.el9_8.1.x86_64.rpm 292c1aa3385afedb45cc994e612ab5a9a28cfdda8a17439b63f8e73493d48ff8 poppler-glib-devel-21.01.0-24.el9_8.1.i686.rpm 3fd1c08a45b4c804596d3b53c3662e88d0e2af57de09f08807dbd40e3d2a6482 poppler-qt5-devel-21.01.0-24.el9_8.1.x86_64.rpm 48627ff94e408870151ec61d811a46def7f8e73ff5f051c69c4a26ccb529b7a1 poppler-glib-doc-21.01.0-24.el9_8.1.noarch.rpm 5d072daa7f6d715a1e707ca4de274071d907d17358f4152524745c4d42ea6ba2 poppler-glib-devel-21.01.0-24.el9_8.1.x86_64.rpm aa5d0fabe1f7f7587558709f3b97c2096b223093e59031786e0c856cb8d3e4f0 poppler-devel-21.01.0-24.el9_8.1.i686.rpm b35c575f49fce7c97bd505d61a19c7a1aaf1f4d122fe21abfdef11b4b9b66737 poppler-qt5-devel-21.01.0-24.el9_8.1.i686.rpm c93972599d93286b7247fa00b933417556e0cd9154a0a88f088712e29aa90b93 ALSA-2026:25217 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CVE-2026-23216) * kernel: Linux kernel: Use-after-free in bonding driver leads to denial of service (CVE-2026-31419) * kernel: net: openvswitch: Avoid releasing netdev before teardown completes (CVE-2026-31508) * kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581) * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056) * kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.15.1.el9_8.x86_64.rpm 152546b91293a1980b6d99bddcc69e3075046707218b2f7ad9e9d6e33d95a47a kernel-tools-libs-devel-5.14.0-687.15.1.el9_8.x86_64.rpm 8a0cfdd631aea762ea1d817bac52d8589ffcf0c31290384d760ac1f00f8e7ab2 libperf-5.14.0-687.15.1.el9_8.x86_64.rpm cb306e6b53c942eae198dd477cb46f9486fc4fef34bf16c4bc9d11a504e1e7be ALSA-2026:25220 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.el9_8.x86_64.rpm c21a01cc2cb6d4689c98e627c5262e90d7318c5fca6dd2afa98be81e3d3fb477 ALSA-2026:25221 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.118-1.el9_8.x86_64.rpm edba7d694cbd1e49674c1bec9282f69e4c747c9718e4d23b4081f74cccebce9c ALSA-2026:25222 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es): * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491) * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.109-1.el9_8.x86_64.rpm eca40a932608391405a16fed68a0f97a5f75cdf48ce72c16b02dcef779e88a6e ALSA-2026:26455 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064) Bug Fix(es) and Enhancement(s): * Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [almalinux-9.8.z] (JIRA:AlmaLinux-152356) * Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [almalinux-9.8.z] (JIRA:AlmaLinux-168967) * DS 12 does not handle escape char in bind user [almalinux-9.8.z] (JIRA:AlmaLinux-170269) * [RFE] Add OS-level thread names to all server threads [almalinux-9.8.z] (JIRA:AlmaLinux-174524) * Online export is failing when using the option "-s" [almalinux-9.8.z] (JIRA:AlmaLinux-180716) * Server shutdown during online reindex may lead to data loss [almalinux-9.8.z] (JIRA:AlmaLinux-183895) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-7.el9_8.x86_64.rpm bc5ed01ae10e12cc2231810d43ec23e7a3ea00bc8ee6791cc8522edf9f060b82 ALSA-2026:26590 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security, bug fix, and enhancement update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xwayland] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184292) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.2.i686.rpm 2219ba0a722cb593e68929bd672ca72f8dc3cb07f6c7802d136e561bbb54f5f6 xorg-x11-server-Xwayland-24.1.9-4.el9_8.2.i686.rpm 4a54f78a9c1efdb44f1fb4832f46bbe13de8f277fdfa66739ef210e6a9f3023d xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.2.x86_64.rpm 920e507158ac9ddb5a67b4eb9a800328c0b1b17052d30aff02e9f14e187c0fdc ALSA-2026:26610 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security, bug fix, and enhancement update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263) * xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264) Bug Fix(es) and Enhancement(s): * [xserver] Backport other security fixes without a CVE assigned [almalinux-9.8.z] (JIRA:AlmaLinux-184288) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.2.i686.rpm bece6ba4322539969094bb61e584ef5e6a6c95cffeaaff2f056f0f4540e7f9f9 xorg-x11-server-devel-1.20.11-34.el9_8.2.x86_64.rpm f4b1e70a91e07e6165dc3868a0e8f838fa73b83937a6df503a6dfaf22a252486 xorg-x11-server-source-1.20.11-34.el9_8.2.noarch.rpm fe8d7b998faa3cd785e1f21616963da47934a541405c9daba0277692995ea4cd ALSA-2026:2722 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CVE-2023-53034) * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Out-of-bounds write in fbdev can lead to privilege escalation, information disclosure, or denial of service. (CVE-2025-40304) * kernel: Linux kernel: Information disclosure and denial of service via out-of-bounds read in font glyph handling (CVE-2025-40322) * kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CVE-2025-68349) * kernel: svcrdma: use rc_pageoff for memcpy byte offset (CVE-2025-68811) * kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CVE-2026-22998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.34.1.el9_7.x86_64.rpm 56a9fe85384bd2cebb0c7de09983e41d78b929cf853d51b1b6f958a5b50c6f4d kernel-tools-libs-devel-5.14.0-611.34.1.el9_7.x86_64.rpm e8423461bb419cf5f85b42eed4de23c78b11b3507d66a9ade0fef478804640ca libperf-5.14.0-611.34.1.el9_7.x86_64.rpm f0e9d86b515e218524c0304d467f02db19b59dfd0b35bd8862b7f7c33bc21a9e ALSA-2026:27741 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default postgresql-private-devel-13.23-3.el9_8.x86_64.rpm 0ed443f99baa1cb50e17940c27b357c827a3b29e5a9f7da8dee4b84cc28eb76e postgresql-docs-13.23-3.el9_8.x86_64.rpm 11b618212f8c3675d292db45e7150b46ca0634dcb169e351ace4fff0244a2817 postgresql-server-devel-13.23-3.el9_8.x86_64.rpm 5abe279690f32c55594872215b66db7a992e60097fc867b5c436e776a66fab3b postgresql-test-13.23-3.el9_8.x86_64.rpm 772e5754a45c94f36f5523a0e58ce6ef9da76eb616cbfd4c4a05057d9bab1dfb postgresql-upgrade-devel-13.23-3.el9_8.x86_64.rpm 9e09f8d1a3dbd15f6e9007e9fe40bcf37c90945cb74bd9e3604ee015f09d4f9e postgresql-static-13.23-3.el9_8.x86_64.rpm c895759ffb222991bfa266efd092a9a1d5fba99969ce8cfdbcb75e8f68c30844 postgresql-test-rpm-macros-13.23-3.el9_8.noarch.rpm f6060fb4be90b694977de0b268823c300ea7bb804cc5da4363f78ccda9909d03 ALSA-2026:2776 Copyright 2026 AlmaLinux OS 0 1 Moderate

edk2 security update

EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default edk2-tools-doc-20241117-4.el9_7.3.noarch.rpm 4b87347bffd1678e7310392c107ce78ebc719dac11d389efe0562315bfe5e98b edk2-tools-20241117-4.el9_7.3.x86_64.rpm 7d7b1c57630f1dde14f3cee7084f06ce6af508ed91839ee9f6197f2a6e4d3eca edk2-ovmf-20241117-4.el9_7.3.noarch.rpm b5e7af0c61e51f6617ef9d9b9ae4fc554d01d0de332dade45c8bb7304457a20d edk2-aarch64-20241117-4.el9_7.3.noarch.rpm c529f43a57b1378db756550bd605d19c555f6d0c4d1b8d34861e2a5c1bfb655e ALSA-2026:27789 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772) * kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) * kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984) * kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056) * kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152) * kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CVE-2026-46117) * kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145) * kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166) * kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135) Bug Fix(es) and Enhancement(s): * AlmaLinux9.4 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-9.8.z] (JIRA:AlmaLinux-166048) * [AlmaLinux 9.8] Hung tasks during both suspend and hibernate operations on systems with Intel E810 NICs [almalinux-9.8.z] (JIRA:AlmaLinux-175699) * DPLL: Add support for pin operational state [almalinux-9.8.z] (JIRA:AlmaLinux-175820) * DPLL: Add support for fractional frequency offset between pin and device [almalinux-9.8.z] (JIRA:AlmaLinux-175823) * ibmveth Adapter Freeze with Small MSS [almalinux-9.8.z] (JIRA:AlmaLinux-178308) * AlmaLinux9.4 - s390/mm: Add missing secure storage access fixups [almalinux-9.8.z] (JIRA:AlmaLinux-183317) * rbd: eliminate a race in lock_dwork draining on unmap [almalinux-9.8.z] (JIRA:AlmaLinux-183130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.17.1.el9_8.x86_64.rpm 04db1d1879f21496299a152de8d89e1ab6489532da0a3e5ecb1b6cb927594c74 libperf-5.14.0-687.17.1.el9_8.x86_64.rpm 0d87e436f31950477072f65b0d5639ad846f98cec3ac89226c46cfe0d188a5d9 kernel-tools-libs-devel-5.14.0-687.17.1.el9_8.x86_64.rpm 646994d7a311186cd28052b6ed6ad4b7b589ce0b7ee60768799132a232cf6636 ALSA-2026:2786 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Integer overflow in memalign leads to heap corruption (CVE-2026-0861) * glibc: glibc: Information disclosure via zero-valued network query (CVE-2026-0915) * glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory (CVE-2025-15281) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default glibc-static-2.34-231.el9_7.10.x86_64.rpm 105a974c9546ce87ae259816eae9edcb8a933d1a471792e93b30324f10dfe084 glibc-benchtests-2.34-231.el9_7.10.x86_64.rpm 10cd42cd7ff7342ebf1b1cfe8a169f6c6a793c6f2c0228f167e2bed37f8f1703 glibc-nss-devel-2.34-231.el9_7.10.i686.rpm 17d2196481cac96c8cb22a564583f211c844e4c6c312e26380d2c788b757cdc5 nss_db-2.34-231.el9_7.10.x86_64.rpm 1dbe3c835a9a5eae747c560c5a6e45e04900a380c9629d413b3f374f73090810 nss_hesiod-2.34-231.el9_7.10.i686.rpm 4a77d71158316539929acbdf55397a5c9aa7e0f9b11f5f8c367de2e761bf94f7 glibc-nss-devel-2.34-231.el9_7.10.x86_64.rpm 5c81eceada6dd762fa3833e1103c8f18d25d9a3350d016d4b1c3ebbdcce5e211 nss_db-2.34-231.el9_7.10.i686.rpm b5de0eb60ef0347e2af69a5588bd0af8ea496f3b21edf25d1880355114ce81fa glibc-static-2.34-231.el9_7.10.i686.rpm c28f1b5c228d2c968691f47ceb6aaad244a910bd7202fc2b287b5bb34d970b4f nss_hesiod-2.34-231.el9_7.10.x86_64.rpm d7517b685e6ef3a75e1ddcd437bb6413d5e83fce3d80de04da841a693a8ef0ba ALSA-2026:28247 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019) Bug Fix(es) and Enhancement(s): * [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.14-freethreading-devel-3.14.5-1.el9_8.x86_64.rpm 1307d2bcef5ab6d3abd8170c6839aaab39bce1ef07aa45da925f037faf7da7a3 python3.14-freethreading-debug-3.14.5-1.el9_8.i686.rpm 1410c331abb057c282b0f6bc609672cc2a8e8e375b1b3e4592060151a946bc09 python3.14-idle-3.14.5-1.el9_8.i686.rpm 1aa215619804441fbec70cf37a77613a22b8438206aeff035c234d52bbf1d4ca python3.14-freethreading-test-3.14.5-1.el9_8.i686.rpm 1dd028f0c8795de6f0f376f14fa9d80f96beeee17e5efae59cf1232b26b99fa1 python3.14-debug-3.14.5-1.el9_8.i686.rpm 1dd3a9e913beca78ecf222efa4d8425f550bcffdbdda63143a68e13772c3e2d2 python3.14-freethreading-3.14.5-1.el9_8.x86_64.rpm 27c7665f3b186d4b757b11beb320993c93e1cf2cd2dbe789639ac8b5bca2a993 python3.14-freethreading-libs-3.14.5-1.el9_8.x86_64.rpm 33746b451e40a1c389b22a54c86c46886f08015ba439bce2b6cfd03bd4e3ac09 python3.14-freethreading-devel-3.14.5-1.el9_8.i686.rpm 3aecbef277104f2eec1964b1accebd6d910531dc3bdaf7fd5808225650b8ea80 python3.14-freethreading-debug-3.14.5-1.el9_8.x86_64.rpm 58c73b954a0adf359a38ea643b06fbee8fda3d99c49c6deee695ea7c12e9256a python3.14-freethreading-libs-3.14.5-1.el9_8.i686.rpm 5959586788f6761a5b118a67a918f3695a4e103c31cda18b3e8679a46fba6f12 python3.14-debug-3.14.5-1.el9_8.x86_64.rpm 7cd0e6ac4985fe4d5a61295975acdcd1902c58e99d2538cefd9e9e0c4ccee40a python3.14-freethreading-idle-3.14.5-1.el9_8.i686.rpm 7e0796218048496123fb1f87704b1d29c6176cd996e9d88b4ae18225c1db64c5 python3.14-test-3.14.5-1.el9_8.x86_64.rpm 8294180080793a55689e793cbd65ed7775b7f87a8292960229f99e2471998686 python3.14-freethreading-idle-3.14.5-1.el9_8.x86_64.rpm 93523f2bc96690504938c528071ac89a74b471cab690759282b335e0cc4d9b71 python3.14-freethreading-tkinter-3.14.5-1.el9_8.x86_64.rpm aa71feafb9c3fa26974c358b5ddfc3ce69a64634fe1da43204ffa20c9dc630fa python3.14-tkinter-3.14.5-1.el9_8.i686.rpm b59a329acb1599d8d4fe23237032ed3c290dad581a8644feae593a246cab9f22 python3.14-freethreading-3.14.5-1.el9_8.i686.rpm bf8e49ad3b0cf82693dc756296dd9093566ebd939959a3b461c1475826759198 python3.14-idle-3.14.5-1.el9_8.x86_64.rpm c66399321697e631752d30b87a07739f24767658eae271e530d47201e1b8f0fe python3.14-freethreading-test-3.14.5-1.el9_8.x86_64.rpm d7ca3bc52e2f5e90d3255bca93638cb5acf9ab9d2596562749001e751e39d4e7 python3.14-test-3.14.5-1.el9_8.i686.rpm dd70f2722eb84f4be0989e4ba7bbe55237bec8c11c924b57d396eb665518ed59 python3.14-3.14.5-1.el9_8.i686.rpm df12e61cca0e65d00161b8a93acb3a1f31148dbef0bb14e114eb19ab883b2014 python3.14-freethreading-tkinter-3.14.5-1.el9_8.i686.rpm f81ffa2dee33275720a7629560eb1557b0cff29890935ed4233ed35c9a0bbd11 ALSA-2026:28256 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Information disclosure and Denial of Service via malformed BER-encoded cryptographic objects (CVE-2026-40253) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default opencryptoki-devel-3.26.0-2.el9_8.2.x86_64.rpm 451827c99a289a5da5beed8c99e9e5f828a1f7e779ee1a7c1d4c31741e8652a3 opencryptoki-devel-3.26.0-2.el9_8.2.i686.rpm af06e3f4d89392cd03be01e448dddf3d4c947b21f5fa26bec71df87319e33dae ALSA-2026:28290 Copyright 2026 AlmaLinux OS 0 1 Moderate

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * LibreOffice: LibreOffice: Denial of Service via crafted OOXML documents (CVE-2026-4430) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libreoffice-sdk-doc-7.1.8.1-15.el9_8.1.alma.1.x86_64.rpm c13d20d71e52095479138b7e02301f03c3393698d7b63f221743d08c2a2c8801 libreoffice-sdk-7.1.8.1-15.el9_8.1.alma.1.x86_64.rpm c87ccb2b0bc6e965dcdb7f536c6ad688419d8c1d2a944a19a6d5ef6127eb33bf ALSA-2026:28973 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.3.alma.1.x86_64.rpm 0a29213b9a5bcd304ba945ced48c67c26f71249888dd697cdf04ccadbc619116 ALSA-2026:3034 Copyright 2026 AlmaLinux OS 0 1 Important

munge security update

MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods. Security Fix(es): * MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default munge-devel-0.5.13-14.el9_7.x86_64.rpm a769589d6559cbdbe9a8c7a882b04648d255f1c7fc09f7d46f155932cc519d74 munge-devel-0.5.13-14.el9_7.i686.rpm be16465b5c6dce10c80644157e50f21f9b376aa4c50230a030b9a309f2a73ab0 ALSA-2026:3066 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: page_pool: Fix use-after-free in page_pool_recycle_in_ring (CVE-2025-38129) * kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service (CVE-2025-38206) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.35.1.el9_7.x86_64.rpm 2ff4f2adb8c8cf090f479f16e2f44ad9317e6775a86a8004976dfd3f95219f4e libperf-5.14.0-611.35.1.el9_7.x86_64.rpm 74b0e4f84cb20c621671c1187a2cc3a0c14d02cbe98625fd3aa23e54ea87706b kernel-cross-headers-5.14.0-611.35.1.el9_7.x86_64.rpm 7e8de370fe94048cc85c302eec22f441a737e5e39264783c5610ddf3d2bf40a9 ALSA-2026:3067 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855) * freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default freerdp-devel-2.11.7-1.el9_7.2.i686.rpm 128d5c9ca2608d4f8e36daea7bf34c3f2533decf55cf9f5b5e1dfce2aa09ce83 libwinpr-devel-2.11.7-1.el9_7.2.x86_64.rpm 68f1b114528042a82967f4604237424f1728d8cf642d101ad27345c971b7719a freerdp-devel-2.11.7-1.el9_7.2.x86_64.rpm 9fea2e7a93410d0a4614e3ad57e5033502621efa022f9f942aaa8d98cf5fcc36 libwinpr-devel-2.11.7-1.el9_7.2.i686.rpm ea1e1d1a012d15166127bff9c2dbb30d40ea7f96a36607041e3bfbcd601f47f1 ALSA-2026:30848 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:AlmaLinux-169057) * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [almalinux-9.8.z] (JIRA:AlmaLinux-172993) * nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [almalinux-9.8.z] (JIRA:AlmaLinux-178273) * sched/fair: Skip sched_balance_running cmpxchg when balance is not due [almalinux-9.8.z] (JIRA:AlmaLinux-182776) * [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [almalinux-9.8.z] (JIRA:AlmaLinux-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.19.1.el9_8.x86_64.rpm e58fa43e8cdb7ab2f13c744bd5ccc08f423949ce484ddd9ed8b692ee238f1678 kernel-tools-libs-devel-5.14.0-687.19.1.el9_8.x86_64.rpm f829728c181617e9ba67bbaefe901cac62a41f773d545fbdbf7dd63ff358b707 libperf-5.14.0-687.19.1.el9_8.x86_64.rpm fde251fbed2341467e7e419e632622db726970a384d662e06c8e987c7e848e79 ALSA-2026:3095 Copyright 2026 AlmaLinux OS 0 1 Important

protobuf security update

The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default protobuf-devel-3.14.0-17.el9_7.i686.rpm 0d413deedaa54a9730c03b73bb1e181a69905dca578eb476e8d4fa9d2d6579a2 protobuf-lite-devel-3.14.0-17.el9_7.i686.rpm 12322aaa008130b242f229884336ec481b04c47dd44150e74e301d15e161d273 protobuf-compiler-3.14.0-17.el9_7.x86_64.rpm 1b3f441a1ae93f1cc9f6ef9ab829773b79c439ccee4a7b18ee46d274094878c2 protobuf-lite-devel-3.14.0-17.el9_7.x86_64.rpm 9e09e22b93641b9bac612ae80f29c3cb2dece5bb122c80ddf4d4c9fc3d11b9f9 protobuf-devel-3.14.0-17.el9_7.x86_64.rpm 9f5ac0cf902efb58f1dfeab2c4980400134890d51d6b6ca2f665a83dbafcd0b8 protobuf-compiler-3.14.0-17.el9_7.i686.rpm df0028fd9594e9f108ce7888dd8345cd5985227dd87c9005ba7ddb596f3d5461 ALSA-2026:3189 Copyright 2026 AlmaLinux OS 0 1 Moderate

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default 389-ds-base-devel-2.7.0-10.el9_7.x86_64.rpm 28d82f4b02a4b09ac1b8cb2e3cfafe25f747aec2192e03efcbd87b2f2bfe7df0 ALSA-2026:33226 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * glibc: counter overflow in __wcsmbs_clone_conv if setlocale is called (JIRA:AlmaLinux-145156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nss_db-2.34-272.el9_8.i686.rpm 6e30f7178b4bb1c134f98bb5c556bf8622772d2c1c40779e50d0658d45b566e8 glibc-nss-devel-2.34-272.el9_8.i686.rpm 76f45103a0625a420285b8cf3028f1d350f99124a8c1a5ec160a47567efddf98 glibc-static-2.34-272.el9_8.x86_64.rpm 963ca9afd5fe30ad97288d767692f05b84c1e93f7f1071606e97d39da1303105 glibc-nss-devel-2.34-272.el9_8.x86_64.rpm 9a738182c6ade334802725070179f6ae88c2c97f59505873238ad122f2274e69 glibc-static-2.34-272.el9_8.i686.rpm a155ce339d4369902a3c9e8aa216ad66e1015840a98d57bf89397527a7aee0a0 nss_db-2.34-272.el9_8.x86_64.rpm c6e051540b06287ebd3f89ac6ff2436485a5f32b88b66ed415dd227cfdc86344 nss_hesiod-2.34-272.el9_8.x86_64.rpm cd98da7ac498e63993667a5d0c40422f37c3c445907f3f3777f5d15ddec80cc4 glibc-benchtests-2.34-272.el9_8.x86_64.rpm f08bd74e96ed060573ac95626b438cf32213e1621cdece18bf2bceb72cf5d733 nss_hesiod-2.34-272.el9_8.i686.rpm fd3d2bc0224be0993aaf940972dfc5b17bc011c9a3bb06065694999e314ec2a7 ALSA-2026:33285 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9.8 Bug] qla2xxx flash image validation failure [almalinux-9.8.z] (JIRA:AlmaLinux-181886) * crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [almalinux-9.8.z] (JIRA:AlmaLinux-182540) * tegra-se fixes and updates [almalinux-9.8.z] (JIRA:AlmaLinux-182760) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.20.1.el9_8.x86_64.rpm 35f561e7c66b15ca78b815dc5b36839e0bb658671d662b1417ca99b4bb86a249 libperf-5.14.0-687.20.1.el9_8.x86_64.rpm a5c797b7599fed4bf8b689e02bee07d9b2aa5fbeac57e78213bc90711dc99b24 kernel-tools-libs-devel-5.14.0-687.20.1.el9_8.x86_64.rpm bfa7254e1331c8fa4078b469bbbc859698161e8940695a1b5e6ed645c1a7da14 ALSA-2026:33501 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default giflib-devel-5.2.1-10.el9_8.2.x86_64.rpm 1580fb693d10c53813a7c2845cdfea781cfeb1b981df280eb9b2194edd675203 giflib-devel-5.2.1-10.el9_8.2.i686.rpm 751cb2cc68d84d77089b768b8fbeeb1494ee25e6bb0a321b913bc26b2c257e6f ALSA-2026:33512 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258) * net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default ruby-doc-3.0.7-167.el9_8.noarch.rpm b8f118e66d4cfca0e379d47fc279003251a1a7a6c5748e8cd32d51a663c369af ALSA-2026:34156 Copyright 2026 AlmaLinux OS 0 1 Moderate

rrdtool security update

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density. Security Fix(es): * rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default rrdtool-doc-1.7.2-22.el9_8.x86_64.rpm 1f61370ca8b0c069edc0a18b52400e4e1baaf88e6eb94a336fe74dacd94b741c rrdtool-devel-1.7.2-22.el9_8.x86_64.rpm 3df6edf7c247bd469dd9f7ec5bf56ab6c5be5695a08613613b372fe02e9dc81b rrdtool-ruby-1.7.2-22.el9_8.x86_64.rpm 4f42a6682fc9d204ef7246d3831ecc4bd06e4d9572e737d4f565544a6f6435ea rrdtool-lua-1.7.2-22.el9_8.x86_64.rpm 623313721aa04d8e5a92de25da51cbe21305992d1e67c456d4d62f3d0a125cf0 rrdtool-devel-1.7.2-22.el9_8.i686.rpm 91e725c938c936c0f558e0d4165f6b763c01d14b89ebc1832b19adc4c6f6a929 python3-rrdtool-1.7.2-22.el9_8.x86_64.rpm d6284a6aa1412f29e2b7d4211f71d3a92266510c81a7181c03158943902f7d0c rrdtool-tcl-1.7.2-22.el9_8.x86_64.rpm e3a04ebf1df10d9c77002506fe653c50c873ea0c5818720636f6d8d6b3e86747 ALSA-2026:3488 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match() (CVE-2025-40168) * kernel: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CVE-2025-71085) * kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration (CVE-2026-23097) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.36.1.el9_7.x86_64.rpm 233c7cd1ee3e79f644e075684be8f640d707c1ba61ee025e3357952871fc2fcc kernel-cross-headers-5.14.0-611.36.1.el9_7.x86_64.rpm 5bc132ff9e6dd036ea47138a2dc4b4aa7425a9833010340f0e5f291a5e03ffe2 kernel-tools-libs-devel-5.14.0-611.36.1.el9_7.x86_64.rpm f64ed2d574c375f6bea0bae0d392c15393f1d2bbc2bb72bebcb2ef8f3b48c6d6 ALSA-2026:36018 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CVE-2026-46116) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CVE-2026-46209) * kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259) * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316) Bug Fix(es) and Enhancement(s): * WARNING at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1585 r535_gsp_fini+0x2fb/0x310 [nouveau] [almalinux-9.8.z] (JIRA:AlmaLinux-160966) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.22.1.el9_8.x86_64.rpm 9e3dc3a77c21a39bd2b0e96ab04a3f2b5386ab6bc00e66e74dbc3edec6719ddd kernel-tools-libs-devel-5.14.0-687.22.1.el9_8.x86_64.rpm ed3c61a2716ba85f33fbe0292591344e8b4e79bcef70549c646d33c1252a61dd libperf-5.14.0-687.22.1.el9_8.x86_64.rpm f1782da869ab950d4730a71b6388888270da959335d529d02a97820ed8742fa3 ALSA-2026:36187 Copyright 2026 AlmaLinux OS 0 1 Important

