openssl: Read buffer overruns processing ASN.1 strings (CVE-2021-3712) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 openssl-1.0.2k-23.el7_9.x86_64.rpm openssl-debuginfo-1.0.2k-23.el7_9.i686.rpm openssl-debuginfo-1.0.2k-23.el7_9.x86_64.rpm openssl-libs-1.0.2k-23.e [More...]
webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2021-30858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 webkitgtk4-2.28.2-3.el7.i686.rpm webkitgtk4-2.28.2-3.el7.x86_64.rpm webkitgtk4-debuginfo-2.28.2-3.el7.i686.rpm webkitgtk4-debuginfo-2.28.2- [More...]
log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender (CVE-2021-4104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 log4j-debuginfo-1.2.14-6.5.el6_10.x86_64.rpm i386 log4j-debuginfo-1.2.14-6.5.el6_10.i686.rpm noarch log4j-1.2. [More...]
samba: Active Directory (AD) domain user could become root on domain members (CVE-2020-25717) * samba: SMB1 client connections can be downgraded to plaintext authentication (CVE-2016-2124) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * Backport IDL changes to harden Kerberos c [More...]
samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets (CVE-2020-25719) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * SL 8.6 IPA Replica Failed to configure PKINIT setup against a SL 7.9 IPA server SL7 x86_64 ipa-client-4.6.8-5.el7_9.10.x86_64.rpm [More...]
This update upgrades Thunderbird to version 91.4.0. * Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 * Mozilla: URL leakage when navigating while executing asynchronous function (CVE-2021-43536) * Mozilla: Heap buffer overflow when using structured clone (CVE-2021-43537) * Mozilla: Missing fullscreen and pointer lock notification when requesting both (CVE-2021-43538) [More...]
This update upgrades Firefox to version 91.4.0 ESR. * Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4 * Mozilla: URL leakage when navigating while executing asynchronous function (CVE-2021-43536) * Mozilla: Heap buffer overflow when using structured clone (CVE-2021-43537) * Mozilla: Missing fullscreen and pointer lock notification when requesting both (CVE-2021-43538) [More...]
mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097) * mailman: CSRF token bypass allows to perform CSRF attacks and admin takeover (CVE-2021-44227) * mailman: CSRF protection missing in the user options page (CVE-2016-6893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related informat [More...]
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS) (CVE-2021-43527) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 nss-3.67.0-4.el7_9.i686.rpm nss-3.67.0-4.el7_9.x86_64.rpm nss-debuginfo-3.67.0-4.el7_9.i686.rpm nss-debuginfo-3.67.0- [More...]
openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured (CVE-2021-41617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 openssh-7.4p1-22.el7_9.x86_64.rpm openssh-askpass-7.4p1-22.el7_9.x86_64.rpm openssh-clients-7.4p1-22.e [More...]
krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field (CVE-2021-37750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 krb5-debuginfo-1.15.1-51.el7_9.i686.rpm krb5-debuginfo-1.15.1-51.el7_9.x86_64.rpm krb5- [More...]
kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after- free (CVE-2020-36385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * scsi: ibmvfc: Avoid link down on FS9100 canister reboot * crash in qla2x00_status_entry() because of corrupt srb * qedf driver: race c [More...]
rpm: Signature checks bypass via corrupted rpm package (CVE-2021-20271) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 rpm-4.11.3-48.el7_9.x86_64.rpm rpm-build-4.11.3-48.el7_9.x86_64.rpm rpm-build-libs-4.11.3-48.el7_9.i686.rpm rpm-build-libs-4.11.3-48.el7_9.x86_64. [More...]
freerdp: improper client input validation for gateway connections allows to overwrite memory (CVE-2021-41159) * freerdp: improper region checks in all clients allow out of bound write to memory (CVE-2021-41160) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 freerdp-2.1.1-5.el [More...]
This update upgrades Thunderbird to version 91.3.0. * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 * Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503) * Mozilla: Use-after-free in file picker dialog (CVE-2021-38504) * Mozilla: Firefox could be coaxed into going into fullscreen mode witho [More...]
This update upgrades Firefox to version 91.3.0 ESR. * Mozilla: Use-after-free in HTTP2 Session object * Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3 * Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503) * Mozilla: Use-after-free in file picker dialog (CVE-2021-38504) * Mozilla: Firefox could be coaxed into going into fullscreen mode witho [More...]
flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE --- SL7 x86_64 -flatpak-1.0.9-12.el7_9.x86_64.rpm - flatpak-builder-1.0.0-12.el7_9.x86_64.rpm - flatpak-debuginfo-1.0.9-12.el7_9.x86_64.rpm - flatpak-devel-1.0.9- [More...]