perl-HTTP-Daemon security update

The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests. Security Fix(es): * perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default perl-HTTP-Daemon-6.12-6.el9_8.1.noarch.rpm 7ccd0b8da3d5b0145c065678e99330c75c2530fc2eb51d3841c2d6293f6eb0e9 ALSA-2026:36195 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) * 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-8.el9_8.x86_64.rpm 1f0acbab85d1215734885a1c176f765386643c59bde615e286176136ff44bb7f ALSA-2026:36210 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freeipmi-devel-1.6.18-1.el9_8.i686.rpm 204d87a7a03f7b96151d147edfa7b8ce167c4f835dd8989f668ee64d9798c00a freeipmi-devel-1.6.18-1.el9_8.x86_64.rpm a8618566281401262436a45298113fe809cfd8ca8f1af7a7d6290c29211aa580 ALSA-2026:36331 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security, bug fix, and enhancement update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) Bug Fix(es) and Enhancement(s): * nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [almalinux-9.8.z] (JIRA:AlmaLinux-190800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.4.alma.1.x86_64.rpm 62701209ea77e475847f9aeb58f7fc8c66d6641bccbea55263b163db11c49929 ALSA-2026:36645 Copyright 2026 AlmaLinux OS 0 1 Important

kernel update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074) * kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242) * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266) Bug Fix(es) and Enhancement(s): * kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite [almalinux-9.8.z] (JIRA:AlmaLinux-182344) * [AlmaLinux 9] Bonding reports unknown speed/duplex for tg3 interface [almalinux-9.8.z] (JIRA:AlmaLinux-182768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.23.1.el9_8.x86_64.rpm 08ccb9e46db82779052bd39343a9d45e4705a0ae54a5fc7a56cf78c6efb343ca kernel-tools-libs-devel-5.14.0-687.23.1.el9_8.x86_64.rpm 511f0e55aac6bf2a3e33f53ce76d756a1f9fd25f42b9ee3e1f9ca1851ede4e6a libperf-5.14.0-687.23.1.el9_8.x86_64.rpm ebc72006254bb23584368e7ab57d549a9b4dac29cc1d7512be35b33e502a1738 ALSA-2026:36777 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Denial of Service via excessive EDNS options (CVE-2026-41292) * unbound: Unbound: Cache manipulation via 'ghost domain names' attack (CVE-2026-40622) * unbound: Unbound: Denial of Service due to excessive resource consumption with large DNS Resource Record Sets (CVE-2026-44390) * unbound: Unbound: Denial of Service due to degraded resolution performance in jostle logic (CVE-2026-42534) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.2.i686.rpm 826d123e67ec0087d4446890e000e192295850a111eacadd1901be1ed47bccee unbound-devel-1.24.2-3.el9_8.2.x86_64.rpm d19c6041f368608d4cc0d581d8a77a35b157c024c83c194efea4ca39a70656db ALSA-2026:36832 Copyright 2026 AlmaLinux OS 0 1 Important

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation (CVE-2026-8357) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libreoffice-sdk-7.1.8.1-15.el9_8.2.alma.1.x86_64.rpm 07729e7987346f773dda0c038833141734ccb0201bb0086646f2ef58810fa245 libreoffice-sdk-doc-7.1.8.1-15.el9_8.2.alma.1.x86_64.rpm 18c898d42b44667f0ff29ba792bc879330d48d276171496d4fcb3b3f6a1350c7 ALSA-2026:36834 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718) * gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719) * gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720) * gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.x86_64.rpm 5e7a519ab317605c3022e70bc474ac53823ea16ab0035202034d0cdb550b01fe gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.1.i686.rpm d9a9f2ae43b9e9e953576f3a094af4a5e1503e480562be982718c0edcf32fe1c ALSA-2026:36957 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113) * kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.24.1.el9_8.x86_64.rpm 3b6cd49195cbc1151343af2c17ee90f0a3678577e70f8e7a967cdecd72665a9f libperf-5.14.0-687.24.1.el9_8.x86_64.rpm 6335dbf4386a90bb7b4194faf893cf6faff75bf82b5057fd50a124ccee573cfe kernel-cross-headers-5.14.0-687.24.1.el9_8.x86_64.rpm f3fb8578f8a81c0d08764be25918e8da1285a9685cf3eddc3a74fd302de22419 ALSA-2026:37207 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.4.x86_64.rpm 12bfd784edcfae20c7200567c385ac6de787677bbe1fa71c78b3a213d9fecd0f libwinpr-devel-2.11.7-7.el9_8.4.i686.rpm 2b1687219136c48aeed8f06ddfe9f7aa68080429771ccf03edc1f056c8635e6f freerdp-devel-2.11.7-7.el9_8.4.i686.rpm e29879b1882d2cebaac302190c89e618a5ec2e748625c4114e4a9c74ffb90c64 libwinpr-devel-2.11.7-7.el9_8.4.x86_64.rpm ea88e775662823a819370dfe38e1dfb5cad3b66d02660af952d2534b0ef542f3 ALSA-2026:3730 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006) * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004) * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default postgresql-upgrade-devel-13.23-2.el9_7.x86_64.rpm 3dcab952d440d3c7ae426a2ad250e698825786d44e001210c47b4ed92858b99d postgresql-server-devel-13.23-2.el9_7.x86_64.rpm 4eef636c09655980d17bfa5a2d7d30c64d20ff32cfdf1ab608f91f81644bddd7 postgresql-test-rpm-macros-13.23-2.el9_7.noarch.rpm 9bc6f1d37d6520e5f2e03b04c3ae18345783ee6bd8725a4785f7fcfd8df0d299 postgresql-test-13.23-2.el9_7.x86_64.rpm b585adfa39b26ebeef1ac803b088dc20f4aa6c41a382d4b616a0925c34358000 postgresql-static-13.23-2.el9_7.x86_64.rpm dad2765b1b1a52ad715a4def6938090810d7d77633c93753da237c5f1a24330e postgresql-docs-13.23-2.el9_7.x86_64.rpm eb47f3c5ecf05c1b313b46aff0316a0a2be7102331201564042c4b782da4e624 postgresql-private-devel-13.23-2.el9_7.x86_64.rpm fa3000a07cf491fcd6e0b52da6fc24276759008e1fea8d3bbd67441188e772ce ALSA-2026:38486 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-source-1.20.11-34.el9_8.3.noarch.rpm 48499a138a6f93c1ab1264a01a39bb13c0536e0479c9928d112ae873477ec932 xorg-x11-server-devel-1.20.11-34.el9_8.3.x86_64.rpm 59173bc9c8210d8b9051e075f99cda8aa73032e6f9dfce1d4aec834086c7d743 xorg-x11-server-devel-1.20.11-34.el9_8.3.i686.rpm ad3194069c6e7a1823d1d69715314eb9e01aa069b510161e15699a53ff2311ea ALSA-2026:38490 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-Xwayland-24.1.9-4.el9_8.3.i686.rpm 4344e8c6814c54ce84cd038fe4ae496e7d3de3ebcf5bffc41dc83e1be80bc88f xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3.x86_64.rpm 72f02cba20f144f07cb093ca472983f2f19e4fd7fce82f40e49d2805de4a6ea3 xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.3.i686.rpm bd62b58c290385e0853484c4da3214fe20bdc0d2f49bf14334184a1a8ec69486 ALSA-2026:38491 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979) * kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499) * kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086) * kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016) * kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166) Bug Fix(es) and Enhancement(s): * Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.25.1.el9_8.x86_64.rpm 26a15e8bcf2cbe9ddc76d6d16c9e5f29138c5a22a4fb4dc7647fcea9c209e191 kernel-cross-headers-5.14.0-687.25.1.el9_8.x86_64.rpm 87f50168031a8b5630658e5d24c01ee4281967c42c82cbd270b0ef8a577decc8 kernel-tools-libs-devel-5.14.0-687.25.1.el9_8.x86_64.rpm dbf24892e32485240e8ff072fef1e6f04948e6de08057717da0d063452867ecf ALSA-2026:38497 Copyright 2026 AlmaLinux OS 0 1 Important

gegl04 security update

GEGL (Generic Graphics Library) is a graph-based image processing framework. Security Fix(es): * gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing (CVE-2026-2050) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gegl04-devel-0.4.62-1.el9_8.1.i686.rpm 098f64bdccb5b99f78a1166873fb9df84c87691ad99f740323f46077ab4e0e9a gegl04-devel-0.4.62-1.el9_8.1.x86_64.rpm 40a051245116931413eb7ee146b18f22892a499227e9b9cd68031ae944d8f7ba ALSA-2026:38498 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142) * OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.3.i686.rpm 6171b53c4d732ee105b3be36aeb24def8a5b6cb4c3e61c8afcefeccabfe5c818 openexr-devel-3.1.1-3.el9_8.3.x86_64.rpm 7800f7e199906663aad41f5f93c07878baa7dc69df4642d9944197b01955662c ALSA-2026:39309 Copyright 2026 AlmaLinux OS 0 1 Low

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-capstone-4.0.2-13.el9_8.x86_64.rpm 8330db07fa821ef7431d0763297c09580dd11056d3f485fc335b3c1bc64ba14f capstone-devel-4.0.2-13.el9_8.x86_64.rpm b878c8ea6961a095fcba198da90ef96963725e5e5d6bdba2d2ea64db6a795891 capstone-java-4.0.2-13.el9_8.noarch.rpm dc79dd0cf954c31a91b07d6c72a509f4dd1e0d453e13741b7bc54e876124392e ALSA-2026:39315 Copyright 2026 AlmaLinux OS 0 1 Moderate

libsolv security update

The libsolv packages provide a library for resolving package dependencies using a satisfiability algorithm. Security Fix(es): * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libsolv-devel-0.7.24-6.el9_8.x86_64.rpm 08e84a3d31ff5539a45adf37847ae096577471476a0dc7acef2d920d2e7d2a98 libsolv-devel-0.7.24-6.el9_8.i686.rpm 8228e46ca0c3979623b40753921e1ed8cfaa2e4fe5ce80256c087d1723e0acc5 libsolv-tools-0.7.24-6.el9_8.x86_64.rpm e3e68f360331d0e63b16c5bdc9aba7822585bbbea5cc74afd53d3f39264dec31 ALSA-2026:3940 Copyright 2026 AlmaLinux OS 0 1 Moderate

nfs-utils security update

The nfs-utils packages provide a daemon for the kernel Network File System (NFS) server and related tools, which provides better performance than the traditional Linux NFS server used by most users. These packages also contain the mount.nfs, umount.nfs, and showmount programs. Security Fix(es): * nfs-utils: rpc.mountd in the nfs-utils privilege escalation (CVE-2025-12801) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libnfsidmap-devel-2.5.4-38.el9_7.3.x86_64.rpm 669638acbb03b0e9c044143df2da7d660fce157791fd455c0b08630ea33a4baa libnfsidmap-devel-2.5.4-38.el9_7.3.i686.rpm 852721db4fec885465f5a0dbaf837ed524cd0a5a6f92f1f8a9699e35fd2a6456 ALSA-2026:39576 Copyright 2026 AlmaLinux OS 0 1 Important

cifs-utils security, bug fix, and enhancement update

The SMB/CIFS protocol is a standard file sharing protocol widely deployed on Microsoft Windows machines. The cifs-utils packages contain tools for mounting shares on Linux using the SMB/CIFS protocol. The tools in this package work in conjunction with support in the kernel to allow one to mount a SMB/CIFS share onto a client and use it as if it were a standard Linux file system. Security Fix(es): * cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (CVE-2026-12505) Bug Fix(es) and Enhancement(s): * cifs-utils: regression with kerberos mount [almalinux-9.8.z] (JIRA:AlmaLinux-192982) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default cifs-utils-devel-7.6-2.el9_8.x86_64.rpm 812101dffb7d49a49f4735043501000fa5de46d6f09c4801a0a4a8cba8b6a27f cifs-utils-devel-7.6-2.el9_8.i686.rpm bcfaeb41780b14783d19b831cc0d652a49b8d96a7801e2cc18a11e312cc48e3b ALSA-2026:3966 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel io_uring: Local privilege escalation, information disclosure, or denial of service via use-after-free (CVE-2025-38106) * kernel: macvlan: fix possible UAF in macvlan_forward_source() (CVE-2026-23001) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.38.1.el9_7.x86_64.rpm 41471a932a34f7112aa0621828b52ec30dd03833dc227add3e83bbe12aab34ed libperf-5.14.0-611.38.1.el9_7.x86_64.rpm df4a327361504ebfd6a946acae03483615b4d1812a9e0e8d7bdd67ed5a253aa2 kernel-tools-libs-devel-5.14.0-611.38.1.el9_7.x86_64.rpm e9e9fe797e7323277e8ac98ca54bbd434495db7d37a269837427f2c57826b166 ALSA-2026:39771 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.12-tkinter-3.12.13-3.el9_8.1.i686.rpm 10fb518c6ffa7b24b0847f091a17f30be38af6fcc5d5191ec83b917e900ae9f6 python3.12-idle-3.12.13-3.el9_8.1.i686.rpm 4c470b3c19afaa086bcedfe80805c6291dd738c050125c88981a2b52c16039b8 python3.12-idle-3.12.13-3.el9_8.1.x86_64.rpm 6a7fc63170a2f97f60e9b5f0ee5089578f869030067d1d931db4e60db15b6bb7 python3.12-3.12.13-3.el9_8.1.i686.rpm 7a3ba1b5841836a7bcd489654969ba8d56e84f4068b0b313021b0d00ae4ad443 python3.12-test-3.12.13-3.el9_8.1.i686.rpm 7ae1873498ab9ed0d26ec6d0f8b3165b957fabf2493809eba56d190ee2670d45 python3.12-test-3.12.13-3.el9_8.1.x86_64.rpm 7cf20e97de30f541badda5ba7bd4c730e8f8e82e38a5e67ce80ddaa80ebb9ee9 python3.12-debug-3.12.13-3.el9_8.1.x86_64.rpm c8381c0d97b73eb5b2bbb81cdcdf9735acb1d3afdebf5775116a69a16c8de5b1 python3.12-debug-3.12.13-3.el9_8.1.i686.rpm f9aa660118580eb61754304899ddcea213ee2702223cefa266461118138adc2d ALSA-2026:39798 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security, bug fix, and enhancement update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) Bug Fix(es) and Enhancement(s): * python3.9 test_ssl fails ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data (_ssl.c:4192) [almalinux-9.8.z] (JIRA:AlmaLinux-194207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-debug-3.9.25-7.el9_8.2.x86_64.rpm 035cd39891e4997fb0537f23b4158f48d0dac1971a0b254dbc63857df0d6bcdf python3-debug-3.9.25-7.el9_8.2.i686.rpm 0cf4ead83f16f3cab50d771e16827eb6549e1b43eacf4286d93af1d5c345c220 python3-idle-3.9.25-7.el9_8.2.x86_64.rpm 0e468303e63ce1addb53f0f02c8563e7f7c64bd46337b4c7a2f2a520afe2dd32 python3-test-3.9.25-7.el9_8.2.x86_64.rpm 28bbbefe2a9bdc8653fa2dd92151da34366a972864a24b1e619b75b9d437f714 python3-test-3.9.25-7.el9_8.2.i686.rpm 530b65805a5f15d65c991bbceb1dbfc037c5fc8c2cc1821c6f56d8627a45e5e8 python3-3.9.25-7.el9_8.2.i686.rpm 569a09e652c0b25f50af6bfa35868b663f124acd21edd3e5989e15b0a8e5dd46 python3-tkinter-3.9.25-7.el9_8.2.i686.rpm 95b8d70d3ef8e89f9d90e86a2f0898e543d61d915f8b468b4a27c6b2253392c9 python3-idle-3.9.25-7.el9_8.2.i686.rpm a1df2e95177abebe0d493ebfe21235164580dc9c10409f1db163ab78c7909990 ALSA-2026:4165 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-tkinter-3.12.12-4.el9_7.1.i686.rpm 01837c4545429afdbb4ddf00aaadb515bc5ca97f3b6038411c99028d0f9a3fc1 python3.12-test-3.12.12-4.el9_7.1.i686.rpm 6313773811a6191a3c7a6187e4535a8be73dfd04331941d39a4470b9eb2a814d python3.12-idle-3.12.12-4.el9_7.1.i686.rpm 9917685ce5966f8f764797778181ce1c71cf77398d7f5b024876e19c6fdd498b python3.12-debug-3.12.12-4.el9_7.1.x86_64.rpm b323de6b0996c9a46e949452e7a89585b922d3e3850a682a364ac020d7ac240b python3.12-3.12.12-4.el9_7.1.i686.rpm ba69e70879efcf80c0d3e898c707f63767074e27a6e8d64368990608a73d9e57 python3.12-idle-3.12.12-4.el9_7.1.x86_64.rpm c6c455084db25e6e1c8196820f8dfd040ae8ca48f259f09803e8ea2c0791152d python3.12-test-3.12.12-4.el9_7.1.x86_64.rpm d9048d840049dbbbdbbf858613d4ad69a788bad7476d60f6a7c44a70c63f9321 python3.12-debug-3.12.12-4.el9_7.1.i686.rpm f055abe3ec79283d871b5042fb6c8716d91ee3e49c481b05171ab002bf55b928 ALSA-2026:4168 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-debug-3.9.25-3.el9_7.1.i686.rpm 26c00854320d32386364b00e1d5c7f7d22151f65869709cc2b9c1a2ce4d03179 python3-idle-3.9.25-3.el9_7.1.i686.rpm 4ca1bc3fdb5e235857fa4d47de9cac680f074cd568c5989f0f82264828892162 python3-test-3.9.25-3.el9_7.1.i686.rpm 8a6a5e96af7ee6e1b9599357b34cef417599988adc377736c1758a58126a2e23 python3-test-3.9.25-3.el9_7.1.x86_64.rpm cb4400bec2d7d2c978650eab52233bec4ddb5c1a0642b6c8b4d50a3a2d7ff760 python3-3.9.25-3.el9_7.1.i686.rpm ccd49b9e9971aaf31c1877a51a7467ae8997786fff019266a18cc37f592e7e2b python3-debug-3.9.25-3.el9_7.1.x86_64.rpm cffda22f75880ddb1a0126540a0649b407318bb789faffc0d54c419e5b5df4d5 python3-tkinter-3.9.25-3.el9_7.1.i686.rpm ed7992e9b4886a4329677cbf5fb59836b8232684ea1992a6a508b6e2c6cbb423 python3-idle-3.9.25-3.el9_7.1.x86_64.rpm f68c7cb24cc0491f483a042474e60224bcbd9bf9e78031ffcb481733daec5491 ALSA-2026:41894 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [almalinux-9.8.z] (JIRA:AlmaLinux-192467) * dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8.x86_64.rpm e30ca52a5fd5a3bc93c8bfc564002632385a506a9fe9e30e717d467b2b9071c7 ALSA-2026:41896 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [almalinux-9.8.z] (JIRA:AlmaLinux-192472) * dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8.x86_64.rpm 55e8a460bb9f360c4c9b58396d9004daafc5580ba7023b5cdab3a4bddf8331ea ALSA-2026:41898 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10. Security Fix(es): * dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651) * dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108) * ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170) * ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300) * ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303) * dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304) * dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302) * dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650) * dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528) * dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649) * dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526) * dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646) * dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525) * dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527) * dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648) * .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659) * dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [almalinux-9.8.z] (JIRA:AlmaLinux-192462) * dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c9s) [almalinux-9.8.z] (JIRA:AlmaLinux-192336) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8.x86_64.rpm fcad26c029468961b8e1c85a0ab7857c183f170db151783552b4f2968b7b9c90 ALSA-2026:41905 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.1.x86_64.rpm 118f613025ffd2681ecec939b0c8b4e02661730c6d5f33fdf3234668c2ce7c4c dovecot-2.3.16-18.el9_8.1.i686.rpm c98bb9bc75283c66d378fe674e94c8e4a1487e7808c67f11ca425677c895334a dovecot-devel-2.3.16-18.el9_8.1.i686.rpm de03e0b66934163a55dd327d58ecb207444fbbd6b584cc5c876eac65570c741b ALSA-2026:41949 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.14-idle-3.14.5-1.el9_8.1.x86_64.rpm 17c00d4e8f0623800eabee30d1e780265b963203d736a82c6127eb53bcc441db python3.14-freethreading-3.14.5-1.el9_8.1.i686.rpm 1cbfd641ed0f27195720d5b912bb5c92aff0ca3132df998ce99963c7c5d8b711 python3.14-freethreading-idle-3.14.5-1.el9_8.1.x86_64.rpm 2aca19bd415b819004dbbc18989d1845e48b3b1437c3cdd5861fb861330a6701 python3.14-freethreading-test-3.14.5-1.el9_8.1.x86_64.rpm 2baf9910a1d85846b52bdad58387df0909a864b79931a831b84fd013c8dca6d1 python3.14-debug-3.14.5-1.el9_8.1.i686.rpm 35f8bad5471c79fe49daddf27530dc95a10529c133fb07fe7673ee276985b526 python3.14-freethreading-debug-3.14.5-1.el9_8.1.x86_64.rpm 582f7caef7c7d48b551d640304c98ad663e67f175d293b2671483c7a7c192e09 python3.14-freethreading-debug-3.14.5-1.el9_8.1.i686.rpm 64f263165e7f273decbc553f2a5b079fa2b934931cefba81e129744064768c67 python3.14-freethreading-test-3.14.5-1.el9_8.1.i686.rpm 8609280d528145af1cd8282c42440fbf23e0165c42c9c357c7d6354e331542a4 python3.14-freethreading-tkinter-3.14.5-1.el9_8.1.x86_64.rpm 9f89d05b0bfac7340f3e4d8263e7e71ba6634a660887824ea70d74449c9e539e python3.14-freethreading-devel-3.14.5-1.el9_8.1.x86_64.rpm a42f00a7c7159a401358ea82b006ed449e624297017ef1578c516e2e06bdc1b0 python3.14-freethreading-tkinter-3.14.5-1.el9_8.1.i686.rpm aad8dedd7e30d7e09c12790175e2b46ebe4b7c8823196d42621ff647dfe29f19 python3.14-3.14.5-1.el9_8.1.i686.rpm acc7e8d77667e82f20a92fcfb1c54b45989af746605d2d989cbf0c1e3bb1d3b4 python3.14-freethreading-idle-3.14.5-1.el9_8.1.i686.rpm b301639587c6e33c56f5bce1d7a23cca7664409bda5b9530c6fb4dba7ce176fc python3.14-freethreading-libs-3.14.5-1.el9_8.1.i686.rpm c1326cdd57def06291ef5d338ceb3aa570e46fd78f3d15d505ac2b8744322572 python3.14-test-3.14.5-1.el9_8.1.i686.rpm cf1f955d6af8a6d62e885b50f8601ee461638c4fbe72690f339cae428384f8ff python3.14-idle-3.14.5-1.el9_8.1.i686.rpm d02c85b57106bd7b161d320619b9c45a0e05f8ec673c85db68653d748c397e4c python3.14-tkinter-3.14.5-1.el9_8.1.i686.rpm d13922a57456a1b1340eae0a51c2a24f838d8e6fe04f453bf83444a1ba974b01 python3.14-freethreading-devel-3.14.5-1.el9_8.1.i686.rpm d95ce1e4eb61a300f904899aedb795d94d330e18e13a939da5913a9959566b57 python3.14-freethreading-libs-3.14.5-1.el9_8.1.x86_64.rpm dc91a5e9b78c62622fa57f0eecdfaace892e9c54cdd5c56be02a4652a83d0256 python3.14-test-3.14.5-1.el9_8.1.x86_64.rpm e015f855186e4379a8a0b5be68ee63e509b584749c1dc210deef93cc9d74c01d python3.14-freethreading-3.14.5-1.el9_8.1.x86_64.rpm f3648be4e368b37753816afa745b46291e68dc1741b9fd7b20ae9ce55bba3300 python3.14-debug-3.14.5-1.el9_8.1.x86_64.rpm ff7d020d85892b98af9f1b1ed4a78aba085eab8a46cb85149e5f8aa66cc90805 ALSA-2026:42089 Copyright 2026 AlmaLinux OS 0 1 Important

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" (CVE-2026-58016) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.2.i686.rpm 3d77cc92b8b7a24da751eb391e5dc5e10ba4ffd830e6d9b249007068953d04bd glib2-static-2.68.4-19.el9_8.2.x86_64.rpm afff4252ce98c82a2f5239d484f3fedce50295b2267226097ebb5d0c64b84c68 ALSA-2026:4216 Copyright 2026 AlmaLinux OS 0 1 Moderate

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * cpython: IMAP command injection in user-controlled commands (CVE-2025-15366) * cpython: POP3 command injection in user-controlled commands (CVE-2025-15367) * cpython: email header injection due to unquoted newlines (CVE-2026-1299) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.11-debug-3.11.13-5.1.el9_7.x86_64.rpm 0787c8ca1c466dbaa763270401184286a64d37870dc134bc3564b3a18c408d2c python3.11-idle-3.11.13-5.1.el9_7.x86_64.rpm 176be313a12636dbe50b37700124d08040f27b5de3bb6cd711a592b960798543 python3.11-debug-3.11.13-5.1.el9_7.i686.rpm 50c592b516e018222797898c85ef40e314f296d6938d3451cb1bae5dc2e71632 python3.11-test-3.11.13-5.1.el9_7.i686.rpm 911b8a5ce7d82f63cec09c071b5cbf7821f46de2e65e9ffe09927d55c1829bef python3.11-tkinter-3.11.13-5.1.el9_7.i686.rpm ae8c08119510aeeb00653fe09f9ab88603810a839f540bc24eff4a679ecb360a python3.11-idle-3.11.13-5.1.el9_7.i686.rpm c5d54f05c9b318f5d39d7e81a97e5a0f47d5c3a7f7c056d5c3beffb3c714bc85 python3.11-3.11.13-5.1.el9_7.i686.rpm f4b938d73289a2fcd2b08c94bbd357e67320d3b4ada22da3400659e9feb4e5c2 python3.11-test-3.11.13-5.1.el9_7.x86_64.rpm f9c09f9c39f22633d068aed27df9688ce3fb26e964b93eabd6c6ce6a21ca77a8 ALSA-2026:42668 Copyright 2026 AlmaLinux OS 0 1 Important

libtiff security update

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libtiff-tools-4.4.0-18.el9_8.1.x86_64.rpm c1b980eed075ea0cab1bafb36c8395ac8fde2b32710a1efacf425a251a2d370c ALSA-2026:42877 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Improve Nashorn index handling (CVE-2026-47057) * JDK: Enhance Dataview Implementation (CVE-2026-47058) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212308, AlmaLinux-212309, AlmaLinux-212310, AlmaLinux-212311, AlmaLinux-212312, AlmaLinux-212313, AlmaLinux-212314, AlmaLinux-212315) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212319, AlmaLinux-212320, AlmaLinux-212321, AlmaLinux-212322, AlmaLinux-212323, AlmaLinux-212324, AlmaLinux-212325, AlmaLinux-212326) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-1.8.0-openjdk-devel-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm 509b1f1a7dd4215b17593a7691eb5626a0304a687dc0535f0777454873f8f328 java-1.8.0-openjdk-demo-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm 6430d3f3903d7feb7137c3d35621319c9f58e2869d6fc1fe430ab6d0c5762c56 java-1.8.0-openjdk-devel-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm 752c65e2f08517f073e27f8b859fd092963524f096fedf8ce86f2b2054d5d853 java-1.8.0-openjdk-headless-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm 922ac38ff7af12fb3fdd503664ea20023bec96443210cb1d580d32792375aafa java-1.8.0-openjdk-demo-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm b7089ece5963dcbae895ccad5b40dc41fee44991bc68779ab36a58dbfa781bbd java-1.8.0-openjdk-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm c85d72e842d1e7f83bfea57dcbe43e4b6277e987a955a33fa089d8750f7313e7 java-1.8.0-openjdk-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm e7746f689781d74461055db0d1da61761098262b1c420d6f0e4c3c8c46901271 java-1.8.0-openjdk-src-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm f347162d271218cca22063ca2207c271b1bdac57c7efbe3e2068b065493ea029 java-1.8.0-openjdk-headless-slowdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm f69578e8ea56db8e43b5a483f0c8ae7e01457f325c2ea789f34285a68fa1fa50 java-1.8.0-openjdk-src-fastdebug-1.8.0.502.b07-1.2.el9.alma.1.x86_64.rpm fe1d951c63268ab688510fc9ad4bdbe26ab6a55adab8e80c0fb471160d1b81e5 ALSA-2026:42887 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212474, AlmaLinux-212475, AlmaLinux-212476, AlmaLinux-212477, AlmaLinux-212478, AlmaLinux-212479, AlmaLinux-212480, AlmaLinux-212481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-17-openjdk-devel-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 08705b57f31331091154b4e2e92e2650538c1067701886eeaa52849a942ec261 java-17-openjdk-demo-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 0a427b12bef06ba925665e7a2b0239f006d1806562a054132a6dbf7b425275fe java-17-openjdk-src-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 136092b9614de66e7bfbdae0d62f00c068e437c1f31d3674f035146fbbd9773f java-17-openjdk-jmods-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 323585d9eb0f4af6da54e8049fc5d71c4f55b6f86d3c0abccc19e7b58acb594c java-17-openjdk-jmods-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 6258a4c9e89dce3ea0f04e58e2895afb1d166667c66486440032d74b85bd8fbc java-17-openjdk-headless-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 7459bc83c967abfe88d4d761084770de72bf652cc02015b9a4414b858b179081 java-17-openjdk-demo-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 7c5ae5383ba6ded50392aefa562e3baee7c4a6b560574d6004a6521939402d0c java-17-openjdk-src-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm 8dbb17139b234b7809450971735f2e155c97015cc6229e653c1d36f3e20d1e43 java-17-openjdk-static-libs-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm a4454ae9eb7f6be3608ad6af18a2cfe6193a8b10d24a1310c2476f1a63e91229 java-17-openjdk-static-libs-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm bfbb7dd291788933564c6fc22a2e9139cd1bc4d8cf7c156c0110e94981b9d5b7 java-17-openjdk-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm c42734b99fb3b3d6fceca1c0457ebd0c4705caed67dbd0251292a74ba549f5a8 java-17-openjdk-devel-slowdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm d81508f3717a68d2add1c86495c1254ce863932eb558f1e473962b40f8f2c45d java-17-openjdk-headless-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm f3b92947db0bb36f6f28930594b0f96276080a4e895d03f5087c0d9b3a06d30a java-17-openjdk-fastdebug-17.0.20.0.8-1.2.el9.alma.1.x86_64.rpm fbc3782a7c84767d471c47354eef1f4eff70fc8fbe66b492055432315c4928e4 ALSA-2026:42895 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-212337, AlmaLinux-212338, AlmaLinux-212339, AlmaLinux-212340, AlmaLinux-212342, AlmaLinux-212343) Bug Fix(es): * In previous releases, the RPM did not correctly own the subdirectories used for documentation in /usr/share/doc and /usr/share/javadoc. This is fixed in this release, so these subdirectories will be removed when the package is uninstalled. (AlmaLinux-212353, AlmaLinux-212359, AlmaLinux-212360, AlmaLinux-212361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-21-openjdk-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 1db4a8670f9531a443c15298d2aef7f66b11f27849e8916ca3acbf0dc9617f9d java-21-openjdk-headless-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 27bd550057a88a384c09d177481621ad625c4c8be4f41746a6cf270fc13905d6 java-21-openjdk-headless-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 32419ad8556f47ee9bc94764deca474f4f4bd1c1db41a2437083fe37ced2c94e java-21-openjdk-devel-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 32dc93d7ce785ba9420e2a69efe4546745cd86bba888ed3c5a2d3cb68804b2cb java-21-openjdk-static-libs-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 3ce6bd11fc1802cda611fd24784feb59798bdd5edc895f617b2984fff79199ea java-21-openjdk-demo-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 4b6b8428cd0a943c250c30aa9614fed187bf906c944f1bde70124c0d1a4ef287 java-21-openjdk-src-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 53afb61a253407cdc23f38ee78ab923abc813eeafb991e29fdd7f953a8cc1aa6 java-21-openjdk-devel-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 5ce0c50a9e8d05616843e579c26fdecb2a22373e18ef7bcb2f32500fc09ef0d9 java-21-openjdk-demo-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 6d7c32d2e9626f3327734a010ff128e2b63a7b8fc6f46079ceccfee84fbcbf58 java-21-openjdk-jmods-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 6e8421b0b0c5c4c34b60bc73f02a0dcefaac755803fff8f656efc029b907df73 java-21-openjdk-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm 75629637d2bf195a7939e5f426bd9c7a8071cb5691642a7c008a27f17fadcf29 java-21-openjdk-static-libs-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm bcd0eac402d9d1ffade0274f6e6040de84d973c62dcfc5704d1e07a588d40d51 java-21-openjdk-jmods-slowdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm d9250e303e530723dcd13d6bfe974e86c2035583abdefdefaf833178582e2a00 java-21-openjdk-src-fastdebug-21.0.12.0.8-1.2.el9.alma.2.x86_64.rpm f73342235fc9c36712d37bc32707d0add16c5ed4dcabc12d120aeec1db76901d ALSA-2026:42899 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance TLS certificate handling (CVE-2026-46968) * JDK: Improve DTLS handshaking (CVE-2026-46917) * JDK: Enhance JPEG handling (CVE-2026-47010) * JDK: Enhance XBM image support (CVE-2026-47021) * JDK: Enhance Jar file processing (CVE-2026-47027) * JDK: Improve certification checking (CVE-2026-60147) * JDK: Enhance AWT ImagingLib (CVE-2026-47059) * JDK: Enhance Jar handling (CVE-2026-47063) * JDK: Update LCMS to 2.19 (CVE-2026-41254) Enhancement(s): * For the last couple of years, OpenJDK has used a single build shared among multiple RPMs and a tarball available on the customer portal. The single "portable" build has a release number ('p') and each RPM has its own release number ('r'). However, the RPM naming only showed the RPM release number, while the version output from the build showed the portable release number, making it unclear that they were different numbers. From this release onwards, a release field of the form 'p.r' is always used for RPMs and the version output shows 'p'. (AlmaLinux-211046, AlmaLinux-211048) Bug Fix(es): * The performance of the Math.pow function regressed between OpenJDK 8 and OpenJDK 11. This was due to an absence of constant folding when applicable (for example, Math.pow(2,1) being replaced by 2). This release reintroduces this optimization. (AlmaLinux-211050, AlmaLinux-211052) * On AlmaLinux 9 systems, the alternatives list a JDK and architecture pair (for example, "java-11-openjdk.x86_64") followed by the path to the binary in brackets. AlmaLinux 10 systems have a simpler format that just lists the path. Because the OpenJDK 25 packages for AlmaLinux 9 were originally based on those from AlmaLinux 10, they used the simpler format. With this release, the format for OpenJDK 25 packages on AlmaLinux 9 is updated to be closer to other JDKs on that platform. (AlmaLinux-212650) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-25-openjdk-src-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 0162cf95eeb0cefd84dc796b84f45c0e826c185ff5b4d17daef266d4d64b093d java-25-openjdk-devel-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 047087585a0c4211628e654a892d3e2e9c4329fed6a11179a2e50080f52f5029 java-25-openjdk-devel-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 09817506e66abc2a2f3023dc1ad3bb188976e98151b3613647c5c0deaf4cb9e0 java-25-openjdk-demo-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 0ccdb500cd3ac194f6827d8f0c9daab79622caf5fa916f7f544698d498185dd0 java-25-openjdk-crypto-adapter-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 144b2be6fd70f43b2f7922ef5653ce72cdec37ab0d869f00586c6a3f355da988 java-25-openjdk-headless-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 458ef017a01eae42828d72000704b4628d0f2dbd44be00003147a0a4008cb839 java-25-openjdk-demo-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 65dcb3a3ef8349d68aa2e60450dfd8f7fe48eb0ffda852d4e5379d7132bd7c9e java-25-openjdk-jmods-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 685ec59e77ddb384ff964d5a1a4d856a5ddebeae13146eb52c5df3d92658d284 java-25-openjdk-headless-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 83d6dda87d6997c76b462e642894e4b339b387353781f665a39b2970aa781d1c java-25-openjdk-static-libs-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 9ea4041a4155c52e8b51d65bcaab13c62fe142074258621d0f70fd98e4e7b3e4 java-25-openjdk-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm 9f33bc3c2de85f84136f02fa4c5081160abaaa74af6907743b06fb4665719c95 java-25-openjdk-jmods-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm c79628de69befd70e17f5abbf3035c6e4d5b77fd9a83d7f185931419b63b1b22 java-25-openjdk-fastdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm e3da43a380d3dd7d3a77faed18c2ece6acd6a96e7b8f1a9dd7554094e7433cdd java-25-openjdk-crypto-adapter-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm ee80f175db5123d7581fee229a4e025cfdc2416345b02462bd20908738bbac7d java-25-openjdk-static-libs-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm f6db1261fe20b912fd02c2ee3fbe2e3389f95cfcdb943f25be47e8616483eecd java-25-openjdk-src-slowdebug-25.0.4.0.7-1.1.el9.alma.1.x86_64.rpm f7f33426cacda7b2c12ed344543ae633592bdaa9fbeffd340974cf095f8bd4d7 ALSA-2026:42952 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings (CVE-2026-5928) * glibc: glibc: Out-of-bounds write via TSIG record processing (CVE-2026-5435) * glibc: glibc: Application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glibc-benchtests-2.34-274.el9_8.x86_64.rpm 0792e2f595da7962315b4f51340aff909ea7deca90634a99d6597da6fc41ce65 glibc-static-2.34-274.el9_8.x86_64.rpm 1773ed50b2c48242c9c68aee3256eef33b848df53f4e748af54030526887ed27 nss_db-2.34-274.el9_8.x86_64.rpm 2277e125c7be3b2a61202e05110358d8eb4373576b3b0f5d1cfd730111530a87 glibc-nss-devel-2.34-274.el9_8.i686.rpm 477efc74dc4cbd089662e17888eada17fa35a7c2e485b7ac57871b0454bf85b8 glibc-static-2.34-274.el9_8.i686.rpm 67f833fadd3d68643d002171cc51658f6061b135bd54f12201414aad27652057 nss_db-2.34-274.el9_8.i686.rpm 7637e6c73818bbf9ceb4706b3f319a76c3e09941e61d16e021c2aab8634c15a2 glibc-nss-devel-2.34-274.el9_8.x86_64.rpm 7ad63e4d53b71916ff25466dcb444a945c0c25b198d237b6a62ee6b69b948a30 nss_hesiod-2.34-274.el9_8.i686.rpm d9a229636e4fe0d013ed14951fd64c4835376c85e34606c5f769196b75a5c67e nss_hesiod-2.34-274.el9_8.x86_64.rpm fee138b520dd814d99d2eeefa658d7670c9e5e8bd0c46eb0cfc9e60e3346611d ALSA-2026:43307 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CVE-2025-71113) * kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110) * kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (CVE-2026-46099) * kernel: fanotify: fix false positive on permission events (CVE-2026-46150) * kernel: drm: Set old handle to NULL before prime swap in change_handle (CVE-2026-46215) * kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tools/lib/perf/Makefile: libperf includes appended after CFLAGS causes parallel build race, breaking kernel builds [almalinux-9.8.z] (JIRA:AlmaLinux-183980) * [AlmaLinux-9.8.z]: mlx5: include bug fixes (JIRA:AlmaLinux-188121) * dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() [almalinux-9.8.z] (JIRA:AlmaLinux-212061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.x86_64.rpm 14e5fa2f1ec89597844eafaad4623f6c31306ea355496f59d8a3585d2a316da9 libperf-5.14.0-687.29.1.el9_8.x86_64.rpm c7619ed7be354f21b2e66a074100a409408b93cdfb351f05a86e23d28a7f704b kernel-cross-headers-5.14.0-687.29.1.el9_8.x86_64.rpm d2b6ae7d91c581598f141cf113eb4074eba464df91078e498c225b77ee411ad1 ALSA-2026:4445 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default dotnet-sdk-10.0-source-built-artifacts-10.0.104-1.el9_7.x86_64.rpm 233d57e2e32252434c2f95ea64d3c119d65d81240566b3c8377e2337a03e617e ALSA-2026:4447 Copyright 2026 AlmaLinux OS 0 1 Important

libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libvpx-devel-1.9.0-10.el9_7.i686.rpm b05da9a08af48be094352966251a526d6f6dfe8b9ffaaf58ec83bb4b0502b374 libvpx-devel-1.9.0-10.el9_7.x86_64.rpm c227209c10991a43b437a0ce19a22676b59b68c8b638a8b64d3308d82abdd17c ALSA-2026:4454 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es): * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.125-1.el9_7.x86_64.rpm 16e5cf4dad8831ea7090f7b40b8b80ef98a0b8ec28ac7b3de2d88dfb1b2c8052 ALSA-2026:4456 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es): * .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127) * asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default dotnet-sdk-9.0-source-built-artifacts-9.0.115-1.el9_7.x86_64.rpm b39daa1924db0d784470e8c72e2a5f398a66b9365baf9780b022a2d99d1bd33f ALSA-2026:45192 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) * kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) * kernel: drm/xe/dma-buf: fix UAF with retry loop (CVE-2026-52950) * kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006) Bug Fix(es) and Enhancement(s): * scsi device removal may hang from race with error recovery [almalinux-9.8.z] (JIRA:AlmaLinux-187412) * [AlmaLinux9] kvm fixes for 2026-07-21 [almalinux-9.8.z] (JIRA:AlmaLinux-213468) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.30.1.el9_8.x86_64.rpm 454a12a2e8f688ddc741bd212af7f804ab58c9baca12b89ae6ed9d4c00d32f60 kernel-tools-libs-devel-5.14.0-687.30.1.el9_8.x86_64.rpm 5f9acb9f385aa56e88a35cbd8a4e112f47a4d7ad340bdfaca595ad0e562a0395 kernel-cross-headers-5.14.0-687.30.1.el9_8.x86_64.rpm 8ee832b04781ec3e8496905598a34735d27b4adb40bdfc0e340cf2099febac48 ALSA-2026:47040 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: Duplicate SPI Handling (CVE-2025-39797) * kernel: lib/buildid: use __kernel_read() for sleepable context (CVE-2026-23002) * kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973) * kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (CVE-2026-53281) * kernel: blk-mq: pop cached request if it is usable (CVE-2026-64017) Bug Fix(es) and Enhancement(s): * general protection fault during exportfs / nfsd4_revoke_states [almalinux-9.8.z] (JIRA:AlmaLinux-188257) * Enable Pretimeout Watchdog Panic Functionality on x86 [almalinux-9.8.z] (JIRA:AlmaLinux-193729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.31.1.el9_8.x86_64.rpm 98d5af7fa9a3d689e6ef7ef3d97389f89f3a93bba8b414c600947dbc68843245 kernel-tools-libs-devel-5.14.0-687.31.1.el9_8.x86_64.rpm c5fb4d30204118fa99810753a71b27eb51aa232515700cbd0d534a37ff946c64 libperf-5.14.0-687.31.1.el9_8.x86_64.rpm e05910af50531c1e2ccf1359a4da58f69432ba37a411385042048f84c1a7ff9e ALSA-2026:47084 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libXfont2: BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * libXfont2: PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.1.i686.rpm 30222a6ca3ff30d91dfb8d76857e72d7ed1d04a253def9a477fbd9a79311c16d libXfont2-devel-2.0.3-12.el9_8.1.x86_64.rpm 73e69bbbe37f6a28c8de80469b1a38fc080fd3cbc22214edda176fbf29bb7b7d ALSA-2026:47178 Copyright 2026 AlmaLinux OS 0 1 Important

yelp security update

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook. Security Fix(es): * yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications (CVE-2026-13601) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default yelp-devel-40.3-3.el9_8.1.x86_64.rpm 3b3f1f652f4f31f9d565feeb7a33b91bf93b9bbf1868a3ba9504267563fd9d2e yelp-devel-40.3-3.el9_8.1.i686.rpm bf1dcb78989662ff1eaefe06bc359c8329494b20d4996935f445fb53bf560b8b ALSA-2026:47179 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer: rfbsrc/librfb Hextile heap out-of-bounds write with 16bpp framebuffer (CVE-2026-59691) * gstreamer: gstreamer: DTLS certificate Subject DN stack buffer overflow in openssl_verify_callback (CVE-2026-59692) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.i686.rpm 4348f0a0fd22f8fffa8486c724ed3d68fe7c254b149514355f069824f80a9ee2 gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.3.x86_64.rpm 66e634e424fdc9bc8e7538f2c1c0a2e4c46f87311e87daf242ba46bdfc5b3dae ALSA-2026:4759 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CVE-2025-39818) * kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CVE-2025-68800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.41.1.el9_7.x86_64.rpm 081dbe11d328bdb22f9922783bba20b8c781cad4e5983a0d0192c84bb53aeb86 kernel-cross-headers-5.14.0-611.41.1.el9_7.x86_64.rpm c9172c04c928903fbc526946f19e45595e3780fd8d52f8ef9f3cab8f3cb9971d libperf-5.14.0-611.41.1.el9_7.x86_64.rpm f70047ad0629c280bb07ba5f61793d1e5b949abcb5f5e229d112ed3bd54e4eb1 ALSA-2026:4828 Copyright 2026 AlmaLinux OS 0 1 Moderate

mysql security update

MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. Security Fix(es): * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948) * mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936) * mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968) * mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937) * mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default mysql-test-8.0.45-1.el9_7.x86_64.rpm 832a7273a7a84d02d2d4f07ab5708b4519c8cb75641315f3ff5b1f33131ce469 mysql-devel-8.0.45-1.el9_7.x86_64.rpm d1784f937fdfa3780db2735f526f9388a6b5476852ef3b4502b53db0dc894b80 ALSA-2026:4898 Copyright 2026 AlmaLinux OS 0 1 Important

capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) * capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default capstone-devel-4.0.2-11.el9_7.i686.rpm 60a0669f98c64f102f8ecc5baccbfa5fb154c70a4d20325538da12fc7c8fc965 python3-capstone-4.0.2-11.el9_7.x86_64.rpm 6a5cd1446d4337e33dd34047a451f60d94eb5c1e05eedfca2a369a4a3b13d9ca capstone-devel-4.0.2-11.el9_7.x86_64.rpm 737ef95bf327d7ef887d2e16b79fcbcf65e373b13d1889bf57e0ef0ad459c1fb capstone-java-4.0.2-11.el9_7.noarch.rpm 9148e1b91a4f21330bcfcfec0fb3809e12ac0bc48c9f877a686b6afcc9e1e6bf ALSA-2026:49212 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle () * kernel: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.33.1.el9_8.x86_64.rpm b5507263c2e347421ec7f9e1bbf3f6484663fa44ff73183a19537c0e11edbc2f kernel-tools-libs-devel-5.14.0-687.33.1.el9_8.x86_64.rpm bf6135a55944010166df381e92ef589a6f29ec12d7ee59b75150f3a9f55329de libperf-5.14.0-687.33.1.el9_8.x86_64.rpm ed3d38204578f23f59d3532d08e22c04493bf7feea17c11adf0712c2a96f26dd ALSA-2026:49870 Copyright 2026 AlmaLinux OS 0 1 Low

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service due to NULL function pointer race in timer shutdown (CVE-2025-68214) Bug Fix(es) and Enhancement(s): * Possible regression with FM350GL [almalinux-9.8.z] (JIRA:AlmaLinux-184273) * AlmaLinux9: Fix downstream-only regression from 532af53c [almalinux-9.8.z] (JIRA:AlmaLinux-192430) * gfs2: xfstests generic/363 failure [almalinux-9.8.z] (JIRA:AlmaLinux-214021) * AlmaLinux 9: Backport b95e0e792822 [almalinux-9.8.z] (JIRA:AlmaLinux-216471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.34.1.el9_8.x86_64.rpm 06445ef4d68a08e33b0817aa1568fc8684db7704499782f22f7c4644f996009c kernel-cross-headers-5.14.0-687.34.1.el9_8.x86_64.rpm 31b223dc7abea04799c519c921f4b5b9ab7645fc90be89f9d90650be62a9d459 libperf-5.14.0-687.34.1.el9_8.x86_64.rpm dca7411f18bd35dce1b6f41949805ccdf860b1ac77a715d63917f57cdd8a8bf6 ALSA-2026:50108 Copyright 2026 AlmaLinux OS 0 1 Important

ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to (for instance) create or sign packets. Security Fix(es): * ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching (CVE-2026-10846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-ldns-1.7.1-12.el9_8.1.x86_64.rpm 06d7e8a6a611fc2f9ab918b9ec42281338132f87169f39e786a3eac820633916 perl-ldns-1.7.1-12.el9_8.1.x86_64.rpm 61194175ee08d445bbb3a08ca8eaeaf74032d5f20e4d9040a6be40eb0020e838 ldns-doc-1.7.1-12.el9_8.1.noarch.rpm 7e158362aea06b2f4ea4f6ac69774898ce998bc5ff610ff22df26aa72729f57c ldns-devel-1.7.1-12.el9_8.1.x86_64.rpm a20a1e19b8460c3e5c27f626812b3ac348f32fc39ac72dbad1f971b5c0076af2 ldns-utils-1.7.1-12.el9_8.1.x86_64.rpm e9e500f006bcceb45fcd958de94b3266e6e2758fd7bcbb48d5a68b4eb200f8e4 ALSA-2026:50141 Copyright 2026 AlmaLinux OS 0 1 Important

sg3_utils security, bug fix, and enhancement update

The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets. Security Fix(es): * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): * sg_inq output conformance for SCSI name string and ATA fields [almalinux-9.8.z] (JIRA:AlmaLinux-188130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default sg3_utils-devel-1.47-10.el9_8.1.x86_64.rpm 61531ac240e2b36b10bee921e8c6d76e7216e6fc28d387eff617e36e10752fe7 sg3_utils-devel-1.47-10.el9_8.1.i686.rpm 6ec9dfebf5f0da554e844bf00d474559ee660b88c5482c7154378ad57610ef2c ALSA-2026:51035 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415) * kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450) Bug Fix(es) and Enhancement(s): * kernel panics caused by NULL pointer dereferences within octeon_ep_vf [almalinux-9.8.z] (JIRA:AlmaLinux-186331) * [AlmaLinux 9.4] Kernel memory reclaim bug [almalinux-9.8.z] (JIRA:AlmaLinux-211058) * Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [almalinux-9.8.z] (JIRA:AlmaLinux-215575) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.36.1.el9_8.x86_64.rpm 0d64727b581ab5f90a9dcbe04915db3fa236adc09240fd0be42210fda81b3226 kernel-tools-libs-devel-5.14.0-687.36.1.el9_8.x86_64.rpm 5dc3c342cedd7a11deafba11271d97c68fb771a305b49dcc8c686a11eb61a9bb libperf-5.14.0-687.36.1.el9_8.x86_64.rpm 72d667252411f6b92a9010f242d2b6b0a34a55769630f9f57bb83a154643c199 ALSA-2026:51105 Copyright 2026 AlmaLinux OS 0 1 Important

LibRaw security update

LibRaw is a library for reading RAW files obtained from digital photo cameras (CRW/CR2, NEF, RAF, DNG, and others). Security Fix(es): * LibRaw: LibRaw: Buffer Overflow vulnerability in image processing (CVE-2026-51235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default LibRaw-devel-0.21.1-2.el9_8.1.x86_64.rpm 773ed59099a309b165dfe17106562476415c5866ba0c543aab9e02ec02a4f7ff LibRaw-devel-0.21.1-2.el9_8.1.i686.rpm d3d1ca49169c09d54d1690ec3e4bc972f27c724de411190e045fe322a78492a7 ALSA-2026:52395 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation (CVE-2026-6479) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default postgresql-upgrade-devel-13.23-5.el9_8.x86_64.rpm 7029ddde903606bccff4b8222f6a1d5a21b336c87b02f22488a7ad0957d0360f postgresql-test-13.23-5.el9_8.x86_64.rpm 82d8575e84e9c65bde596277757adeafabe980ca654468caad7d268656336c33 postgresql-docs-13.23-5.el9_8.x86_64.rpm 87a2283fa91b675be981c7c6d78d361e4d0741b4526b35846f60109458ed3f03 postgresql-private-devel-13.23-5.el9_8.x86_64.rpm 9c54482b4beff45615041b70586fc4bf4d495b7b52cefe0a85e3003b7c48fd6b postgresql-static-13.23-5.el9_8.x86_64.rpm bfffadc48cfb2bdff697df10d8cd7f52a4a53ee7f9823cffea9a0c337b855876 postgresql-test-rpm-macros-13.23-5.el9_8.noarch.rpm d732c71a16cd11972ca9f56da5ba1df03a091f44c271942eb352f1e41e040b86 postgresql-server-devel-13.23-5.el9_8.x86_64.rpm d9d7dd20bb2b0f0220c24d574c99f2e52d3ff00be930edb86b42b70b9c2f35ff ALSA-2026:53329 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: cxl/port: Fix use after free of parent_port in cxl_detach_ep() (CVE-2026-31530) * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * kernel: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (CVE-2026-64368) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) Bug Fix(es) and Enhancement(s): * Kernel oops after increasing max number of mac addresses of a mlx5 VF [almalinux-9.8.z] (JIRA:AlmaLinux-213036) * AlmaLinux9.4 - s390/pkey: Check length in pkey_pckmo handler implementation [almalinux-9.8.z] (JIRA:AlmaLinux-215578) * AlmaLinux9.4 - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl [almalinux-9.8.z] (JIRA:AlmaLinux-215580) * cifs: periodic IO errors when rename races with lease break (JIRA:AlmaLinux-192999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.38.1.el9_8.x86_64.rpm 24d330b9c0822a61d5749129752a58cc97b7a8093b5db0ac61bece04145676bf kernel-tools-libs-devel-5.14.0-687.38.1.el9_8.x86_64.rpm 66f679509528b6c076618ae6dfda805610f22ef81ceb5d1e4fb1c928bf6f3cca libperf-5.14.0-687.38.1.el9_8.x86_64.rpm 75083f8a57887683d928f080b9bc605250a9fb8434487dc18216cd2dbe750d77 ALSA-2026:54268 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-test-3.9.25-7.el9_8.3.i686.rpm 5499154d855099838d4cee819afe0d71e7403bc5fdf7a7f39adde4811cf81b1d python3-tkinter-3.9.25-7.el9_8.3.i686.rpm 6ddb9728a35fcdf4753551a0c272ad38200d7e36719d031be3cbebf9f495a820 python3-test-3.9.25-7.el9_8.3.x86_64.rpm 92729e1c8836c383350dbba291e81daf65ccb48caaf7cbfebfd02d75257b824b python3-debug-3.9.25-7.el9_8.3.x86_64.rpm 9c734826a24ab3fb1672dc7bc108883dcf17dedd4cf788262f23628c6b0210f9 python3-idle-3.9.25-7.el9_8.3.x86_64.rpm ac22188a5d81eb0ce031c70a78f24d9f42648c6786abe10c0d4660a0a44e6fe8 python3-idle-3.9.25-7.el9_8.3.i686.rpm cff6d328a8d658e54ed6955f88b4dd3f554074393b8605be77ea2b30a18b7219 python3-debug-3.9.25-7.el9_8.3.i686.rpm e7e2c6cb7d54517d896545aad1b22a7311c1457f80951c1766ccca4bae77316a python3-3.9.25-7.el9_8.3.i686.rpm ff9a8bfc84264d9d6294adc83e0f21f4cb4f7fd722998b4a43908e6ef8c0f5ea ALSA-2026:54443 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: accel/ivpu: Fix signed integer truncation in IPC receive (CVE-2026-53202) * kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264) Bug Fix(es) and Enhancement(s): * [AlmaLinux9] tlbflush - Windows Driver Verifier catches FLTMGR/Ntfs crashes during KVM 42-VM soak test on AMD EPYC Turin [almalinux-9.8.z] (JIRA:AlmaLinux-214434) * Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [almalinux-9.8.z] (JIRA:AlmaLinux-220787) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.39.1.el9_8.x86_64.rpm 0c22a7fa0efe52e184178b41151aaacc5d42153691721b9abe55a396b16d23ca libperf-5.14.0-687.39.1.el9_8.x86_64.rpm c6ba8de7fd0f1bdb648179b83110c3a92cb40084fa09388f37bb5c63d000dac5 kernel-cross-headers-5.14.0-687.39.1.el9_8.x86_64.rpm db9c7fab0dbc23217a7615f8a7898b560878d2bec787930821d2a09dee2f46b4 ALSA-2026:54487 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624) * FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299) * FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289) * FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.5.x86_64.rpm 6e946afc932e06e923a1484f6417381deaa2d9fbe593e18d6c3f95a8db24b4b2 libwinpr-devel-2.11.7-7.el9_8.5.x86_64.rpm c50cb20937eefd46a495be1ecbe892b5f96c4efc24e08b56010005b7cdbd119e freerdp-devel-2.11.7-7.el9_8.5.i686.rpm c81b5f20c8475ad1f7457559519a74d9abd9fbac47e76f6302c107aa3e89b393 libwinpr-devel-2.11.7-7.el9_8.5.i686.rpm f6ed7661904077e27eb29dba0eb1b9a9ed6f1b455494c876223bb6641841db5b ALSA-2026:54510 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind-libs-9.16.23-40.el9_8.8.i686.rpm 1a094953496e53ec0dd784b457c903618a025d98c54baae2f7b980666ec0f7ee bind-devel-9.16.23-40.el9_8.8.x86_64.rpm 2951206ad4bfeb4b97ae2ecb560ed5b1801a4ed0e8ce49af2c31b7f83369070d bind-devel-9.16.23-40.el9_8.8.i686.rpm 46927cfdb3bde15d976fd49d83ba33a610055f9d063c7b925da355bfc859a809 bind-doc-9.16.23-40.el9_8.8.noarch.rpm 707e97caec593d461f991261508fa9381c00491912300c14df52d4d4823da370 ALSA-2026:54574 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.130 Runtime version: 8.0.30 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.130 and Runtime 8.0.30 [almalinux-9.8.z] (JIRA:AlmaLinux-235471) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.130-1.el9_8.x86_64.rpm bff03d8683c97c9f81aeb1f2af332c10057908b695841b2364bcfc8a3dc5bd70 ALSA-2026:54662 Copyright 2026 AlmaLinux OS 0 1 Moderate

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libnghttp2-devel-1.43.0-6.el9_8.2.i686.rpm 6d92f829bbf32835c591f9616f56afebea26f76e7852bfb38d3cee6d5f408f0b libnghttp2-devel-1.43.0-6.el9_8.2.x86_64.rpm 7b359242f36661ddb9cbdb367c6c4f2387d6af02b930ba59e26cc9fd98edc18a nghttp2-1.43.0-6.el9_8.2.x86_64.rpm b65ac9136dff99b5c1f5491a0e24f07251d602a233099a069fa1b989efb35adc ALSA-2026:55423 Copyright 2026 AlmaLinux OS 0 1 Important

389-ds-base security update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check (CVE-2026-11770) * 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser (CVE-2026-11788) * 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing (CVE-2026-15722) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-9.el9_8.x86_64.rpm 26a9a8bf8794586485c24d6d1d7b692c61d2bf01b8182e44b14b72635802e478 ALSA-2026:55440 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal() (CVE-2026-58010) * glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime (CVE-2026-58011) * glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char() (CVE-2026-58012) * glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend" (CVE-2026-58013) * glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014) * glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015) * GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering (CVE-2026-15588) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.9.x86_64.rpm 145136e859db145c56f1a7d579ba8d22f0dac4dcf9cd11261c360d1a85cc2834 glib2-static-2.68.4-19.el9_8.9.i686.rpm 8ec0804d8c5628ca8455115f7c7bfc12cf6793e2a222e14fc9ae5b176ac44525 ALSA-2026:55442 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.8.noarch.rpm 25810d7d4702c335e76c9bab862566f0691f40c2f421619204196cd55e0e2ec6 bind9.18-libs-9.18.29-14.el9_8.8.i686.rpm 42bc6e5110570c58152ce5368864c152a8be7f5cd6d1cc2b2bc6f3169a86935a bind9.18-devel-9.18.29-14.el9_8.8.i686.rpm 4b1ecc7fb787e4508b273cb0c85635ab0e276a05577a80d086ee7af2fd3a3911 bind9.18-devel-9.18.29-14.el9_8.8.x86_64.rpm 65b04398d484882435dda23c93a0fde3329425d41d20b7bdc756d7b8a2ff7ef0 ALSA-2026:55447 Copyright 2026 AlmaLinux OS 0 1 Important

libXfont2 security update

X.Org X11 libXfont2 runtime library Security Fix(es): * libxfont2: Font Server Client encoding[] Out-Of-Bounds Read/Write (CVE-2026-59679) * libxfonts2: libXfont2: Privilege Escalation via Heap Buffer Overflow in Font Server Client (CVE-2026-44950) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libXfont2-devel-2.0.3-12.el9_8.3.i686.rpm df2eeb4710c94b93bbbbb54eed08c220703f61f1d2ddce421387abbbc52d3df3 libXfont2-devel-2.0.3-12.el9_8.3.x86_64.rpm e76098f2023b006541e726037333541d26268cfc5e6e51a3bf9d3162c3305506 ALSA-2026:55775 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-1.8.0-openjdk-devel-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm 35276245855d43ffe9318ed12951a3a709de5efa06fab0bb6cee3ee5704fb7f7 java-1.8.0-openjdk-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm 76d27e7d60a866e7be76bfeb9096266c029c5358e8ed1beab7f6ed50823dc97f java-1.8.0-openjdk-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm 7f7bd25b0cd66e2c2a15eabd3a997db216ce1aa8d85e7473976572e357e9bad4 java-1.8.0-openjdk-headless-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm 84cce66820bb9174cf11f32713752586605b03edc996d63a66c6999eb179334c java-1.8.0-openjdk-headless-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm b17cd65b1e5485c7fe2cc0a881ac2fe7d69a8f1406a02a4d796082a935a53a1b java-1.8.0-openjdk-demo-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm b73dac3cdc0fc7fe17ca52d1c1f6de89e40f7a6c4c49967010835fa490853936 java-1.8.0-openjdk-src-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm d32695e0e0e27eeeb67a888350cb9ff3b1d954daf9202ae55cb5eb318aee2bb8 java-1.8.0-openjdk-demo-slowdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm d5782ea6cb4f155ceabb657a9ee2a3e1c705dc019c425b21e3904a2e65d74e9a java-1.8.0-openjdk-devel-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm ed644cd7849a22a2e61328737b3cab5046042b88cd59fda8fff88579a9e23ee5 java-1.8.0-openjdk-src-fastdebug-1.8.0.504.b01-1.2.el9.alma.1.x86_64.rpm febb5b3dff82e10d1d42a7b4ef12e03dc1a6bfec15c73e7e8a2fc84b51aa9a80 ALSA-2026:55781 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-17-openjdk-src-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 1ac2a4c3bd37203d1f1a0052873456ee5094c45147e69c16093386ffac7a37b4 java-17-openjdk-src-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 1c83b3505aece7ad4681557b9c709d5867d1063146e087d9b844d77c4c82b287 java-17-openjdk-devel-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 2f6514019f9536d64b6cf57c1a1b9e883322689db46c5bcbac526e2c68e33ee7 java-17-openjdk-jmods-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 42d2533e41db8541cd3afeb06d09916464781bda5cb472a930f9f4df9b7981bb java-17-openjdk-demo-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 5e0b000b0bb0237e68fbdbe241171a9d289dc9fb5da18e6d7f308354a3e81cd5 java-17-openjdk-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 6878d17bc49d15325d8e6a5b29c2be8fc6c67ae6bca4005a230b78f5ae05fd0a java-17-openjdk-headless-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 75784df34e5db83baf26b84b35c795d5b0a3cfbdae90b52aed79d8f3e7f5723a java-17-openjdk-jmods-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm 93f46309a66b43620e2d380f3fa65a6f2afc0189aae4538fc50fe45d8e8c78cc java-17-openjdk-demo-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm a1582e1e441e9e827bfc43a9daff60e600cceaee9cfa862e59edfc0c141364f5 java-17-openjdk-static-libs-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm aff62fe3ff6e7e637e22ab1cf8b72d093396e844ff21f23096bc987a93d8b7b5 java-17-openjdk-devel-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm b738b082e6312235f9d28337fc2147e892dae7bf605b3879d744e9b3f44ac4d7 java-17-openjdk-static-libs-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm d4da5c3cc6603f13c37de9658cf74dd19af0dedf09f3dfc0b35fb22a06653431 java-17-openjdk-headless-fastdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm d855d793382b90418f982219ba43f24cf2ec0df8e4bab2da62e0464250d2a105 java-17-openjdk-slowdebug-17.0.20.1.1-1.2.el9.alma.1.x86_64.rpm f75a378f8bbf707167e30b117e52eaee053336910352acec0a73adc66b120014 ALSA-2026:55787 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-21-openjdk-src-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 0feeb4903e90694e68782f1b0ef82da20b24beb40016915286ed6ae877d8e241 java-21-openjdk-jmods-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 2b3f4030e4c14971e95dfad5a7507fb93e476267d8fb88b813879383fa595b07 java-21-openjdk-static-libs-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 3d19cb0a21ac9b027afe58f3634023722b0bc75f7c1281403cc1fc7642f11936 java-21-openjdk-headless-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 5cf5fe7bd576acefd6c4d14d1825ec6013e5695b24faf2711ab9af15b643be48 java-21-openjdk-static-libs-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 652fb72bd50eb216775a560d27171b94eddf99dfc446dfbdd46eae7ac65e039f java-21-openjdk-devel-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 704f10dceb7202db65a922d6d802a27fdf69550d0f30247fd866a925a5465397 java-21-openjdk-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm 860ce9980957ecb241bbdaf0b1544a79c04d2a88f63832a536808944d34b8450 java-21-openjdk-headless-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm a2eb63b988f73fdac45e65933f5190fdf56c1fb1da6e42eef84e1b817bbe865e java-21-openjdk-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm af3ecf1821b0c658e7dc5c166d52b05c90b42f2572b19c61163c47f6da3158ab java-21-openjdk-demo-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm b00b235fd417096f1abd6115b99d02d00cc7eecdabade89f43e78786b5022704 java-21-openjdk-jmods-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm c32e594c93b771e24eedd6c49d005e961a557c8adc20d6a5e4bf1b90fa095210 java-21-openjdk-src-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm e08fb073742367b38d4cca226ed100069c3ca1e609bef3ff1a76d4fafc9cb0b0 java-21-openjdk-demo-slowdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm f352128e8e79113806ef2f1460911dcb00c5d17ca6edf927df6c2daa2e0d5887 java-21-openjdk-devel-fastdebug-21.0.12.1.1-1.2.el9.alma.1.x86_64.rpm fcdd09d1396db3790550b2523fab166d45415eeee333d64d7898b227f9bece32 ALSA-2026:55798 Copyright 2026 AlmaLinux OS 0 1 Moderate

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Improve Resource Resolving (CVE-2026-60589) * JDK: Enhance HTTP Connections (CVE-2026-61308) * JDK: Improve font loading (CVE-2026-70906) * JDK: Enhance TLS server (CVE-2026-70907) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default java-25-openjdk-jmods-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 319446e6d81963f15de3cbc65d5e7e60ec9ac1707e25b33213cfe78d2a12e978 java-25-openjdk-crypto-adapter-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 55de2090d0070c3095f4309970cdc9ca4948651d6a5c95bcea2d86937635b05d java-25-openjdk-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 5cdaf8c57f01c674c33aa21839b9c55c8194266952505eae4f0eb7193ef45ffc java-25-openjdk-demo-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 5f78dc4c9a39b53defb082a0537b28b9608f3578b4c5d3085e2d4d9f829a0784 java-25-openjdk-headless-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 6efe5c58fddd9c8c503aa897ec1c04ab13ba3fe9520e9cfa2a42631cda9a89bb java-25-openjdk-src-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 72a05f15042356c93ca4619ef852f7e122c091ce3ee89e8ca4760e7510209ef2 java-25-openjdk-headless-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 73c9d4a37c4e4f2983ef9b133916b20697ada59939afa7f79ea252c973ffcaa2 java-25-openjdk-jmods-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 75aff5a5f491bafdfca94d5172edde331edcdd4e3f8d14692ac27e87b04e22ef java-25-openjdk-src-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 7671f248743e7c0e5d7f9bf91b07e67cce553831ebf85d72dd6d8a4eeb034738 java-25-openjdk-devel-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 7d7f8167a28141a8848d07b2c24cf0a37c42a68e081ab36951489d5b1a70af57 java-25-openjdk-demo-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm 7d8ed3b41846ca8c5afbc69c045ce1361e4e6b1b0ade333990e6f5da2e13530a java-25-openjdk-devel-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm c681f2d1fa197c445666e377a971fb40e172a84cca48526549a11b3c22189381 java-25-openjdk-crypto-adapter-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm c78fb66ec5c2423888a20872e8b6aaf4d8041556fc3b85ea41987ad765999fdc java-25-openjdk-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm cc8c61db3a0fa4facb386e8748ce28908ad70c19a9d18bd16c2d5063f7d37773 java-25-openjdk-static-libs-slowdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm d67c96bdbb1bc18dbbc2fa7f18907a2c00b3cac487c49183fd17b481c9163910 java-25-openjdk-static-libs-fastdebug-25.0.4.1.1-1.1.el9.alma.1.x86_64.rpm e587a51b6b1bc8a6a4bfeaba1b73bcb834a1ed09d1cce6a4c3731115b23d41a3 ALSA-2026:55841 Copyright 2026 AlmaLinux OS 0 1 Important

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Cache poisoning via insufficient RRSIG.Labels validation and premature cache writes (CVE-2026-44690) * unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option (CVE-2026-55973) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.4.i686.rpm 5e6000b718c5f32b4f451bdf71927f64baccb0be36afee321dd31d250236a643 unbound-devel-1.24.2-3.el9_8.4.x86_64.rpm 8f9272f6eaf6b72085db1c86e0a756eb3a0fa0389c21cb427624a0bd0d43d107 ALSA-2026:55856 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.120 Runtime version: 9.0.19 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.120 and Runtime 9.0.19 [almalinux-9.8.z] (JIRA:AlmaLinux-235476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.120-1.el9_8.x86_64.rpm 0f6a9ced96f85a81f6f7f059e30e512b3c0ca8402f1abaee225644e416bb170d ALSA-2026:55857 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.111 Runtime version: 10.0.11 Security Fix(es): * .NET: .NET Core: .NET Security Feature Bypass Vulnerability (CVE-2026-62899) * .NET: .NET Information Disclosure Vulnerability (CVE-2026-62900) * .NET: .NET Denial of Service Vulnerability (CVE-2026-62901) * .NET: .NET Elevation of Privilege Vulnerability (CVE-2026-62909) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.111 and Runtime 10.0.11 [almalinux-9.8.z] (JIRA:AlmaLinux-235481) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.111-1.el9_8.x86_64.rpm ccbb31fd98b32bdc83e0f4995adb9c2580a066658f6d107bf592a2ccb68f8b48 ALSA-2026:55865 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder (CVE-2026-19387) * gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read (CVE-2026-19389) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.4.x86_64.rpm 8837a61c65a3c372111744a77c2604239ab397d0aac782a072c11bdac9f05138 gstreamer1-plugins-bad-free-devel-1.22.12-7.el9_8.4.i686.rpm bc0a72d6ab7ef678d99d42a0bf44fc418a18a238faa085f4144a948cbb41c9df ALSA-2026:5599 Copyright 2026 AlmaLinux OS 0 1 Moderate

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.1.alma.1.x86_64.rpm e7022a8dc863c98a291dad8a0c18ef6ac6c372ae2745515d42f54c0391033b95 ALSA-2026:5603 Copyright 2026 AlmaLinux OS 0 1 Moderate

opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities. Security Fix(es): * openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following (CVE-2026-23893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default opencryptoki-devel-3.25.0-4.el9_7.2.i686.rpm ce9d87928964b7aaf484f08e6f6b2f08ff5d0723786f9cb3c5efbf85cc927a79 opencryptoki-devel-3.25.0-4.el9_7.2.x86_64.rpm ceb7c9809d81cd88cac4c2209b57ffec5a8c5d043e3bbcf22d3f9a9edb1bca44 ALSA-2026:57252 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233) * kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206) * kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237) * kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991) * kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878) * kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120) * kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991) * kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143) * kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136) * kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189) * kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329) * kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356) * kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374) * kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884) * kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007) * kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952) * kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888) * kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879) * kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048) * kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219) * kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382) * kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379) * kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386) * kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560) * kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343) * kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388) Bug Fix(es) and Enhancement(s): * kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:AlmaLinux-181065) * vhost: reset the vring metadata cache on vring reconfiguration [almalinux-9.8.z] (JIRA:AlmaLinux-224549) * cifs: smb1 directory listings from xp server returning EINVAL and EIO [almalinux-9.8.z] (JIRA:AlmaLinux-235811) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.41.1.el9_8.x86_64.rpm 20d8414caf11cbab437c51bce80c1986886c640363c3a479ec0e0f13cab0e332 kernel-tools-libs-devel-5.14.0-687.41.1.el9_8.x86_64.rpm 5926294c4a1db7c73f7e133f536e21bb3dfdbf9b5d77d5fa91a6a4d0dfe8b8f0 kernel-cross-headers-5.14.0-687.41.1.el9_8.x86_64.rpm 78e7fdf448bf80719e436fb26cadb2b5405e08b2ca6995a7a66f44345b8966bd ALSA-2026:58560 Copyright 2026 AlmaLinux OS 0 1 Moderate

cups-filters security update

The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * libcupsfilters: cups-filters: libcupsfilters: CUPS image filter process abort via malformed PNG (CVE-2026-64612) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default cups-filters-devel-1.28.7-27.el9_8.i686.rpm 621ec2b76bfc6b49c872d6561796908f24ac4d0667c62cd467efeb1fd6e456e8 cups-filters-devel-1.28.7-27.el9_8.x86_64.rpm 8bc518f038289e764667b5897bf5447bc50787c42f7cdf6ddf5642c2a85f6b1f ALSA-2026:58572 Copyright 2026 AlmaLinux OS 0 1 Moderate

NetworkManager security update

NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services. Security Fix(es): * NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend (CVE-2026-10805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default NetworkManager-libnm-devel-1.54.3-5.el9_8.x86_64.rpm 50f36a957248d359b455e44495fb0df2818af68c98111ce056c04214af903354 NetworkManager-libnm-devel-1.54.3-5.el9_8.i686.rpm e8717a79dbbdd45db597c593a15d9f296bc28b8fae7cec78fe723e94244af6bd ALSA-2026:58901 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.14-freethreading-3.14.7-2.el9_8.x86_64.rpm 0e40900e036f334d31844f95554bd8cb80f6aca721f495a4abe5c01e120c3a9a python3.14-tkinter-3.14.7-2.el9_8.i686.rpm 10481c2898fb1766884eef96e0b895435a7cc78648693a7561eb3a0ca633f769 python3.14-test-3.14.7-2.el9_8.x86_64.rpm 1680f20e55fe502b4e9a6046b5e9672484d0caaca2b56dbefa07232b82823465 python3.14-freethreading-libs-3.14.7-2.el9_8.i686.rpm 1da33881b3c92b634e0818ddae79959fc0c7f6dd464182d69277355c617270af python3.14-freethreading-idle-3.14.7-2.el9_8.i686.rpm 25544f4d2a7fc393dc349dd2d126ee023298d4c2bdbeeb73c50d20d63aba5bd0 python3.14-freethreading-3.14.7-2.el9_8.i686.rpm 3136c28c04c9d492f895ab8706eb8d0098ed8e73881b7921aab135eacdc8ee4d python3.14-freethreading-idle-3.14.7-2.el9_8.x86_64.rpm 36c995df8ccb572bf6142c55eed1777dd78eb1b2db27626fbea739f9c784d628 python3.14-3.14.7-2.el9_8.i686.rpm 4207de4c0baa33122a6ec64d01f2c6291b8fbc6079f22b699fee020b106685be python3.14-freethreading-tkinter-3.14.7-2.el9_8.i686.rpm 4965789c3e3e4dbf78ad896c1337cdd41cef8a2be839bc06bc67eb61b3b5f617 python3.14-freethreading-tkinter-3.14.7-2.el9_8.x86_64.rpm 74db6c3d9dad2898dd70ed2af6d562bd3520c2ee28a8b1c457e34166b6a73b92 python3.14-test-3.14.7-2.el9_8.i686.rpm 764ecb7301a5fc895ffa25c83c01ba80c2823b98b19f8e2e0e809c4577a1ab40 python3.14-debug-3.14.7-2.el9_8.i686.rpm 78f8848dc9b6e92c62932d1bf08157d58fb0d7b355330322e6b32ec706bb93f7 python3.14-freethreading-libs-3.14.7-2.el9_8.x86_64.rpm 83f8ad086f1497f0ea387681ff028c8a052fe43cb599dbbc5b5ab85f1ed9c62c python3.14-freethreading-devel-3.14.7-2.el9_8.x86_64.rpm 8af42cc34ce6508269c36e35501ebe0e4a2d095df9dcbdddc7b7741f890ce736 python3.14-freethreading-debug-3.14.7-2.el9_8.i686.rpm ba052b9405b174b2093ac9425d2f26b7f319a3e69caa16a806bce3067f6de062 python3.14-freethreading-test-3.14.7-2.el9_8.x86_64.rpm bc67f4f7ddfe9578b3ab0ebb0d816ec15cbfc9655a4be0392c8b82272394c831 python3.14-freethreading-test-3.14.7-2.el9_8.i686.rpm bec91056c56e794ebdece94ba8f945f514b0e5cbdd12686868fe3d7e06c09218 python3.14-idle-3.14.7-2.el9_8.i686.rpm d053c80c7bd84e1f6d858e1425d21a834bcf6fd9e2fb3260c8de5b3abe551595 python3.14-freethreading-debug-3.14.7-2.el9_8.x86_64.rpm e0cd9e7851b1721a0c3ccd5236842e66f5039234c216aeb762f72f591ebcedf4 python3.14-debug-3.14.7-2.el9_8.x86_64.rpm f1cffa58b1e943dae3ddd13203b1279f624caa1f31e8631f8d2c8c062ea5e5cb python3.14-idle-3.14.7-2.el9_8.x86_64.rpm fd217e73c5cc19c95f16e696134c20bd4c60f9b7febc06c001d904f84c11baa9 python3.14-freethreading-devel-3.14.7-2.el9_8.i686.rpm ff042457fdfbcaed1e19cfb08bd3d73aa474fe4502bc82eedf8b76089fb3e480 ALSA-2026:59009 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.12-debug-3.12.14-1.el9_8.i686.rpm 006a089aa111ee1978bde33fefc9d404de4fe1e067541266d850da2d07cd34f9 python3.12-3.12.14-1.el9_8.i686.rpm 0ba1ac55ad622e2d73005dae1ef017334d0dd41f6addab35fe61f500d7bb18e5 python3.12-idle-3.12.14-1.el9_8.i686.rpm 2314642367d9a3961573bd94d12ef5cb1989b498532c6d8146cda0c3ad76c9c0 python3.12-test-3.12.14-1.el9_8.i686.rpm 5fde87161be3ae5961e36f9ff6c46ce80b448b7535b4d5607445736000b1a4da python3.12-tkinter-3.12.14-1.el9_8.i686.rpm 973b5a7a9a721429832e796b919453b7e02a5f96a7c3b5099249414fee706f08 python3.12-debug-3.12.14-1.el9_8.x86_64.rpm a4ce4abc623c2b5c21853a33c32911ad7d16390245e6d588025cb8f15dda7714 python3.12-test-3.12.14-1.el9_8.x86_64.rpm c879f27a315351960b5ebd63da61df0dbcdc7413560eed243851b0bc6f6e80c1 python3.12-idle-3.12.14-1.el9_8.x86_64.rpm e25bd9c36ede1a844cd46b429e058193ce8a17608710983bf6e48cb08f98ab31 ALSA-2026:59362 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) * nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.5.alma.1.x86_64.rpm d2b472a21aacefc147c00d0e772a2a56930f447e780f4693f83525ca40c18f47 ALSA-2026:59723 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CVE-2025-68211) * kernel: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CVE-2026-23003) * kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114) * kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924) * kernel: netfilter: xt_policy: fix strict mode inbound policy matching (CVE-2026-52920) * kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185) * kernel: netfilter: require Ethernet MAC header before using eth_hdr() (CVE-2026-53131) * kernel: netfilter: conntrack_irc: fix possible out-of-bounds read (CVE-2026-53268) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189) * kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277) * kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276) * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) Bug Fix(es) and Enhancement(s): * [AlmaLinux-9.8.z] Intel CWF: CPU is unable to obtain cstate1 on idle system (JIRA:AlmaLinux-166118) * ss core dumped when there is an SCTP session [almalinux-9.8.z] (JIRA:AlmaLinux-212398) * [IBM 9.9 FEAT] zcrypt driver overwrite function - kernel part [almalinux-9.8.z] (JIRA:AlmaLinux-245333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.42.1.el9_8.x86_64.rpm 2e111a03b721cdd9b7c1cad4a58645769c710705f7029644f1cce835d307d47d kernel-tools-libs-devel-5.14.0-687.42.1.el9_8.x86_64.rpm 4b2bafda87f4c8c1ab12265d8e1c7aee1eb0c8ee584f145419569e4215d93ad5 libperf-5.14.0-687.42.1.el9_8.x86_64.rpm 82212b0526bb986c3bfdb9ea66be964b83e71c7800ebae50d56e32713795f19f ALSA-2026:6004 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary code execution via heap out-of-bounds write in RLE planar decode path (CVE-2026-26965) * freerdp: FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline (CVE-2026-26955) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.3.i686.rpm 13e88e61ddb960693c970fee94480a78be5c5f43c376c8d1c31e0a0db6ce7f22 freerdp-devel-2.11.7-1.el9_7.3.x86_64.rpm 2474f6f1569e9ec2c1b39f5efbd20fb167c206c371d891719f90b92bd1733787 libwinpr-devel-2.11.7-1.el9_7.3.x86_64.rpm 64cbe557d43cea9018f9f6dc36699ac8d4f17faa05744e0510dbc40912f6e427 freerdp-devel-2.11.7-1.el9_7.3.i686.rpm beeaaa2feda8690e021f23db029cc461322f11e8a1b2d5f608bacffe4ec9d3da ALSA-2026:61316 Copyright 2026 AlmaLinux OS 0 1 Important

xmlrpc-c security update

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML. Security Fix(es): * xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component (CVE-2026-15928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xmlrpc-c-c++-1.51.0-17.el9_8.x86_64.rpm 1675574e3ab3eef2f690dcd4c5e7a794aaeee447e7f13c4e32d58540f2bda7af xmlrpc-c-client++-1.51.0-17.el9_8.x86_64.rpm 24786989ed2360611b6a3253ba1670f2418927a0c26e543583a7899962c8c9bd xmlrpc-c-devel-1.51.0-17.el9_8.x86_64.rpm 6010d20c346f82a8d12579e1eea78b391ef366404897e68024895c16702997ce xmlrpc-c-client++-1.51.0-17.el9_8.i686.rpm 77907eedb6aecfffdd799c497db9e4c01c5054a6b9919648b1bc8ae4d3e624ed xmlrpc-c-devel-1.51.0-17.el9_8.i686.rpm dcef6c8f6b5d8fa86aab3e31f868ee8dacdd4ad2ca1c68bad048b7022202b2a3 xmlrpc-c-c++-1.51.0-17.el9_8.i686.rpm e45295e6f4bcbd4eba7b27924b05a3d0d4fefba5b5bf0fb6b29b0305deb6a2f9 ALSA-2026:61379 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP update orders (CVE-2026-67301) * FreeRDP: FreeRDP: Denial of Service via crafted smartcard cache requests (CVE-2026-67288) * FreeRDP: FreeRDP: Denial of Service via heap out-of-bounds read (CVE-2026-67291) * FreeRDP: FreeRDP: Heap-buffer-overflow allows arbitrary code execution via crafted RPC response (CVE-2026-55194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.6.i686.rpm 44a83549ea03ca1e6201c5196fa2b4110fe58fb98e3be82dd34122221140670a freerdp-devel-2.11.7-7.el9_8.6.x86_64.rpm 5a182e7a1500328b8957e9e9264850b58c056580e099fdce4fe8c7b18c071cdd freerdp-devel-2.11.7-7.el9_8.6.i686.rpm a068fc9b944fa920662d8a935e2a9453ea5324f21c6af9b6ce672a55702efa17 libwinpr-devel-2.11.7-7.el9_8.6.x86_64.rpm f6d5e4e03c0af507758d3fbeb52246d7df43f7216f50ca7f3b3e0d91684ae9b1 ALSA-2026:6153 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (CVE-2025-40096) * kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure (CVE-2026-23144) * kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution (CVE-2026-23171) * kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CVE-2026-23193) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (CVE-2026-23209) * kernel: net/sched: cls_u32: use skb_header_pointer_careful() (CVE-2026-23204) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.45.1.el9_7.x86_64.rpm 20600d0a13cb4e54f7fefdff36ae0573d65df1e7fa3ea87f7f2a4264cd305621 kernel-cross-headers-5.14.0-611.45.1.el9_7.x86_64.rpm 29e69c376344ac34ed599ca9274c4c36e82487b5f1fdcbfff793e582c339f2c9 libperf-5.14.0-611.45.1.el9_7.x86_64.rpm db82ffee21d29ccd2f5649246ad9d27df9ed41d0a49df6cde54eb2a3a42176a0 ALSA-2026:62170 Copyright 2026 AlmaLinux OS 0 1 Important

gegl04 security update

GEGL (Generic Graphics Library) is a graph-based image processing framework. Security Fix(es): * gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing (CVE-2026-18300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gegl04-devel-0.4.62-1.el9_8.2.x86_64.rpm 24e49929a63654f6809e5024087c8ac996e685ae7af8327d2088ee9963bbb279 gegl04-devel-0.4.62-1.el9_8.2.i686.rpm fbc432a12eb422f615a2b290626d4b35b4dd7060efb31020a42b032226a60d2a ALSA-2026:6285 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.12-tkinter-3.12.12-4.el9_7.2.i686.rpm 196f5c691262ab9c812b7df64a824ac1dd0fa3c2d51b57fa8e7a122196283928 python3.12-test-3.12.12-4.el9_7.2.x86_64.rpm 1ea9b391329226e7707f45b7c5af2ee3ed4203bf3960f632b89c07308bf133cc python3.12-idle-3.12.12-4.el9_7.2.x86_64.rpm 2457b16d4b6071f20622890ef52dfcb5749d2528236e763829c5ad5188a27fc4 python3.12-idle-3.12.12-4.el9_7.2.i686.rpm 3ac25485be8ba20a669da36426d14384e6402e3643fbbe1a3b931e69dff459a8 python3.12-test-3.12.12-4.el9_7.2.i686.rpm 467848b6928145cdd851da47b94a917e8500ef249c8e9de85f742f6a5fc59d2e python3.12-debug-3.12.12-4.el9_7.2.i686.rpm 65eb7fdc797742cf7a39e9d228f1811b3250cd1ba56f2fc11d045ec203f97c7f python3.12-debug-3.12.12-4.el9_7.2.x86_64.rpm 8e37ae89b611ad2e20eb42b027c46cd579abed3a2fe09b29b0208492c34fb50e python3.12-3.12.12-4.el9_7.2.i686.rpm 9bee3c5ceee7d3ea56ccdf40997137ceccec3f324d28b331026a05db22a12f3b ALSA-2026:6286 Copyright 2026 AlmaLinux OS 0 1 Important

python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3.11-debug-3.11.13-5.2.el9_7.x86_64.rpm 0a1e2cbc523f1418b1240a3394303d8b733667c2b762391c6e91aa7e60857b40 python3.11-idle-3.11.13-5.2.el9_7.i686.rpm 6e118fb87e984166379c25c4e10689d4df2346261eb29ae8bfc782504bc54272 python3.11-idle-3.11.13-5.2.el9_7.x86_64.rpm 93a81c894d38b73f5e05c9a3f3fc3472224b963fb0473ed4c1dc26a395b20190 python3.11-tkinter-3.11.13-5.2.el9_7.i686.rpm 96121e24310ab32157a4e5fc1fac6ff5e9b6605ccd5b6be91ad4ad78e85a57b0 python3.11-test-3.11.13-5.2.el9_7.i686.rpm aba5505f8167656d094e66ba606e71897b77540bd4d720827dbdddf9490e8c46 python3.11-debug-3.11.13-5.2.el9_7.i686.rpm de9868356f7afebfdcdec5c57104c126f6dcb4aa528ddd5df6e7869308d03c83 python3.11-3.11.13-5.2.el9_7.i686.rpm f388baf908dc8eb44fd059dba7804530010907d6435809e299870eefa96f0d03 python3.11-test-3.11.13-5.2.el9_7.x86_64.rpm f405eda6cd4509a29d1e248a033206737bdd4981280e8b464b2bdf42fd822f65 ALSA-2026:6300 Copyright 2026 AlmaLinux OS 0 1 Important

gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920) * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082) * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085) * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921) * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922) * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.i686.rpm 19d4b6a6bf87bad3eab00d30e7994dc8b021ad8ce7a275a64b47ce513163bf80 gstreamer1-plugins-bad-free-devel-1.22.12-5.el9_7.x86_64.rpm e2f0058a13c6b7eac8d6824302030fbc4950e91bb5e408e1bae5a7687b3f95de ALSA-2026:63129 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: smc: Fix use-after-free in __pnet_find_base_ndev() (CVE-2025-40064) * kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd (CVE-2025-71147) * kernel: bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CVE-2026-45970) * kernel: smb/client: fix out-of-bounds read in symlink_data() (CVE-2026-46185) * kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073) * kernel: pNFS: Fix use-after-free in pnfs_update_layout() (CVE-2026-63800) * kernel: nfsd: fix posix_acl leak on SETACL decode failure (CVE-2026-53397) * kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808) * kernel: nfsd: release layout stid on setlease failure (CVE-2026-53399) * kernel: NFSv4/flexfiles: reject zero filehandle version count (CVE-2026-53392) * kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824) * kernel: NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CVE-2026-53391) * kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886) * kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002) * kernel: net: mana: validate rx_req_idx to prevent out-of-bounds array access (CVE-2026-64018) * kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887) * kernel: smb: client: fix query directory replay double-free (CVE-2026-64387) * kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268) * kernel: crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (CVE-2026-64438) * kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304) * kernel: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CVE-2026-64298) * kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490) * kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480) * kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation (CVE-2026-68166) * kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145) * kernel: locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CVE-2026-72069) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) Bug Fix(es) and Enhancement(s): * [AlmaLinux 9] TPM becomes completely unresponsive and requires a full reboot to clear [almalinux-9.8.z] (JIRA:AlmaLinux-213940) * RT scheduler livelock caused by missing backport of 94894c9c477e [almalinux-9.8.z] (JIRA:AlmaLinux-240634) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.44.1.el9_8.x86_64.rpm 6d641e543b758cc4636250edf8d46392188b3207d2b6c5f1e01dfaa7798dc226 libperf-5.14.0-687.44.1.el9_8.x86_64.rpm bb0b715568bfcf3c861d367cea120d0b04202b20ba53259b588ec2fbd62e9f5b kernel-cross-headers-5.14.0-687.44.1.el9_8.x86_64.rpm d6adfddf5a0047240d8d2cf1bceaeca185b1d146694e63877709e61c071d959d ALSA-2026:6340 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-after-free (CVE-2026-22856) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854) * freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852) * freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732) * freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676) * freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491) * freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948) * freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684) * freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681) * freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683) * freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679) * freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675) * freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.5.x86_64.rpm 8c2ecb7f999851111c2101702fc34f0f6d958426c736221983820ce9953644ff freerdp-devel-2.11.7-1.el9_7.5.x86_64.rpm 92c0907e4fd839ffc6e70d95bf544cad44a9d11eaafe0cbd13dadfc83be070c5 freerdp-devel-2.11.7-1.el9_7.5.i686.rpm af80f437fbf96a43bc2cd9735ecdcfcd26126a1213db3349885a1f6fd500c78f libwinpr-devel-2.11.7-1.el9_7.5.i686.rpm e1d2139cd9ed228e6a810c4ede0e9d3ddece7a9765ff18efb9c34650c6b56510 ALSA-2026:64784 Copyright 2026 AlmaLinux OS 0 1 Critical

389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() (CVE-2026-18355) * 389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (CVE-2026-18453) * 389-ds-base: 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property (CVE-2026-18922) * 389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN (CVE-2026-76560) * 389-ds-base: 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS (CVE-2026-78701) Bug Fix(es) and Enhancement(s): * lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [almalinux-9.8.z] (JIRA:AlmaLinux-244467) * fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [almalinux-9.8.z] (JIRA:AlmaLinux-248766) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default 389-ds-base-devel-2.8.0-10.el9_8.x86_64.rpm 6a2bed529970f7fad9efdcd9b4a22fc8f499f259724d84f49aed274efe6770b9 ALSA-2026:64800 Copyright 2026 AlmaLinux OS 0 1 Moderate

glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default glib2-static-2.68.4-19.el9_8.10.x86_64.rpm 4f842911e3cee0feb05f9a47ffde8cd8757a60b0ad049b97c6fe82df7fc56484 glib2-static-2.68.4-19.el9_8.10.i686.rpm 9d37a731a1c98d9ed245e058fae1e8a267a17157280428442a342811e986cc0a ALSA-2026:64808 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004) * kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933) * kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000) * kernel: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CVE-2026-64136) * kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320) * kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319) * kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287) * kernel: smb: client: fix change notify replay double-free (CVE-2026-64384) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.45.1.el9_8.x86_64.rpm 06e572313375f3c0e07b15760e2f65f94d7c44ba70905fe3d911bd6310cd4515 kernel-cross-headers-5.14.0-687.45.1.el9_8.x86_64.rpm 628d4f90ceff62f888f198dcf0f3e0a1374f3f0072370665d4701be9bc88d7c7 libperf-5.14.0-687.45.1.el9_8.x86_64.rpm 7fd86ffb2876b196734e9d56c65b448105a07592d8302b3be12a03982c1a30ed ALSA-2026:6570 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service (CVE-2025-38109) * kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111) * kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild (CVE-2026-23210) * kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() (CVE-2026-23231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libperf-5.14.0-611.47.1.el9_7.x86_64.rpm 51cfb7df7afe7439a4be6cef2c99afba30136fa8263758b193a95563a3e678ec kernel-tools-libs-devel-5.14.0-611.47.1.el9_7.x86_64.rpm 948525097aa9c87416d4b656c848c41c805b0f101da8d102f7b0660b38a7a92e kernel-cross-headers-5.14.0-611.47.1.el9_7.x86_64.rpm f4a59da96a21b8c4a02e5ac5015a820b04b347099772ca9a3b6a2feb48ef5f9d ALSA-2026:65993 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qt: Qt: Denial of Service via out-of-bounds read in text codec handling (CVE-2026-9499) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.1.i686.rpm 90f1de551e54c490ffa0a0123f96eee0c432adb66cbeb396cdeb6a02744739ab qt5-qtbase-static-5.15.9-11.el9_8.1.x86_64.rpm f8ce48ffa103af8c49d72a913a273ddddb00d151976d0b90989e61142468eadc ALSA-2026:66180 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CVE-2026-43133) * kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339) * kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493) * kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015) * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266) * kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306) * kernel: Revert "net/smc: Introduce TCP ULP support" (CVE-2026-46330) * kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002) * kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223) * kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275) * kernel: ipv4: account for fraggap on the paged allocation path (CVE-2026-53366) * kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034) * kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563) * kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597) * kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129) * kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480) Bug Fix(es) and Enhancement(s): * KSM to deduplicate only zero pages [almalinux-9.8.z] (JIRA:AlmaLinux-249161) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.46.1.el9_8.x86_64.rpm 0bc1cb47bdac04bc2a0a5d8ded2cf5ff41e302f13aa8d9f1f5f8d554d1552a2c libperf-5.14.0-687.46.1.el9_8.x86_64.rpm 4f5be0375b625bfc934c1c62ee468a0d8f92c5dc8317e3970438eea9359786be kernel-tools-libs-devel-5.14.0-687.46.1.el9_8.x86_64.rpm df5a38f636d58d7cf255b0cf4bdd3535fe30ca89fe18b1e8839bad69518ad1db ALSA-2026:6628 Copyright 2026 AlmaLinux OS 0 1 Important

fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Remote Code Execution via malicious SFD file parsing (CVE-2025-15270) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default fontforge-20201107-8.el9_7.i686.rpm e4175e11ec2faf07dc03ad780def54ba0fa67ec119957af1a390eca98a7d7c84 fontforge-20201107-8.el9_7.x86_64.rpm eb3cc023ef4539cd1f3aa8e3520859e6d437f4565192b82044302162ffde8feb ALSA-2026:66347 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway (CVE-2026-55193) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freerdp-devel-2.11.7-7.el9_8.7.x86_64.rpm 081d6ccf9c42ba3bd2439659d8d38fa1498f4bb7741156de47ced5721a0dc087 freerdp-devel-2.11.7-7.el9_8.7.i686.rpm 81973cc5e4f91ac26baa3d6fb94ca1bb5c548c09ac6aed36c0784db3b70057bb libwinpr-devel-2.11.7-7.el9_8.7.i686.rpm 97092000cfee1fae1388fdf92b06b0ce8fb420bb615067e37edb81f8adc1f2c0 libwinpr-devel-2.11.7-7.el9_8.7.x86_64.rpm eef515501772e5de4424f2427b0fc2b721015c651ccabf5bcbc67a76847dda91 ALSA-2026:66542 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nginx-mod-devel-1.20.1-28.el9_8.6.alma.1.x86_64.rpm 9834479f0fb1979fb0647f02c4ebe412f5e12f05910413ec7d92d7d597fb56b4 ALSA-2026:67150 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset (CVE-2025-68745) * kernel: drm/xe: Open-code GGTT MMIO access protection (CVE-2026-23466) * kernel: drm/xe: always keep track of remap prev/next (CVE-2026-31479) * kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566) * kernel: drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CVE-2026-31656) * kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692) * kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response (CVE-2026-43334) * kernel: drm/i915: Fix potential overflow of shmem scatterlist length (CVE-2026-43368) * kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370) * kernel: Bluetooth: serialize accept_q access (CVE-2026-52918) * kernel: sctp: diag: reject stale associations in dump_one path (CVE-2026-52917) * kernel: net: pull headers in qdisc_pkt_len_segs_init() (CVE-2026-53091) * kernel: iommu/amd: Fix clone_alias() to use the original device's devid (CVE-2026-53053) * kernel: Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CVE-2026-53072) * kernel: net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (CVE-2026-52947) * kernel: Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CVE-2026-53256) * kernel: wifi: nl80211: reject oversized EMA RNR lists (CVE-2026-53182) * kernel: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CVE-2026-53209) * kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (CVE-2026-53246) * kernel: Bluetooth: RFCOMM: validate skb length in MCC handlers (CVE-2026-53254) * kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (CVE-2026-63801) * kernel: scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CVE-2026-63889) * kernel: sctp: fix race between sctp_wait_for_connect and peeloff (CVE-2026-63971) * kernel: Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CVE-2026-63975) * kernel: Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CVE-2026-63947) * kernel: Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CVE-2026-63944) * kernel: Bluetooth: ISO: fix UAF in iso_recv_frame (CVE-2026-63946) * kernel: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CVE-2026-63945) * kernel: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (CVE-2026-64117) * kernel: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (CVE-2026-64037) * kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113) * kernel: wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (CVE-2026-64255) * kernel: wifi: mac80211: fix MLE defragmentation (CVE-2026-64515) * kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086) * kernel: Linux kernel: Wi-Fi subsystem out-of-bounds read via crafted frames (CVE-2026-68402) * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376) * kernel: wifi: cfg80211: validate PMSR FTM preamble range (CVE-2026-68406) * kernel: tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (CVE-2026-68117) * kernel: sctp: auth: verify auth requirement when auth_chunk is NULL (CVE-2026-68300) * kernel: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (CVE-2026-68264) * kernel: sctp: validate stream count in sctp_process_strreset_inreq() (CVE-2026-68315) * kernel: dm-verity: fix buffer overflow in FEC calculation (CVE-2026-72098) Bug Fix(es) and Enhancement(s): * gfs2: Various xfstests fixes [almalinux-9.8.z] (JIRA:AlmaLinux-178219) * rtla-timerlat-top doesn't stop properly when threshold is reached on multiple CPUs at once [almalinux-9.8.z] (JIRA:AlmaLinux-193025) * qede: build_skb failure causes off-by-one BD ring corruption and kernel panic [almalinux-9.8.z] (JIRA:AlmaLinux-193050) * Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [almalinux-9.8.z] (JIRA:AlmaLinux-224489) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.47.1.el9_8.x86_64.rpm 0e12b84c0c9a620b3c25bac9526dba3887ad93b8ecb15b5e17965d6e191a5ce3 libperf-5.14.0-687.47.1.el9_8.x86_64.rpm 27c1aa7db2a51c0713dc9668f8cbb373512e414e1069445031437427d83e55ad kernel-tools-libs-devel-5.14.0-687.47.1.el9_8.x86_64.rpm acb593a8cf120580a034b672bc18c6175d3f0c5fc27f31f2c8a39be3813fd4a9 ALSA-2026:67470 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: vhost: move vdpa group bound check to vhost_vdpa (CVE-2026-43248) * kernel: security/keys: fix missed RCU read section on lookup (CVE-2026-64015) * kernel: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (CVE-2026-63923) * kernel: Linux kernel SLIP: Out-of-bounds write due to race condition during MTU change (CVE-2026-68143) * kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294) * kernel: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (CVE-2026-72045) * kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556) Bug Fix(es) and Enhancement(s): * gfs2: bufdata leaks [almalinux-9.8.z] (JIRA:AlmaLinux-178223) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.48.1.el9_8.x86_64.rpm 6901b102319dd4f7e9d00f31788c431e54feb2755efe2c0e5a34c4a8484d2a2f kernel-tools-libs-devel-5.14.0-687.48.1.el9_8.x86_64.rpm 7e065053fd22935f62f82bb1b69a84f6d785edd32daf95fdaefb50cdbede818c libperf-5.14.0-687.48.1.el9_8.x86_64.rpm fe82be513ab6234293375648157484961eda47b4b39bd05041a442a205b31709 ALSA-2026:67524 Copyright 2026 AlmaLinux OS 0 1 Moderate

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.131 Runtime version: 8.0.31 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.131 and Runtime 8.0.31 [almalinux-9.8.z] (JIRA:AlmaLinux-252247) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.131-1.el9_8.x86_64.rpm a35c9f45aa1f8a688b0df6cead83dc7644d8e6a28d1c8af8a11a5a967ffd40ef ALSA-2026:67613 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.112 Runtime version: 10.0.12 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.112 and Runtime 10.0.12 [almalinux-9.8.z] (JIRA:AlmaLinux-252319) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.112-1.el9_8.x86_64.rpm 95d71b84c24b356325f0d385a01b35962cab63c0c60efbc8532c756b85d74d2d ALSA-2026:67614 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.121 Runtime version: 9.0.20 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet8.0: .NET Information Disclosure Vulnerability (CVE-2026-58649) * dotnet10.0: dotnet9.0: .NET Elevation of Privilege Vulnerability (CVE-2026-69806) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.121 and Runtime 9.0.20 [almalinux-9.8.z] (JIRA:AlmaLinux-252278) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.121-1.el9_8.x86_64.rpm 7ae6187d5411caea47a25382f846bc73bd0700a37fdf77aef079c059b64e567b ALSA-2026:6766 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default python3-test-3.9.25-3.el9_7.2.i686.rpm 15f0355871f27a5722e4f46eda1685d83ad8bcb9b9a344c7af2894c7cb757e58 python3-debug-3.9.25-3.el9_7.2.i686.rpm 2966152e533e99ef7edddc1d745b83743519b2a3f80265a796e35349a686ed06 python3-test-3.9.25-3.el9_7.2.x86_64.rpm 573a59e860abe2744b7f735c663144a29cbb67dad529e5587e4c08cc5fe30927 python3-debug-3.9.25-3.el9_7.2.x86_64.rpm 6016e775ac23d7c7eb9afb0de5143978111e62e791a5176e8300980e215fe313 python3-idle-3.9.25-3.el9_7.2.x86_64.rpm 6b650bbddb179c445bb5bc1c2903d6c9c5c7d6e84214d97983b9eb877c54cac8 python3-3.9.25-3.el9_7.2.i686.rpm 81d3d879e2d0aa3562b556c214936445d9ecbd18cbbb50a5570972593b86c90b python3-tkinter-3.9.25-3.el9_7.2.i686.rpm 892b5634225c4aff619062c241585b965850a473e150cf1287a171d28613a0e6 python3-idle-3.9.25-3.el9_7.2.i686.rpm d585966501c9afb5e0034c2e7a9dc2381f105c58f64d604646c53bde3f105186 ALSA-2026:67831 Copyright 2026 AlmaLinux OS 0 1 Important

tesseract security update

A commercial quality OCR engine originally developed at HP between 1985 and 1995. In 1995, this engine was among the top 3 evaluated by UNLV. It was open-sourced by HP and UNLV in 2005. Security Fix(es): * tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata (CVE-2026-73066) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default tesseract-devel-4.1.1-8.el9_8.i686.rpm 51cd5578785c781f96e1223310de50f64cfc027376c0e9b8a1b9e4b9eed7999b tesseract-devel-4.1.1-8.el9_8.x86_64.rpm a28ee9f7ec86caeeb4626896963ae0dd308dd51e6f411c4f5691c1f2ede969c0 ALSA-2026:67873 Copyright 2026 AlmaLinux OS 0 1 Important

corosync security update

The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software. Security Fix(es): * corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly (CVE-2026-81665) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default corosync-vqsim-3.1.10-1.el9_8.2.x86_64.rpm da3a9b23a4df99a04ebc500e1e2672dfdf533dd301dd65f084e6b219f0c8ab4b ALSA-2026:68292 Copyright 2026 AlmaLinux OS 0 1 Moderate

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.6.x86_64.rpm e8a23bc907f924bd988856eaa2311d3bfe9405f8ebb5fbd74a428e481fcbb407 unbound-devel-1.24.2-3.el9_8.6.i686.rpm f9841d0927de5e6c251e6f19e545c489ac05c1a66ef582a6118634489c466a78 ALSA-2026:68570 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow (CVE-2026-23172) * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910) * kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043) * kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133) * kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114) * kernel: net: ena: PHC: Fix potential use-after-free in get_timestamp (CVE-2026-52971) * kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CVE-2026-53176) * kernel: ALSA: timer: Forcibly close timer instances at closing (CVE-2026-53193) * kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ALSA: timer: Fix UAF at snd_timer_user_params() (CVE-2026-53192) * kernel: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (CVE-2026-63869) * kernel: ALSA: seq: Serialize UMP output teardown with event_input (CVE-2026-64029) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913) * kernel: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (CVE-2026-64176) * kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (CVE-2026-64174) * kernel: wifi: iwlwifi: mld: stop TX during firmware restart (CVE-2026-64175) * kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582) * kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159) * kernel: Linux kernel: ALSA timer use-after-free vulnerability allows privilege escalation (CVE-2026-68200) * kernel: Linux kernel (ice): Denial of Service via out-of-range ptype in VIRTCHNL (CVE-2026-68128) * kernel: Linux kernel: ath9k Wi-Fi driver use-after-free vulnerability leading to system crash (CVE-2026-68363) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: dm_early_create: fix freeing used table on dm_resume failure (CVE-2026-72102) * kernel: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (CVE-2026-72298) * kernel: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (CVE-2026-72003) * kernel: selinux: check connect-related permissions on TCP Fast Open (CVE-2026-72243) Bug Fix(es) and Enhancement(s): * gfs2: filesystem withdrawal rework [almalinux-9.8.z] (JIRA:AlmaLinux-252540) * The slab cache entries for gfs2 and dlm grow very large for gfs2 filesystems [almalinux-9.8.z] (JIRA:AlmaLinux-252544) * gfs2: Get rid of sd_async_glock_wait [almalinux-9.8.z] (JIRA:AlmaLinux-253986) * [AlmaLinux9.8z] watchdog: System panics during reboot when pretimeout is disabled (0) (JIRA:AlmaLinux-255217) * [usb/xhci] kdump on Arrow Lake systems hangs system with dracut-initqueue Timed out errors [almalinux-9.8.z] (JIRA:AlmaLinux-256733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.49.1.el9_8.x86_64.rpm 1762deab1a6ace984cf84e11004e019f73aa9aa45fd3e93ef841a2c8866ef1d2 kernel-tools-libs-devel-5.14.0-687.49.1.el9_8.x86_64.rpm 47e94de5e189a45948810c66c35a0f22b6976ff87ba33db0b5cf74cdec8e1b1f libperf-5.14.0-687.49.1.el9_8.x86_64.rpm 6cbf18ddc22caf575a4223f07d84f4a39b851a79aa65c058417855553e6d143f ALSA-2026:68786 Copyright 2026 AlmaLinux OS 0 1 Important

perl-Net-DNS security update

The perl-Net-DNS package contains a collection of Perl modules that act as a Domain Name System (DNS) resolver. It allows the programmer to perform DNS queries that are beyond the capabilities of the gethostbyname and gethostbyaddr routines. Security Fix(es): * perl-Net-DNS: Net::DNS: Denial of Service via unbounded recursion with misplaced TSIG records (CVE-2026-81928) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default perl-Net-DNS-Nameserver-1.29-6.el9_8.1.noarch.rpm 3dea2d596bfd0fb0be7ef382f57b66ad15cd1f6ae834a04a8214e6ea75c47492 ALSA-2026:69607 Copyright 2026 AlmaLinux OS 0 1 Important

postgresql security update

PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default postgresql-test-rpm-macros-13.23-6.el9_8.noarch.rpm 044ccbdab6973b9c28f68ec9d3f12e3ae4050a40b55a0bf43371a25d1afda6c9 postgresql-upgrade-devel-13.23-6.el9_8.x86_64.rpm 625023b308f568f7cface0d35bf15055adce18ef8fc294e006c83b7363de3abb postgresql-test-13.23-6.el9_8.x86_64.rpm 6c5ca3224799399868e3144d493f200454bd1148fe09c3f6e469052097ef5cfb postgresql-docs-13.23-6.el9_8.x86_64.rpm cf3482c242b1efff03cc667a2aa50d28b30b8c70800c87114e6470e21f561565 postgresql-static-13.23-6.el9_8.x86_64.rpm d411e935350e1a94f341b408dff762f0541418ed3fbaa288d413f6589f045fa7 postgresql-server-devel-13.23-6.el9_8.x86_64.rpm e354a2ad9d48a0080cba2326977a698ee70936c9669843dff8e8fd053a273c61 postgresql-private-devel-13.23-6.el9_8.x86_64.rpm e9e129beb5829248fc0240a928a2c247baad26d224bcff4aa4e57a601c34405c ALSA-2026:69608 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.4.i686.rpm a19115fc803868ab173583819ab9d0f82c302e97bbe305b5998f75b6b28dff78 openexr-devel-3.1.1-3.el9_8.4.x86_64.rpm f38dcf9828fae093e2e8317ab736044637e2704dba6bded286b056c8f35ceb32 ALSA-2026:7002 Copyright 2026 AlmaLinux OS 0 1 Important

nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654) * NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) * NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default nginx-mod-devel-1.20.1-24.el9_7.2.alma.1.x86_64.rpm 2ab2ea2196a883a85ffe63e364acca29819e66d98f977d13fff043689523b1f8 ALSA-2026:70459 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CVE-2025-39964) * kernel: iommu/vt-d: Clear Present bit before tearing down PASID entry (CVE-2026-45894) * kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CVE-2026-45959) * kernel: dm cache policy smq: fix missing locks in invalidating cache blocks (CVE-2026-53062) * kernel: keys: Pin request_key_auth payload in instantiate paths (CVE-2026-63823) * kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CVE-2026-68293) * kernel: Linux kernel: libceph null pointer dereference leads to denial of service (CVE-2026-68157) * kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios (CVE-2026-68188) * kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156) * kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155) * kernel: Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391) * kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072) * kernel: mm/hugetlb: fix list corruption in allocate_file_region_entries() (CVE-2026-74518) Bug Fix(es) and Enhancement(s): * [Intel 9.8 FEAT] ice: Driver Update [almalinux-9.8.z] (JIRA:AlmaLinux-213003) * AlmaLinux 9.8: Multiuser Kerberized DFS shares fail to mount with UID mount option [almalinux-9.8.z] (JIRA:AlmaLinux-254108) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-tools-libs-devel-5.14.0-687.50.1.el9_8.x86_64.rpm 4870f42793ba230185361844a8d5323c5b16e9423ea5ed0d1f7469c47203be69 kernel-cross-headers-5.14.0-687.50.1.el9_8.x86_64.rpm 76967a4b3bb6ba57ebb630f45723b36ca1c85464273d1936cd2ffa0fe7974066 libperf-5.14.0-687.50.1.el9_8.x86_64.rpm b917f22e4f80b3d82bb44228cc2449863bc51069a23ae0ad6eb79defdf0cb219 ALSA-2026:70564 Copyright 2026 AlmaLinux OS 0 1 Critical

ipa security, bug fix, and enhancement update

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otptoken-import hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238519) * host-mod: handle the password attribute when set with --setattr userpassword= [almalinux-9.8.z] (JIRA:AlmaLinux-238523) * ipa env: support only simple * wildcard [almalinux-9.8.z] (JIRA:AlmaLinux-238527) * ipa-epn: drop_privileges method is mixing uid and gid [almalinux-9.8.z] (JIRA:AlmaLinux-238674) * ipa-migrate: require Replication Administrator privilege [almalinux-9.8.z] (JIRA:AlmaLinux-238677) * ipa-migrate tool is renaming host records & host info in automount information [almalinux-9.8.z] (JIRA:AlmaLinux-240767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-ipatests-4.13.4-1.el9_8.noarch.rpm 06db0bac21c10e74e426e3f9d48fdfa4abcb65e373a0087a66db13989f728e6f ALSA-2026:71487 Copyright 2026 AlmaLinux OS 0 1 Critical

unbound security update

The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Unbound: Remote Code Execution Vulnerability in CNAME Synthesis (CVE-2026-82717) * unbound: Unbound: Heap buffer overflow via malicious DNSSEC response (CVE-2026-81634) * unbound: Unbound: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY (CVE-2026-81642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default unbound-devel-1.24.2-3.el9_8.8.i686.rpm 80ea5b80af3a6003cd1307776b2953095b21589a41076e8cf3e9dc823ee72dbc unbound-devel-1.24.2-3.el9_8.8.x86_64.rpm af48d757ff9e24ff561a52f43c141e3c21b2702cd3cf681ffa12c487c2262d90 ALSA-2026:71700 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323) * kernel: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (CVE-2026-31539) * kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204) * kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199) * kernel: drm/amdgpu/userq: fix access to stale wptr mapping (CVE-2026-46311) * kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912) * kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CVE-2026-53203) * kernel: drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CVE-2026-53290) * kernel: drm/virtio: use uninterruptible resv lock for plane updates (CVE-2026-64098) * kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121) * kernel: drm/amdgpu/vce: fix integer overflow in image size (CVE-2026-68108) * kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CVE-2026-68257) * kernel: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CVE-2026-68267) * kernel: drm/xe: Hold a dma-buf reference for imported BOs (CVE-2026-68266) * kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273) * kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714) Bug Fix(es) and Enhancement(s): * MADVISE i/o size in AlmaLinux 9 additionally limited by read_ahead_kb - Was addressed in AlmaLinux8 via AlmaLinux-22476 [almalinux-9.8.z] (JIRA:AlmaLinux-260938) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.52.1.el9_8.x86_64.rpm 23e926bc5ac0adb18eb537cd9a0a4b341ff8fd96c54810d716a404033f244b49 kernel-cross-headers-5.14.0-687.52.1.el9_8.x86_64.rpm 27404aec465a370d79ac56801d02a042a321705dcf4a89fd38e300eafe3beb92 kernel-tools-libs-devel-5.14.0-687.52.1.el9_8.x86_64.rpm 8861523346a6e8e44e0a66e982a5397574185c8755e9d9bb633059ca46c2eef9 ALSA-2026:72286 Copyright 2026 AlmaLinux OS 0 1 Important

ruby security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses (CVE-2026-80212) Bug Fix(es) and Enhancement(s): * ruby %check fails in Konflux: Rinda multicast tests need network device [almalinux-9.8.z] (JIRA:AlmaLinux-255606) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default ruby-doc-3.0.7-168.el9_8.noarch.rpm 562cb5d5786d01eedf9f00b70da58fe188ff6ae20423a3bb01536606f5fbb0f4 ALSA-2026:72623 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942) * kernel: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (CVE-2026-46325) * kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000 (CVE-2026-52972) * kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341) * kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875) * kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CVE-2026-64102) * kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556) * kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522) * kernel: perf: Reject exited events as group leaders (CVE-2026-74753) Bug Fix(es) and Enhancement(s): * KVM: s390: Limit adapter indicator access to mapped page [almalinux-9.8.z] (JIRA:AlmaLinux-188656) * crypto: xxhash64 should not be fips approved [almalinux-9.8.z] (JIRA:AlmaLinux-256437) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.53.1.el9_8.x86_64.rpm 0692c300e4628072ed9629c656b1103683395856a2f080539e8711ba277a5b33 libperf-5.14.0-687.53.1.el9_8.x86_64.rpm 3bc6781afd9ed7e68dccda14ba0b53b4cc1c99b8f91f1fabd6a2880086234291 kernel-tools-libs-devel-5.14.0-687.53.1.el9_8.x86_64.rpm be17c89e24fdd9e630fceac4b69bfb1523e4f4be6deda9b0128ecdb97509ae3f ALSA-2026:74370 Copyright 2026 AlmaLinux OS 0 1 Important

gvfs security update

GVFS is the GNOME Desktop Virtual File System layer that allows users to easily access local and remote data using File Transfer Protocol (FTP), Secure Shell File Transfer Protocol (SFTP), Web Distributed Authoring and Versioning (WebDAV), Common Internet File System (CIFS), Server Message Block (SMB), and other protocols. GVFS integrates with the GNOME I/O (GIO) abstraction layer. Security Fix(es): * gvfs: SFTP: heap-based buffer overflow in read_reply() (CVE-2026-84268) * gvfs: gvfs-admin socket ownership race permits local root (CVE-2026-88924) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default gvfs-1.48.1-8.el9_8.1.i686.rpm 698ca572923a53bdd29ee72edb8f47592896a1b61d806d41fcb23f205160b1b2 ALSA-2026:74424 Copyright 2026 AlmaLinux OS 0 1 Important

libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622) * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (CVE-2026-18917) Bug Fix(es) and Enhancement(s): * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018) * libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z] (JIRA:AlmaLinux-224986) * Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306) * allow hyperv pvpanic "device" to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libvirt-devel-11.10.0-12.7.el9_8.alma.1.x86_64.rpm 1fc5902c4897561bf72d6520e98633434463ca786907dac027e95a4b2df3a065 libvirt-daemon-plugin-sanlock-11.10.0-12.7.el9_8.alma.1.x86_64.rpm 4eb704a25afef3da9bc7976314961ac756b2386d0adb517188132dc02caae33e libvirt-docs-11.10.0-12.7.el9_8.alma.1.x86_64.rpm d12e27e534c0bdd88ac274c5d32ec65ab20b0f925501675a63a310deeaec2e82 ALSA-2026:74438 Copyright 2026 AlmaLinux OS 0 1 Moderate

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856) * kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794) * kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775) Bug Fix(es) and Enhancement(s): * Backport of protocol attribute to IP addresses (IFA_PROTO) [almalinux-9.8.z] (JIRA:AlmaLinux-169936) * try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [almalinux-9.8.z] (JIRA:AlmaLinux-269060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.54.1.el9_8.x86_64.rpm 426e6f1cde38538e222ecfdea329eeec646d70fc00cc894985fe66a58329a156 kernel-tools-libs-devel-5.14.0-687.54.1.el9_8.x86_64.rpm 85f702a096ec5656b20e5b0d872d8e917bc42b4c98975bd13ceadd92af582c82 ALSA-2026:74441 Copyright 2026 AlmaLinux OS 0 1 Important

libpcap security update

The libpcap packages provide a portable framework for low-level network monitoring. The libpcap library provides network statistics collection, security monitoring, and network debugging. Security Fix(es): * libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access (CVE-2026-0799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libpcap-devel-1.10.0-4.el9_8.1.x86_64.rpm ce0bc3dfdba4b8ae887a3614e07bdb4c8f0f42a486cb13f57f3d69b71e6d3f37 libpcap-devel-1.10.0-4.el9_8.1.i686.rpm d4710b06cedb030484d45a075a2ee95e9cf010b439fe659cf55ab77c3571c362 ALSA-2026:74457 Copyright 2026 AlmaLinux OS 0 1 Moderate

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: Heap buffer overflow via JPEG 2000 output adapter (CVE-2026-39919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default ghostscript-9.54.0-19.el9_8.1.i686.rpm 307e6ba69cc7aae6b5a5760c798846c45f784d7b28f75bc42da8a1f1ffedf6d1 libgs-devel-9.54.0-19.el9_8.1.i686.rpm 394dae5c9bf9852c482afa2579c461e2e9d7233d7300972daad275f6eeb80673 ghostscript-tools-fonts-9.54.0-19.el9_8.1.i686.rpm 3b6270e0042352508bfa8f7f6e6653ad790b9e01d3eb16d65a5f760d372e6d9d ghostscript-tools-printing-9.54.0-19.el9_8.1.i686.rpm 5c68cd187b4a7c11fcd480af11b36ef5c56cfffebb1d063e30749795bc40aca2 libgs-devel-9.54.0-19.el9_8.1.x86_64.rpm ca181ba95a4c5e095a635b2d85de177f2647c304e2f9d659066b4059fc7ad8be ALSA-2026:75578 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records (CVE-2026-81736) * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing (CVE-2026-81563) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind9.18-doc-9.18.29-14.el9_8.10.noarch.rpm 2a584dd14b6d4796d03568e01402b558f4448f3a260c0fbe0f2da4f13e48ce62 bind9.18-libs-9.18.29-14.el9_8.10.i686.rpm cd1c72425519844c98ce02933ee18ce4c8a2b102cd15bf5cd2fc2ae575889e91 bind9.18-devel-9.18.29-14.el9_8.10.x86_64.rpm d08d0a700db31dae1cdedfd70d84ec2b3a9d09fe59cd6705a5ba148921628295 bind9.18-devel-9.18.29-14.el9_8.10.i686.rpm df81c36579fc04ed684daa67cf335ae44af0ca955d3c07196688082b488e7c10 ALSA-2026:75673 Copyright 2026 AlmaLinux OS 0 1 Important

mariadb-connector-c security update

The MariaDB Native Client library (C driver) is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fix(es): * mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() (CVE-2026-44172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default mariadb-connector-c-doc-3.2.6-2.el9_8.noarch.rpm 671566d6bd00c1f50a91d7ed5d66397998ffbca21276a0e5a09e5b890c0c0190 mariadb-connector-c-test-3.2.6-2.el9_8.x86_64.rpm bdc70ecd9bee839fb6ee57aaea75745bda0d78231f354116d9d1231705ea88e2 ALSA-2026:75767 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling (CVE-2026-19667) * bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274) * bind: BIND: Denial of Service via malformed DNS64 responses (CVE-2026-19666) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind-devel-9.16.23-40.el9_8.10.i686.rpm 2df79d76e3e495a05318444217cf8261ce658cf46fdc579c8f76a2b4e1fc9a61 bind-devel-9.16.23-40.el9_8.10.x86_64.rpm 924f33ae1b4408ccb487a259172d47d597524a4eb141f3a0690f50f48d31f451 bind-libs-9.16.23-40.el9_8.10.i686.rpm bcbc11ce75c68df6c2f71baf0bca6d5cf71a144828cb62f26c64231659b32034 bind-doc-9.16.23-40.el9_8.10.noarch.rpm f8068bdfd6137ff02e78373df63feaebce8470dee4eb13f7308fcf3766182e8c ALSA-2026:7668 Copyright 2026 AlmaLinux OS 0 1 Important

nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libnghttp2-devel-1.43.0-6.el9_7.1.i686.rpm 3d982bc2796ec8a7f8dd88786426cc2acc61d103a88510c77e8f83381bb2b32f nghttp2-1.43.0-6.el9_7.1.x86_64.rpm b4ac3eee5283b085b0026bc342375b29081d94cf799e5219c62b484d21b07d06 libnghttp2-devel-1.43.0-6.el9_7.1.x86_64.rpm eb4cd1d327a188f72feefcf626cd257ee24f4f40501f28135e677cb0b2462c63 ALSA-2026:76733 Copyright 2026 AlmaLinux OS 0 1 Important

rust-rpm-sequoia security update

An implementation of the RPM PGP interface using Sequoia. Security Fix(es): * sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion (CVE-2026-42784) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default rpm-sequoia-devel-1.10.2.1-1.el9_8.x86_64.rpm c11d71f40c23ca014b67d2deebad0a0b6e59a1039c4d89168841e54cd73f5bd1 rpm-sequoia-devel-1.10.2.1-1.el9_8.i686.rpm ffa16ba3ae2f20338839cdd5a808e5d92517e43438ab42ee1c637e2edcb2b001 ALSA-2026:76755 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954) * FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964) * FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956) * FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963) * FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959) * FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libwinpr-devel-2.11.7-7.el9_8.8.i686.rpm 0edee1749e258e4451266a096beae15b24e6920f33d5a3186f655951c925333a freerdp-devel-2.11.7-7.el9_8.8.i686.rpm 708b7b175fbe16856ce717332bb11656f82a7ff8b82964a8be896dc0cf99e19d libwinpr-devel-2.11.7-7.el9_8.8.x86_64.rpm 731a63b45a1b0ef3e42c72c36cac808ee99d2bc56ceedf0be59bbfd2d57b5024 freerdp-devel-2.11.7-7.el9_8.8.x86_64.rpm f5dc398eb38d7b4f95f4ea5ede80f28bb7f1ab8bb7efca793b3c721d626e16ad ALSA-2026:77017 Copyright 2026 AlmaLinux OS 0 1 Important

python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.12-test-3.12.15-1.el9_8.x86_64.rpm 242c89d2125acb4e25db68b3bb70985e09ec419cfdceeda1a9dd90e84d806103 python3.12-idle-3.12.15-1.el9_8.i686.rpm 36a47dd566f36995b91959c105f03671f83d79b2a78c9e695c9f200ef152de16 python3.12-tkinter-3.12.15-1.el9_8.i686.rpm 3d6e62f534e9b8b189614cee9d4f27d4565b2b57542c347c5eaa393d80bef81f python3.12-3.12.15-1.el9_8.i686.rpm 5ba1d259aa0072cc77e0da861c0271700cfab033b72f79c3594da22a1a15deee python3.12-debug-3.12.15-1.el9_8.x86_64.rpm 7d6455fdaee749a1345a97f7edb42f4ea26c3e5c00529e9b28bbbb1570a05bb4 python3.12-debug-3.12.15-1.el9_8.i686.rpm b841f5aa8df454f1a640f4afde719e8f95fb6170f5107088f684e048abebbca9 python3.12-idle-3.12.15-1.el9_8.x86_64.rpm d3ebf1cb6dd7d9492e96794de9176419a1205d8a2a9b558ecf2856b7afd9e6db python3.12-test-3.12.15-1.el9_8.i686.rpm f7718d576896440530f313977c972d63a2eb05c78aab9c43fcb755c2f7dc9042 ALSA-2026:77021 Copyright 2026 AlmaLinux OS 0 1 Important

python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3.14-tkinter-3.14.8-1.el9_8.i686.rpm 0f5e673238216ae18ab4dfa5d33d64267a563e558deefaefa7d68c39a72cca85 python3.14-freethreading-libs-3.14.8-1.el9_8.x86_64.rpm 1ba2daffff22c1fc3fb411a9ba3f374c90dbd4633c044c00205ff928095ea055 python3.14-test-3.14.8-1.el9_8.i686.rpm 1ef31358e88697bf1a679386d4d7da3ea682970bc53f68a736bd8d8a1ecd2fcb python3.14-freethreading-tkinter-3.14.8-1.el9_8.i686.rpm 267fd3b18026b58b6fd100f877271a03dbe30bb723a9d597671794d056c8d26d python3.14-freethreading-devel-3.14.8-1.el9_8.i686.rpm 2e630d114533cde4fdb5686c665747133a61c7533fca6a9e44d3e6ad3549f64a python3.14-freethreading-tkinter-3.14.8-1.el9_8.x86_64.rpm 3eab3023a30753462a58682b5ab13bfa19d45653c7a1a7c1d35e8ef8c91c73c2 python3.14-freethreading-3.14.8-1.el9_8.i686.rpm 3ecdd3c439f3698000d84c5360a1af2d086534ceab2fbaf027219f3989624a26 python3.14-freethreading-libs-3.14.8-1.el9_8.i686.rpm 428661616f5898c0906e35573e3c4fb4f3401a48296038a084e2605ece448ddd python3.14-freethreading-idle-3.14.8-1.el9_8.i686.rpm 4aeb6f8c2f74e8bdc8177d772000a25af923d9bbf2c663494e9e49ad0d9a36b0 python3.14-freethreading-debug-3.14.8-1.el9_8.i686.rpm 56944c579b908c1f7e8bbdc1a0cbc056a9ba334642d9c5eab186d9ff24be4a1e python3.14-freethreading-test-3.14.8-1.el9_8.x86_64.rpm 593563b14f2b472bc68ea36ffad7d221e0f9a3a52a925a5491259202e5685fdc python3.14-freethreading-debug-3.14.8-1.el9_8.x86_64.rpm 67580f5489b00e01855dda4916cda8c4262c41e228c1d2fcfc1f91afa8b39746 python3.14-debug-3.14.8-1.el9_8.x86_64.rpm 77c75b7a59c29c5376fa24c508913281b7bc9a52ab598e659135b23937b89f51 python3.14-idle-3.14.8-1.el9_8.x86_64.rpm 7988adc410ffdd7959691ea870ce77b80c1a16bc510436778c5ba3ae6391a9ce python3.14-test-3.14.8-1.el9_8.x86_64.rpm 83dc7522e58e5a59fbe1bd75bc352ec1c09531da0e5fee7a42b7bdcac124a743 python3.14-freethreading-devel-3.14.8-1.el9_8.x86_64.rpm 8a456a6c48bbe94627263a2335236866aa75d9d3b9ad98215ddd44dc0d95414c python3.14-freethreading-3.14.8-1.el9_8.x86_64.rpm a280cefc949749e9145a8afab186107fd5db6411549ca1420b1610ef6df5bd55 python3.14-freethreading-test-3.14.8-1.el9_8.i686.rpm ba984217765bf60357c85639a795e5b219e80ec798613161a99fd00ff3b5348f python3.14-idle-3.14.8-1.el9_8.i686.rpm d9a573c3db41d4a3219d07acafa007d3a5a3b31f0f9342d859433817de332fab python3.14-3.14.8-1.el9_8.i686.rpm dd795390f63f0c29c58ea34ebd7673b7554153054df104540e07eaaf7096ba89 python3.14-freethreading-idle-3.14.8-1.el9_8.x86_64.rpm e4dad50aad267b6b4690d368a8a233e6e355c9bb42dcd8f85aca9bce543b7162 python3.14-debug-3.14.8-1.el9_8.i686.rpm e6ca35953403e67d855038ba62731224e1ab48b533d9732e6ff5a9b6c9b33237 ALSA-2026:77689 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipvlan: Make the addrs_lock be per port (CVE-2026-23103) * kernel: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (CVE-2026-53360) * kernel: vsock/virtio: fix zerocopy completion for multi-skb sends (CVE-2026-53365) * kernel: NFSD: Fix SECINFO_NO_NAME decode error cleanup (CVE-2026-53398) * kernel: vsock/virtio: bind uarg before filling zerocopy skb (CVE-2026-63970) * kernel: igc: set tx buffer type for SMD frames (CVE-2026-64035) * kernel: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (CVE-2026-64162) * kernel: vsock/vmci: fix UAF when peer resets connection during handshake (CVE-2026-64115) * kernel: SUNRPC: pin upper rpc_clnt across the TLS connect_worker (CVE-2026-72317) * kernel: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (CVE-2026-74744) * kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690) * kernel: nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669) * kernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530) * kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663) Bug Fix(es) and Enhancement(s): * "iavf: refactor iavf_clean_rx_irq to support legacy and flex descriptors" broke rx-vlan-offload on almalinux-9.7 [almalinux-9.8.z] (JIRA:AlmaLinux-169480) * [GNR-D] missing interfaces tspll_cfg (JIRA:AlmaLinux-183201) * AlmaLinux9.8z KVM guest panicked in vmmouse driver (JIRA:AlmaLinux-186577) * Add Epson RX8111 support to AlmaLinux9.9 [almalinux-9.8.z] (JIRA:AlmaLinux-212014) * RT scheduler livelock: migrate-disabled task at pushable-list head causes repeated RT push/stopper retries, starving a critical RT task (remaining issue after CVE-2026-45919 fix in 94894c9c477e) [almalinux-9.8.z] (JIRA:AlmaLinux-256279) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.56.1.el9_8.x86_64.rpm 508dbd1582635155ce5559723793e729376a94b14bd1dc523544efbd9f7ade02 kernel-tools-libs-devel-5.14.0-687.56.1.el9_8.x86_64.rpm a5197fdac34611ce33366d89fc8fe90cb38dd05a6a4cff972faeb84fdb588163 libperf-5.14.0-687.56.1.el9_8.x86_64.rpm b745ab0bed79caaa6d69342f52046817a60b09378559d8ee33c170ea52aed789 ALSA-2026:7915 Copyright 2026 AlmaLinux OS 0 1 Important

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default bind9.18-devel-9.18.29-5.el9_7.4.x86_64.rpm 207426042703160f6306b26e1368348bfe721d1577dc5f50ecd17866fcbc66bf bind9.18-libs-9.18.29-5.el9_7.4.i686.rpm 7585304e8fe4999660a0d28374e33f8ff8d8e23b1aa56c95787568246408bfc5 bind9.18-doc-9.18.29-5.el9_7.4.noarch.rpm 9e325df1d0aa41c0f14eb50dcf97f2fe6e998789cba551763a254703171afd2c bind9.18-devel-9.18.29-5.el9_7.4.i686.rpm ebe6df1d732685af357a8d62a35147108c765fe47988b7887d903dc3292ebc2b ALSA-2026:79281 Copyright 2026 AlmaLinux OS 0 1 Moderate

glibc security, bug fix, and enhancement update

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion (CVE-2026-6791) * glibc: glibc: Process abort due to invalid memory in wordexp (CVE-2026-6368) * glibc: Fix out-of-bounds array write in tdelete (CVE-2026-19542) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt (CVE-2026-77117) * glibc: Non-progress DoS in SHIFT_JISX0213 -&gt; UCS-4 conversion state (CVE-2026-80489) * glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string (CVE-2026-18374) Bug Fix(es) and Enhancement(s): * glibc: Stop shipping glibc32-debuginfo package (in debug channels) [almalinux-9] (JIRA:AlmaLinux-219516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default nss_hesiod-2.34-283.el9_8.i686.rpm 3a3a31ee01bd94cfabf6f719ab155b28cce0a87aa7e5c8daa25d1566080810f4 glibc-nss-devel-2.34-283.el9_8.x86_64.rpm 3b0d1e55c2b290ac6380e5cac1826d7a2a50aa52721d75d9a7fb55ef4d80fb70 nss_db-2.34-283.el9_8.x86_64.rpm 3ba53f9389bfa4e3ef1304555c856682a51ef0c5d3c2912be5cac178a964ee05 nss_hesiod-2.34-283.el9_8.x86_64.rpm 7089244b410b8d3ac68bad7daceb8ce93efdf0620a2517eb11ffa76996bfa37a glibc-nss-devel-2.34-283.el9_8.i686.rpm 80e9793db61af7e0dfe27a0be02e1f4f1e770e6037323b9d2adca7b8a85ec856 nss_db-2.34-283.el9_8.i686.rpm d158702618793f1262c9e4fdf6d6cfb78d62c4d283a55ada897cc93d43e76f6d glibc-benchtests-2.34-283.el9_8.x86_64.rpm e2e415185b679fe35648146d939d89b5434d0d10b41b771360e2282dec95ff75 glibc-static-2.34-283.el9_8.x86_64.rpm e406e6e61fff5dca15ceae69a49a220bfa1409731224517f19e6b32848be4deb glibc-static-2.34-283.el9_8.i686.rpm ee7af082584c3b1467c8c004795c0609a5fabd70678a8db35a4ddf77c3527838 ALSA-2026:80497 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via missing symlink protection (CVE-2026-90616) * flatpak: flatpak: Arbitrary write access as root via extra-data extraction (CVE-2026-96275) * flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280) * flatpak: Flatpak: Local privilege escalation via symlink traversal in revokefs writer (CVE-2026-96808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default flatpak-session-helper-1.12.9-4.el9_8.4.i686.rpm 084c122f370c8dd6155b17d661d2982a5b55021f49e7fa6560e26305933ded0d flatpak-1.12.9-4.el9_8.4.i686.rpm 8e8294065ce8b37139323a9d89e085433c5c7439b5b47e339adc7cc2135b05b9 flatpak-devel-1.12.9-4.el9_8.4.i686.rpm d9509a4785bc6c378ff69635818457c4339c1f23613a0a192b8c9782848328d1 flatpak-devel-1.12.9-4.el9_8.4.x86_64.rpm e4bdb016e8ed36fd2ac85512d53da23c8ede4d545ebf82bbca388adb0ca3e48d ALSA-2026:8075 Copyright 2026 AlmaLinux OS 0 1 Important

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default bind-devel-9.16.23-34.el9_7.2.x86_64.rpm 3795464e500b52007170d60a0e4462ffd018a4e4ad3d89cc736c5435d7d5065f bind-libs-9.16.23-34.el9_7.2.i686.rpm 4a9de11fd7dd49dec72c415c97d7ad605bbc130aa34d408a461e49261c0e26c1 bind-doc-9.16.23-34.el9_7.2.noarch.rpm 6230f544cc78b94f7f849f02776a9ee03d0d629a65ae19a135fca406798a0a1d bind-devel-9.16.23-34.el9_7.2.i686.rpm f7971a24986bf5329869280e0832fa22cc8a68998e1b4afe64678369b3e39ae6 ALSA-2026:80825 Copyright 2026 AlmaLinux OS 0 1 Important

dovecot security update

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Dovecot: Denial of Service via IMAP ID command with excessive parameters (CVE-2026-42391) * dovecot: Dovecot: Authentication bypass via incorrect OAuth2 token validation (CVE-2026-73208) * dovecot: Dovecot: Denial of service via crafted email headers (CVE-2026-27852) * dovecot: Dovecot: Denial of Service via truncated quoted argument in ManageSieve (CVE-2026-40019) * dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion (CVE-2026-33263) * dovecot: Dovecot: Denial of Service in ManageSieve login process (CVE-2026-33605) * dovecot: Dovecot: Arbitrary Code Execution via Sieve editheader use-after-free (CVE-2026-42007) * dovecot: Dovecot: MySQL multi-byte escaping wrong (CVE-2026-40018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dovecot-devel-2.3.16-18.el9_8.8.i686.rpm 2b4ef5c524207d9e137db95b3eaa9c8b88dedce0062e35b0299347aa1978a743 dovecot-2.3.16-18.el9_8.8.i686.rpm b5b9d4bc04c6f1bfc80196a416c41237c9c365513369c1fa0197e45a5e714712 dovecot-devel-2.3.16-18.el9_8.8.x86_64.rpm ea1a14280768eed28618883e7d6f91c544bacce521554aeafc3d7c7d486245f9 ALSA-2026:81532 Copyright 2026 AlmaLinux OS 0 1 Important

pcre2 security update

The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145) * PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback (CVE-2026-89156) * pcre2: PCRE2: Out-of-bounds write via large pattern input (CVE-2026-89157) * pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching (CVE-2026-89160) * PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms (CVE-2026-89158) * pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161) * pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default pcre2-tools-10.40-7.el9_8.x86_64.rpm c1cf4f66369e749722d3ef1b7f64b59a1e341792f4ba3057293efe6d67d3f48f ALSA-2026:82013 Copyright 2026 AlmaLinux OS 0 1 Important

libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: heap buffer overflow in PDF import stream handling (CVE-2026-63274) * libreoffice: stack buffer overflow in CFF to Type 1 font conversion (CVE-2026-63276) * libreoffice: stack buffer overflow in CFF font hint handling (CVE-2026-63275) * libreoffice: libreoffice: Arbitrary code execution via remote Java database driver (CVE-2026-63277) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libreoffice-sdk-7.1.8.1-15.el9_8.3.alma.1.x86_64.rpm 5a7667d7c576a13d5ea7614f055f3585537983b17bea57aadc78914afdc7e083 libreoffice-sdk-doc-7.1.8.1-15.el9_8.3.alma.1.x86_64.rpm 6f537791243e596c197e45ee3a2669025b52ec7d530bcf783edb0b164ae58249 ALSA-2026:82015 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.4.i686.rpm 49028b37f218e56d81c02fefd3386574393f2a342ca475c08b23aaa790d364db xorg-x11-server-source-1.20.11-34.el9_8.4.noarch.rpm ad0c1b502f04032297357cb36967d764515c70d09ede769ca1d12ab3e5bcff25 xorg-x11-server-devel-1.20.11-34.el9_8.4.x86_64.rpm d8dabc74cad85acdce92c71ddaa9228c1da346d8e4c503f462d7dba68fda80e2 ALSA-2026:82094 Copyright 2026 AlmaLinux OS 0 1 Important

librabbitmq security update

The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service (CVE-2026-44236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default librabbitmq-devel-0.11.0-7.el9_8.1.x86_64.rpm 21f7869624e1f78ea7f040b79cb5ef1d085ddea6e0e5f1635f12c9c99a7a9561 librabbitmq-devel-0.11.0-7.el9_8.1.i686.rpm dd6161be448f739de73383e60beac7e8666b56b9a1481aac71475abaa944bc80 ALSA-2026:83156 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: act_ct: Only release RCU read lock after ct_ft (CVE-2026-46319) * kernel: net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CVE-2026-53011) * kernel: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CVE-2026-64030) * kernel: wifi: cfg80211: use wiphy work for socket owner autodisconnect (CVE-2026-68404) * kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key (CVE-2026-68377) * kernel: net/iucv: fix use-after-free of a severed iucv_path (CVE-2026-68140) * kernel: wifi: mac80211: defer link RX stats percpu free to RCU (CVE-2026-68409) * kernel: KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (CVE-2026-72288) * kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CVE-2026-72262) * kernel: netfilter: nft_lookup: fix catchall element handling with inverted lookups (CVE-2026-72320) * kernel: ALSA: usx2y: bound the hwdep mmap fault offset (CVE-2026-74641) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) * kernel: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (CVE-2026-80985) * kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526) * kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003) * kernel: NFSD: Prevent client use-after-free during blocked-lock reaping (CVE-2026-90036) * kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (CVE-2026-93207) * kernel: svcrdma: Reject Write/Reply chunks with segcount 0 (CVE-2026-93228) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.58.1.el9_8.x86_64.rpm 3d490d6713adafac33230beb7c1bb7e0c6879ed079693ad0410b1f67e3afc9b9 kernel-tools-libs-devel-5.14.0-687.58.1.el9_8.x86_64.rpm 7b65655ea41363a95be6e7e9a74bd026fcfdabcb98a7c203b2689a33fcb22112 kernel-cross-headers-5.14.0-687.58.1.el9_8.x86_64.rpm 905f0b024da05b0fa95fc885648b6d8f3256a8a575449933cb940118f82b3ec3 ALSA-2026:83546 Copyright 2026 AlmaLinux OS 0 1 Important

wireshark security update

The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Wireshark: Denial of Service via C12.22 protocol dissector crash (CVE-2026-76886) * wireshark: Wireshark: Denial of Service via RRC protocol dissector out-of-bounds write (CVE-2026-76880) * wireshark: Wireshark: Denial of Service vulnerability in ESS protocol dissector (CVE-2026-76919) * wireshark: Wireshark: Denial of Service vulnerability in H.245 protocol dissector (CVE-2026-76927) * wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default wireshark-devel-3.4.10-9.el9_8.5.i686.rpm 4a75d1759a440e20621fa751bca12cefa4e39327bc4c60bcf76f7b3ee31010f6 wireshark-devel-3.4.10-9.el9_8.5.x86_64.rpm 71c62fd8f6f72b6b7267ceacbf5677f113722d0e25c6691726b0a3ac7ba010bb ALSA-2026:83553 Copyright 2026 AlmaLinux OS 0 1 Important

ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free (CVE-2026-101258) * ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data (CVE-2026-103226) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libgs-devel-9.54.0-19.el9_8.3.x86_64.rpm 47bc116fd9724a399ff51d25b87b8612c700ddc7d5fadeb1d66f519b241063c1 ghostscript-tools-fonts-9.54.0-19.el9_8.3.i686.rpm 5bd95049e9aaf0d8a4319141ddcb5fd5097b785e7e8c79f0f56a997265e232a5 ghostscript-9.54.0-19.el9_8.3.i686.rpm 795d207532db272aeeba12e89aa91cd5781a112afc5adee7a3b22421ccac833c libgs-devel-9.54.0-19.el9_8.3.i686.rpm c89894b62e391a23d719c93dd91ce892375f8ab976ba0bd022859d7688a45bba ghostscript-tools-printing-9.54.0-19.el9_8.3.i686.rpm eba2608c8677679ff5aaf6eb95ce66af78373d145ce494f66108f6b0a908dba7 ALSA-2026:8457 Copyright 2026 AlmaLinux OS 0 1 Important

freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984) * FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default libwinpr-devel-2.11.7-1.el9_7.6.i686.rpm 1a6e3b36a27865deb4b008565a8ad30262fdaf9dca6bba3d6c57988295385b7e freerdp-devel-2.11.7-1.el9_7.6.i686.rpm 20107ae8c4985a917ab5c7c305c4e4e575d664c29e93ad88f05e6043bcc78646 freerdp-devel-2.11.7-1.el9_7.6.x86_64.rpm 71ff79089b70b84979854477baff24316e33dec7ef7ad35d8e43481966e052e5 libwinpr-devel-2.11.7-1.el9_7.6.x86_64.rpm e1d7b396f0dc12b78313496c171c043046f637a55f62c139b33d952fb0f5c1f1 ALSA-2026:84574 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server security update

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-devel-1.20.11-34.el9_8.5.i686.rpm 19807c6ff706b9701fd703ac996dea3fb2819f1736657c38b8f58473d5a854ca xorg-x11-server-source-1.20.11-34.el9_8.5.noarch.rpm 2773c8f10cf5cdb9a9e0fab413643f95230344eabc2607e96c6fba7b65410a67 xorg-x11-server-devel-1.20.11-34.el9_8.5.x86_64.rpm 70d81e0b13c4d373eaabb5fd9a2553b919e937915aa9e35609e2dc72e724d7d7 ALSA-2026:8469 Copyright 2026 AlmaLinux OS 0 1 Important

.NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es): * dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171) * dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203) * dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116) * dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default dotnet-sdk-8.0-source-built-artifacts-8.0.126-1.el9_7.x86_64.rpm d17843a663a3d7ce4ac3db538ab02e8bd619930d66cabbe8457fa262d6e16834 ALSA-2026:85193 Copyright 2026 AlmaLinux OS 0 1 Important

xorg-x11-server-Xwayland security update

Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: xorg-x11-server: Arbitrary code execution via use-after-free in passive grab handling (CVE-2026-93516) * xorg-x11-server: xorg-x11-server: Privilege escalation via crafted RandR provider property requests (CVE-2026-93521) * xorg-x11-server: xwayland: xorg-x11-server: Arbitrary code execution via double-free in XKB geometry handling (CVE-2026-88812) * xorg-x11-server: xorg-x11-server: Out-of-bounds write via unvalidated modifier in ProcXIPassiveUngrabDevice (CVE-2026-93523) * xorg-x11-server: glamor: size tmp_bits buffer for source coordinate range in upload_boxes (CVE-2026-93522) * xorg-x11-server: xorg-x11-server: arbitrary code execution via GLX RenderLarge heap-based buffer overflow (CVE-2026-93517) * xorg-x11-server: xorg-x11-server: arbitrary code execution via integer truncation during keyboard mapping resize (CVE-2026-93518) * xorg-x11-server: xorg-x11-server: Arbitrary code execution via buffer overflow in input_constrain_cursor() (CVE-2026-93519) * xorg-x11-server: xorg-x11-server: arbitrary code execution via out-of-bounds write in XKB keycode handling (CVE-2026-93520) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.4.x86_64.rpm 8ebfc3de9c45519577109153efaafa5d03b885dfb8d7bd2a97049834cc0acea8 xorg-x11-server-Xwayland-devel-24.1.9-4.el9_8.4.i686.rpm a77ffc11aade8562e1d8afd2ede3adac3aa8fa0a27fa9edd470e33cef058b284 xorg-x11-server-Xwayland-24.1.9-4.el9_8.4.i686.rpm ea966b40b1e3854af480f20c69f7384c4f8c5a088e05daf278a27821fb98b039 ALSA-2026:86033 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678) * kernel: xfrm: espintcp: do not reuse an in-progress partial send (CVE-2026-52935) * kernel: USB: serial: mxuport: fix memory corruption with small endpoint (CVE-2026-63899) * kernel: bridge: mcast: Fix a possible use-after-free when removing a bridge port (CVE-2026-64032) * kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (CVE-2026-64024) * kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (CVE-2026-63962) * kernel: Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CVE-2026-63974) * kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (CVE-2026-64114) * kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path (CVE-2026-64572) * kernel: Bluetooth: hci_sync: Fix advertising data UAFs (CVE-2026-74509) * kernel: Linux kernel: Denial of Service due to incorrect GSO state handling in network fragment reassembly (CVE-2026-80590) * kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633) * kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817) * kernel: kernel: strparser: use-after-free via msg_timer_work rearm after strp_done() cancellation () * kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) * kernel: ipv4: validate checksum_start before completing checksum (CVE-2026-99999) Bug Fix(es) and Enhancement(s): * Batch: z-stream xfrm - almalinux-9.8.z (NST-Core-26W38) (JIRA:AlmaLinux-256697) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default kernel-cross-headers-5.14.0-687.59.1.el9_8.x86_64.rpm 73932ae0396c49cdc9e0a1a912ed6491271dd41cbc67ef7a8729a9d40c9010df libperf-5.14.0-687.59.1.el9_8.x86_64.rpm 9f39da280b42d32ff6af3f9f483167bf393ed9d9e70a56d886dbd15b357bf99e kernel-tools-libs-devel-5.14.0-687.59.1.el9_8.x86_64.rpm f9cb6bd1fa684f623ec46536ec595253c186e91158071af33dbbbf9be3109d07 ALSA-2026:86169 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 8.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 8.0.132 Runtime version: 8.0.32 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability (CVE-2026-96222) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 8.0 to SDK 8.0.132 and Runtime 8.0.32 [almalinux-9.8.z] (JIRA:AlmaLinux-277793) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8.x86_64.rpm 6aeeaa78e1c98401953809bf03a02f95072c2c55470990b1ab14b5993986a723 ALSA-2026:86171 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 9.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 9.0.122 Runtime version: 9.0.21 Security Fix(es): * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) Bug Fix(es) and Enhancement(s): * Update .NET 9.0 to SDK 9.0.122 and Runtime 9.0.21 [almalinux-9.8.z] (JIRA:AlmaLinux-277800) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8.x86_64.rpm 20d2d6d445f2065cb8308343067693e13f4d31353cd9bbc8395607e6dd0a2994 ALSA-2026:86193 Copyright 2026 AlmaLinux OS 0 1 Critical

.NET 10.0 security, bug fix, and enhancement update

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework libraries, an SDK containing compilers and a 'dotnet' application to drive everything. SDK version: 10.0.113 Runtime version: 10.0.13 Security Fix(es): * dotnet: dotnet10.0: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-102870) * dotnet10.0: dotnet9.0: dotnet: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-58280) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: .NET Information Disclosure Vulnerability (CVE-2026-66822) * dotnet9.0: dotnet: dotnet10.0: dotnet8.0: .NET Denial of Service Vulnerability (CVE-2026-69651) * dotnet8.0: dotnet10.0: dotnet: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70159) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70175) * dotnet10.0: dotnet8.0: dotnet9.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70179) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70181) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Elevation of Privilege Vulnerability (CVE-2026-70183) * dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70186) * dotnet: ASP.NET Core Security Feature Bypass Vulnerability (CVE-2026-70188) * dotnet9.0: dotnet8.0: dotnet10.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-70196) * dotnet: ASP.NET Core Tampering Vulnerability (CVE-2026-88092) * dotnet10.0: dotnet8.0: dotnet9.0: dotnet: MessagePack: Nested arrays can blow past buffer length limits (CVE-2026-92707) * dotnet: dotnet8.0: dotnet9.0: dotnet10.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96225) * dotnet9.0: dotnet10.0: dotnet8.0: dotnet: ASP.NET Core Remote Code Execution Vulnerability (CVE-2026-96230) * dotnet: dotnet9.0: dotnet10.0: dotnet8.0: .NET Elevation of Privilege Vulnerability (CVE-2026-96231) * dotnet10.0: dotnet: dotnet8.0: dotnet9.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96233) * dotnet: dotnet10.0: dotnet9.0: dotnet8.0: ASP.NET Core Denial of Service Vulnerability (CVE-2026-96236) * dotnet8.0: dotnet10.0: dotnet9.0: .NET Remote Code Execution Vulnerability (CVE-2026-96237) * dotnet8.0: dotnet10.0: dotnet9.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96238) * dotnet10.0: dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-96957) Bug Fix(es) and Enhancement(s): * Update .NET 10.0 to SDK 10.0.113 and Runtime 10.0.13 [almalinux-9.8.z] (JIRA:AlmaLinux-277808) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8.x86_64.rpm bbe239272f8e43a1de50f570b2341a339b8187f9dc92331c185605b6a36d9c40 ALSA-2026:86983 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing (CVE-2026-34544) * openexr: OpenEXR: Denial of Service or Information Disclosure via crafted EXR image file (CVE-2026-59982) * openexr: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184) * openexr: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189) * openexr: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default openexr-devel-3.1.1-3.el9_8.5.i686.rpm 3c738f02f2062c87bf5418cfb28d71cd6096f9c48fdbec18831a960529e8cc46 openexr-devel-3.1.1-3.el9_8.5.x86_64.rpm d9a74a3be447883ef1030a98bb2592b212f9bba045d0036d2d46f1074825e526 ALSA-2026:87082 Copyright 2026 AlmaLinux OS 0 1 Important

qt5-qtbase security update

Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qt5-qtbase: qt6-qtbase: qtbase: Denial of Service via uncontrolled recursion in XML serialization (CVE-2026-11573) * qt5-qtbase: qt6-qtbase: Qt: Denial of Service vulnerability in XML parsing (CVE-2026-19248) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default qt5-qtbase-static-5.15.9-11.el9_8.2.x86_64.rpm 085f4e667a04f1eb5adc74a98ea436287eff8cfbc70e0f195eccaaa36d88a219 qt5-qtbase-static-5.15.9-11.el9_8.2.i686.rpm e610ed3cd2090dc15201ea3dc7e88eb791de7e38b0fa09864360b48ca2166156 ALSA-2026:87805 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063) * kernel: calipso: Don't call calipso functions for AF_INET sk. (CVE-2025-38147) * kernel: ALSA: hda/cs35l41: Fix firmware load work teardown (CVE-2026-64481) * kernel: ALSA: seq: close a re-opened queue timer in the destructor (CVE-2026-68202) * kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299) * kernel: ovl: check access to copy_file_range source with src mounter creds (CVE-2026-68448) * kernel: xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CVE-2026-80530) * kernel: xfs: bounds-check buffer log item's dirty bitmap (CVE-2026-80536) Bug Fix(es) and Enhancement(s): * RTLA segfaults on freed memory access on double SIGINT [almalinux-9.8.z] (JIRA:AlmaLinux-193029) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.60.1.el9_8.x86_64.rpm 0e0d14f3f38948ed1a69f54513f84e070bc9763a07b42eb01296022f9f3390a0 kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.x86_64.rpm 21c4192b34186ecb2ccf3f69d596e5cf8df8a92da9c83c9942644556f82c7e40 kernel-cross-headers-5.14.0-687.60.1.el9_8.x86_64.rpm 9575139bb90f1717f25842e0a07db7867cd880c8db208e8bf98f3cc4f374b62a ALSA-2026:8859 Copyright 2026 AlmaLinux OS 0 1 Important

giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default giflib-devel-5.2.1-9.el9_7.1.x86_64.rpm 608f0d91075130a16ee4b671eb148783003b05a5168d8c2e228ffb6d53467650 giflib-devel-5.2.1-9.el9_7.1.i686.rpm abde4acac92c7e69b877a551e03b0defde022d7afce749dee52673aaa8be6c97 ALSA-2026:8888 Copyright 2026 AlmaLinux OS 0 1 Important

openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default openexr-devel-3.1.1-3.el9_7.1.x86_64.rpm 3905ba6f60a0f689afafdc4b9d8e884ef19674534244ccd77f34ab535b5d55c4 openexr-devel-3.1.1-3.el9_7.1.i686.rpm cacc0faa99a0899dce042b4c201bed2590432480329efe558273f51ada1de110 ALSA-2026:8921 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766) * kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.49.1.el9_7.x86_64.rpm 0f050586a101cf2ffbc2452b79de9d4f743974f0102797834c3e65a244a4d0f7 kernel-cross-headers-5.14.0-611.49.1.el9_7.x86_64.rpm 11a05acd84f89906ba787b219292eab1e4a47a28dd0fe7c950c5a6c638c76340 libperf-5.14.0-611.49.1.el9_7.x86_64.rpm 541c8ba9a16b321c46d18091509c08f74a90d41289612ee86515b6869e180635 ALSA-2026:89742 Copyright 2026 AlmaLinux OS 0 1 Important

python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: python: Arbitrary file deletion via race condition during temporary directory cleanup (CVE-2026-12345) * python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553) * python: Use-after-free of a server-side SSLContext when sni_callback switches contexts (CVE-2026-19445) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default python3-test-3.9.25-7.el9_8.6.x86_64.rpm 3e5507d92615dd2f2b86649bffe5ff45d4c7f411565c12f20df567cf8d56b854 python3-idle-3.9.25-7.el9_8.6.x86_64.rpm 5944bea59aa3b827c03d39d7ba020f76f7d6f24b4b0962203e99ff0ae325aa5a python3-debug-3.9.25-7.el9_8.6.i686.rpm 5c6680c095193e4b841d94f853503b0e7c45c7b5257371fbc8a9a3370e809155 python3-3.9.25-7.el9_8.6.i686.rpm 73adbd7ee9a255e0da7998f417b0d9f8aa81f136fa296c1178de5d9dc0a63dc6 python3-debug-3.9.25-7.el9_8.6.x86_64.rpm 9ce791e0ecd4b11b8e46e2fd59836de81233ec37be5af41f7bfb8cbf84ac8f4c python3-idle-3.9.25-7.el9_8.6.i686.rpm 9fc5e444703e2ff2d5ab200890e1c51f494c75ee04a9fa670dc162bf980b8509 python3-tkinter-3.9.25-7.el9_8.6.i686.rpm a952a92f45f2c4bbbd45bf7526a25a6d53678e6808257b3974f006923609af9d python3-test-3.9.25-7.el9_8.6.i686.rpm ff48c6fb2fc09b1145c63c43e2cc8e5e3f475da770b3e27d8ac0f07ccc91a956 ALSA-2026:89745 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind-doc-9.16.23-40.el9_8.12.noarch.rpm 3e440850130266e96cf9744617c8fb9a9598d4aa754fa8c74fd8cad49bb9d04a bind-devel-9.16.23-40.el9_8.12.i686.rpm 464e0c3d52733786d2907b0491f6953681469e24fa51f6b1e6bbe511099153ea bind-devel-9.16.23-40.el9_8.12.x86_64.rpm c6118edfbba5f946df5902a7694e2d62ad6ca89eb096c28dd5b5cae414bd856a bind-libs-9.16.23-40.el9_8.12.i686.rpm ddb4b48869631bacabac11e38ffebdbb038d3f466fa920994f945a87ea53fa1a ALSA-2026:89746 Copyright 2026 AlmaLinux OS 0 1 Moderate

bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating properly. Security Fix(es): * bind9: bind: BIND 9: Denial of Service via crafted DNSSEC responses (CVE-2026-19662) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default bind9.18-devel-9.18.29-14.el9_8.11.i686.rpm 1d3be756d7c69cb43ff8970e6ed3772190f49b880c192c1dbaa481fe43389a44 bind9.18-libs-9.18.29-14.el9_8.11.i686.rpm 76feacef1f78a3977a7287b46db67490eb7fc84f9ca01761ab2e86a4958a0f85 bind9.18-devel-9.18.29-14.el9_8.11.x86_64.rpm 9860dab441ec663e6f86cf83df3296390083e2440527b4d3f288a8aa1597f46d bind9.18-doc-9.18.29-14.el9_8.11.noarch.rpm bd56e931b4a46d62a43b94895cf0e92c0b6d6c79a308a996f478e30cce79e25f ALSA-2026:89753 Copyright 2026 AlmaLinux OS 0 1 Moderate

freeipmi security, bug fix, and enhancement update

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification. Security Fix(es): * FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) * FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) * FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) * freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508) Bug Fix(es) and Enhancement(s): * Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-9.8.z] (JIRA:AlmaLinux-279523) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default freeipmi-devel-1.6.20-1.el9_8.i686.rpm 15594974b20953514b1db7f164bbd59b2cb4e6377bf2aa75a81c64fe48d6e6bb freeipmi-devel-1.6.20-1.el9_8.x86_64.rpm 229ed7ee3f822e13d66cfa8f1c613016886ad330d2bb9379de15a7195d0b6993 ALSA-2026:89850 Copyright 2026 AlmaLinux OS 0 1 Important

flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin (CVE-2026-97023) * flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc (CVE-2026-97024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default flatpak-devel-1.12.9-4.el9_8.6.i686.rpm 045ee5f71ac5e416b37b2101586642436cb2db788edeb9cef401643e3eab1c2a flatpak-session-helper-1.12.9-4.el9_8.6.i686.rpm 9f6332ad10d87231ef69e1ec8fa5c72474732808d374be2ad1972965ddb14df8 flatpak-devel-1.12.9-4.el9_8.6.x86_64.rpm c34df9c36e679689ef29f73723fb0a5b1cb76b8d7d6c2dbf9d8a7ad80983e781 flatpak-1.12.9-4.el9_8.6.i686.rpm d309727f111b498a26ab66428bcf6a1cf95670eff5641462a6231a1f6e84aee1 ALSA-2026:90365 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: udp: Deal with race between UDP socket address change and rehash (CVE-2024-57974) * kernel: fuse: re-lock request before replacing page cache folio (CVE-2026-53388) * kernel: net/handshake: hand off the pinned file reference to accept_doit (CVE-2026-63979) * kernel: net/handshake: Drain pending requests at net namespace exit (CVE-2026-63978) * kernel: fuse: re-lock request before returning from fuse_ref_folio() (CVE-2026-64266) * kernel: net/handshake: Take a long-lived file reference at submit (CVE-2026-64523) * kernel: ipvs: reload ip header after head reallocation (CVE-2026-68476) * kernel: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CVE-2026-72242) * kernel: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CVE-2026-74515) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush() (CVE-2026-93262) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) Bug Fix(es) and Enhancement(s): * kernel panic at __crypto_xor+0x2 after a number of out-of-bounds read and use-after-free read (JIRA:AlmaLinux-257205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_8_default libperf-5.14.0-687.61.1.el9_8.x86_64.rpm 1ec05fddb6f102534ee40521fe836d98ef68ce83c23afbed8ffe6d028664974d kernel-tools-libs-devel-5.14.0-687.61.1.el9_8.x86_64.rpm 3b5f20281633408aea23a75ad8ba98d4b2ead06b43a23e3a2387338d860d60a3 kernel-cross-headers-5.14.0-687.61.1.el9_8.x86_64.rpm 5f161e26e3b1cee4695443168ec2552da7410a46585d3f9087514e78c3ae4930 ALSA-2026:9683 Copyright 2026 AlmaLinux OS 0 1 Important

java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance key generation (CVE-2026-34268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-1.8.0-openjdk-src-slowdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 1d41633b0f284bfd200dd8f92009652221ed9d8bb14bea0a9fb19936bf680ea8 java-1.8.0-openjdk-devel-fastdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 394488895d1546b599a71dbea8c71123da4cc3f40db4b5e8633493a1ff4ebaa2 java-1.8.0-openjdk-fastdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 769a6c8d7a32eb5116b9615dc0078d603d1a346d02e40f227204df53ab527d26 java-1.8.0-openjdk-demo-slowdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 7a83010cf1e8f3b0c051808e1ba014912341e472e3009cf74fea590357a69990 java-1.8.0-openjdk-headless-slowdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 7eea870ee441d9e39e8930cce83e7ea0d26930ce13816696b429cbab6fd529ab java-1.8.0-openjdk-src-fastdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 80f35359897a80b27913ef24e813a82ffd06471918d2e81051475974148a3d29 java-1.8.0-openjdk-headless-fastdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm 96e2d92894738db13189787492bfb1f3c0c98c0d5ebacd36082150db574a2531 java-1.8.0-openjdk-slowdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm ae77f7ff82c6ba8fb8c3037d5c0c7210f7d0d18ab9524785cd0c4099feb16c71 java-1.8.0-openjdk-devel-slowdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm cc1f2ea1b79f67081a43dfa60a04759b8a4c8cc0f0141445e1107711c4d0c820 java-1.8.0-openjdk-demo-fastdebug-1.8.0.492.b09-2.el9.alma.1.x86_64.rpm f2e563b61db4a78321242530366adca7c27c2f3706260128d2721ed18f76243a ALSA-2026:9686 Copyright 2026 AlmaLinux OS 0 1 Important

java-17-openjdk security update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-17-openjdk-jmods-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 0474eaece993e2eb0cb20d503fe2e90a4ae023462f12a50995d5a729ac76f39c java-17-openjdk-headless-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 20e51c28e6e67856fcfbe06eae63734d682234072608fade01d1844dde76e3e2 java-17-openjdk-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 60dcb657caf51a8380b8a05813cdf837ecc4d55e39d31dd3c62acd8b37bbd374 java-17-openjdk-headless-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 6c173f8b86e2f3ecfc1f10666a370659507d3ac8875667d546c7dae480928976 java-17-openjdk-static-libs-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 76d01a2156632a0c7db493d36ae662a9f408dfcd7a243b91ff2776a81aca1aa3 java-17-openjdk-src-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 76fd261c40c1323734e4172c2140c077c296798e0e3fda30b73583fd14b9d128 java-17-openjdk-src-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 9256cc3119181db9bf0f7f7cc2a23a0bfd410c1a41429b61bad270c59c00b1c2 java-17-openjdk-demo-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 957e75c78a9338e16b2c54cfc081f79bd8646d0402adf7e5a58a138f5119d19b java-17-openjdk-devel-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm 9d14d86ef8a75b6e2d61d0395baa88a073617f392552113af4b96b60880ad2f3 java-17-openjdk-demo-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm b4d75277358b7dc604b2d46f63a5dbc5ae272759e48562658bc25247699ce9bf java-17-openjdk-jmods-fastdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm cd43e580aae3a6aa5765342d16410b87e8670666be484c3bc18d389d237a2b95 java-17-openjdk-static-libs-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm ed0ea49779c137ebaff8f6a3588aeff546b4641d6326c6c5027bb335308511e1 java-17-openjdk-devel-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm f22e28ff3764e64069287358c2c72979678ad24d7d1d1558ac3f18d2727aa7fb java-17-openjdk-slowdebug-17.0.19.0.10-2.el9.alma.1.x86_64.rpm f723deb27b3e792ba72b059072ab80d562db286756ca139429cc17038cc85f1b ALSA-2026:9689 Copyright 2026 AlmaLinux OS 0 1 Important

java-21-openjdk security update

The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) Bug Fix(es): * When copying files, OpenJDK 21 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 21 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169617, AlmaLinux-169951, AlmaLinux-169952, AlmaLinux-169942, AlmaLinux-169953, AlmaLinux-169945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-21-openjdk-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 31352795858856d641b6f1fb04b816a9ee1e9b21624ae6e103d72673960f60b3 java-21-openjdk-jmods-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 43dec98672b078c097c8447cb8f364067274f64f0840808578e7be8e5cbb517c java-21-openjdk-demo-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 45e3421e1f88ec5a6798bc0306b2c0f70288080e7e61f3acc7270909fc0814f2 java-21-openjdk-static-libs-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 499282fd3022dab6ab0b0edba86397f34a3163d66192794848d4843acbf29fe0 java-21-openjdk-devel-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 4ca26bfed9a77d23a9b04b69198a170456aca3cbf04bc9883b537205101b7d53 java-21-openjdk-src-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 5540cca4e2cbb203d79a4ee0088fbd61b91e8376b8c9434de4776c722decabf4 java-21-openjdk-headless-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 6176bdd49f4dc2324e21b56deb1cef386065589b94f0cd986543751936a6c713 java-21-openjdk-src-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 800fad1c15b5f68354aa07bf39fa734e748acf75a12bac59acad2ee540fe7d7a java-21-openjdk-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm 9892f6ba4fa108f583c5615f477bea6ba46adde53bb447607e094819b739c4a2 java-21-openjdk-static-libs-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm b06137627e5ed5126d29771dadf3013af211f702d15d9c7b92830a2eb5d61ee4 java-21-openjdk-headless-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm b834635f3b192d768b5de122fcf1b67fcf6c64d6b2010d054379e720161cfb9a java-21-openjdk-demo-fastdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm d046be036d3c4deda8e9cf0f5642c42399ed558bec35386c0138d9bc179d54d1 java-21-openjdk-jmods-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm e88b018792dbd5f0289fd31dff7bd45062da02ce0c4679c825664a5743f56464 java-21-openjdk-devel-slowdebug-21.0.11.0.10-2.el9.alma.1.x86_64.rpm e92974019abc870855212c8dc2367ad66dcebd32e85e175491454421311df7f5 ALSA-2026:9693 Copyright 2026 AlmaLinux OS 0 1 Important

java-25-openjdk security update

The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit. Security Fix(es): * JDK: Enhance crypto algorithm support (CVE-2026-22007) * JDK: Improved Arena allocations (CVE-2026-22008) * JDK: Improve Kerberos credentialing (CVE-2026-22013) * JDK: Enhance Path Factories Redux (CVE-2026-22016) * JDK: Enhance Zip file reading (CVE-2026-22018) * JDK: Enhance certificate chain validation (CVE-2026-22021) * JDK: Updating FreeType 2.14.1 (CVE-2026-23865) * JDK: Enhance TLS connection handling (CVE-2026-34282) * JDK: Enhance key generation (CVE-2026-34268) This release also updates a number of third-party libraries included in the JDK. The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected: * giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740) * libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) * libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) Bug Fix(es): * When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails. However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile. This is rectified in this release. (AlmaLinux-169939, AlmaLinux-169937) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default java-25-openjdk-jmods-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 1fe8b0a75a8bc9dfe79a0c8160493d1419d04ec5ce53d4eec29545a51b41682a java-25-openjdk-crypto-adapter-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 39848d18e1422558f213ff5a1faac96e0c14c0591a45233ded1d06bbacfe3c45 java-25-openjdk-headless-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 53fa8bdff6b0f4e4e926085d45acb08934c30efa727e8f287c0e29c5626139ea java-25-openjdk-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 60528381e996d605be5679c05f26fbc70832f7281742dd3e885d40c6d881975a java-25-openjdk-static-libs-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 688cba1f78159615f6f388fce8801c4d708623a4a0f59c30c271296195c65886 java-25-openjdk-headless-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 78f5b94c316b541de42f878fff469b6f4aca3ca8d3d002da462ed1cc1d832f8e java-25-openjdk-jmods-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 7fd9e5eb55c812006ff980328723ed9a38ce8ebb903d31117658d4492542d760 java-25-openjdk-src-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 836731c3558513e46a93a5b8c10c214360018c4e6c00a63a802bcccb2532d285 java-25-openjdk-demo-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 8af9ecfdb6a55c3ba48fcd009c4f0a5e9ca4149aceec30022566c498f42113d9 java-25-openjdk-demo-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm 8d11b9b7ac363994e5c3dc88f28a1f7cd077c92f7b942fd48fa819141a51ea1d java-25-openjdk-static-libs-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm a3e0bfa748086eb50b4ecd4fbce15863e3aa8db1df331b9ec65aaf42b54ac14b java-25-openjdk-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm b2bfb1a26d329133786a67e350ad86866cba6d2fcfa83d79f23ea8ff34d8e280 java-25-openjdk-devel-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm bbe4098fef7a0b58a24a7b22d8e6493b6b3c6288758136f91fec2b393336920f java-25-openjdk-src-slowdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm d7710584d4936872ee0196e1f1b0bf7d6529df6ebefb55f78ed9734c5f860cfc java-25-openjdk-crypto-adapter-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm e7e1956de6a54650a9c2785a44c1e2202ae2d5ab44dfb573c2721294b492b155 java-25-openjdk-devel-fastdebug-25.0.3.0.9-1.el9.alma.1.x86_64.rpm ff7c87250be38bf1be71d0973b3d45a4cbeec2c1a76776dfdd39a15d1cd2d2b3 ALSA-2026:A002 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.49.2.el9_7.x86_64.rpm 5ca33210d84c16117b47866b60bdb0464f38ab555109763a9cf27b473fe02fcf kernel-cross-headers-5.14.0-611.49.2.el9_7.x86_64.rpm ac5edf7db6721a9097679c365ee61042bfc628c2a3ecca3660159d328907b919 libperf-5.14.0-611.49.2.el9_7.x86_64.rpm ef0f20b72270b6937a15a1b4f5476a90a7a408994f13e7068a39d8ae22b87132 ALSA-2026:A005 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-cross-headers-5.14.0-611.54.3.el9_7.x86_64.rpm 18104d195ff611c5e1dfcb57676141b5cc5a882a050eb6d3a376c2f80775ae54 libperf-5.14.0-611.54.3.el9_7.x86_64.rpm 34da6076b46fe5c827c29fece5d1a306d1af381c52a6edf5c087dd23d5e0d4b8 kernel-tools-libs-devel-5.14.0-611.54.3.el9_7.x86_64.rpm e6f276bf184f95967bf2724e7c729d5bdac986c1280c81e794d78e9f99a3d2a9 ALSA-2026:A009 Copyright 2026 AlmaLinux OS 0 1 Important

kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300) * kernel: ptrace: require CAP_SYS_PTRACE when task has no mm (CVE-2026-46333) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 almalinux-9-for-x86_64-crb-rpms__9_7_default kernel-tools-libs-devel-5.14.0-611.54.6.el9_7.x86_64.rpm 847a895ed4c4a4786124adb025d9e62795ba43b689070e88ab2177377a74056c libperf-5.14.0-611.54.6.el9_7.x86_64.rpm 92d66e76e2b95364f05c2ef3fe01332cdc5fc728794043d1e3188b511969e779 kernel-cross-headers-5.14.0-611.54.6.el9_7.x86_64.rpm 9ec0704e3a227c058d7441d24fbc083b3f06f9724b1b614591c7dacfa1859a57