Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
100
security advisorybuffer overflowSuSESUSE SVT-AV1 Important Buffer Overflow Memory Issues Vuln 2026-3224-1
A security update for SVT-AV1, libyuv0, and libaom3 addresses multiple vulnerabilities, allowing potential memory corruption and remote code execution, requiring updates for affected SUSE products.. # Security update for SVT-AV1, libyuv0, libaom3 Announcement ID: SUSE-SU-2026:3224-1 Release Date: 2026-07-23T18:34:25Z Rating: important References: * bsc#1263678 * bsc#1268242 * bsc#1268650 * bsc#1268651 * bsc#1268653 * bsc#1268655 Cross-References: * CVE-2026-56208 * CVE-2026-56209 * CVE-2026-56210 * CVE-2026-56211 CVSS scores: * CVE-2026-56208 ( SUSE ): 6.0 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-56208 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H * CVE-2026-56208 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2026-56208 ( NVD ): 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H * CVE-2026-56209 ( SUSE ): 7.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-56209 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H * CVE-2026-56209 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2026-56209 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H * CVE-2026-56210 ( SUSE ): 7.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2026-56210 ( SUSE ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H * CVE-2026-56210 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H * CVE-2026-56210 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H * CVE-2026-56211 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2026-56211 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-56211 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H * CVE-2026-56211 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H Affected Products: * Basesystem Module 15-SP7 * Desktop Applications Module 15-SP7 * openSUSE Leap 15.6 * SUSELinux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 An update that solves four vulnerabilities and has two security fixes can now be installed. ## Description: This update for SVT-AV1, libyuv0, libaom3 fixes the following issues: * CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap- based buffer overflow and a process crash (bsc#1268650). * CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651). * CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out- of-bounds heap read (bsc#1268653). * CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655). Bug fixes: * Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * Desktop Applications Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-3224=1 * openSUSE Leap 15.6 zypper in -t patch SUSE-2026-3224=1 * Basesystem Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3224=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3224=1 * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3224=1 ## Package List: * openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64) * aom-tools-debuginfo-3.7.1-150600.3.9.1 * libaom-debugsource-3.7.1-150600.3.9.1 *libaom-devel-3.7.1-150600.3.9.1 * libyuv-tools-20230517+a377993-150600.3.4.2 * libyuv-devel-20230517+a377993-150600.3.4.2 * libyuv0-20230517+a377993-150600.3.4.2 * libyuv-tools-debuginfo-20230517+a377993-150600.3.4.2 * libaom3-3.7.1-150600.3.9.1 * libyuv0-debuginfo-20230517+a377993-150600.3.4.2 * aom-tools-3.7.1-150600.3.9.1 * libaom3-debuginfo-3.7.1-150600.3.9.1 * libyuv-debugsource-20230517+a377993-150600.3.4.2 * openSUSE Leap 15.6 (aarch64 x86_64) * SVT-AV1-debugsource-1.8.0-150600.3.2.5 * libSvtAv1Enc1-1.8.0-150600.3.2.5 * SVT-AV1-debuginfo-1.8.0-150600.3.2.5 * libSvtAv1Enc1-debuginfo-1.8.0-150600.3.2.5 * libSvtAv1Dec0-1.8.0-150600.3.2.5 * SVT-AV1-devel-1.8.0-150600.3.2.5 * libSvtAv1Dec0-debuginfo-1.8.0-150600.3.2.5 * SVT-AV1-1.8.0-150600.3.2.5 * openSUSE Leap 15.6 (noarch) * libaom-devel-doc-3.7.1-150600.3.9.3 * openSUSE Leap 15.6 (x86_64) * libyuv0-32bit-20230517+a377993-150600.3.4.2 * libaom3-32bit-debuginfo-3.7.1-150600.3.9.1 * libaom3-32bit-3.7.1-150600.3.9.1 * libyuv0-32bit-debuginfo-20230517+a377993-150600.3.4.2 * openSUSE Leap 15.6 (aarch64_ilp32) * libaom3-64bit-3.7.1-150600.3.9.1 * libaom3-64bit-debuginfo-3.7.1-150600.3.9.1 * libyuv0-64bit-debuginfo-20230517+a377993-150600.3.4.2 * libyuv0-64bit-20230517+a377993-150600.3.4.2 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * libaom3-debuginfo-3.7.1-150600.3.9.1 * aom-tools-debuginfo-3.7.1-150600.3.9.1 * libaom-debugsource-3.7.1-150600.3.9.1 * libaom-devel-3.7.1-150600.3.9.1 * libyuv-tools-20230517+a377993-150600.3.4.2 * libyuv0-20230517+a377993-150600.3.4.2 * libyuv-tools-debuginfo-20230517+a377993-150600.3.4.2 * libyuv0-debuginfo-20230517+a377993-150600.3.4.2 * libaom3-3.7.1-150600.3.9.1 * aom-tools-3.7.1-150600.3.9.1 * libyuv-devel-20230517+a377993-150600.3.4.2 * libyuv-debugsource-20230517+a377993-150600.3.4.2 * SUSE Linux Enterprise Server 15 SP6 LTSS(x86_64) * libyuv0-32bit-20230517+a377993-150600.3.4.2 * libaom3-32bit-3.7.1-150600.3.9.1 * libaom3-32bit-debuginfo-3.7.1-150600.3.9.1 * libyuv0-32bit-debuginfo-20230517+a377993-150600.3.4.2 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 x86_64) * SVT-AV1-debuginfo-1.8.0-150600.3.2.5 * SVT-AV1-debugsource-1.8.0-150600.3.2.5 * libSvtAv1Enc1-1.8.0-150600.3.2.5 * libSvtAv1Enc1-debuginfo-1.8.0-150600.3.2.5 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * libaom-devel-doc-3.7.1-150600.3.9.3 * Basesystem Module 15-SP7 (aarch64 ppc64le s390x x86_64) * libaom-debugsource-3.7.1-150600.3.9.1 * libyuv0-20230517+a377993-150600.3.4.2 * libyuv0-debuginfo-20230517+a377993-150600.3.4.2 * libaom3-3.7.1-150600.3.9.1 * libyuv-debugsource-20230517+a377993-150600.3.4.2 * libaom3-debuginfo-3.7.1-150600.3.9.1 * Basesystem Module 15-SP7 (aarch64 x86_64) * libSvtAv1Enc1-1.8.0-150600.3.2.5 * Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64) * aom-tools-debuginfo-3.7.1-150600.3.9.1 * libaom-debugsource-3.7.1-150600.3.9.1 * libaom-devel-3.7.1-150600.3.9.1 * aom-tools-3.7.1-150600.3.9.1 * libyuv-tools-20230517+a377993-150600.3.4.2 * libyuv-devel-20230517+a377993-150600.3.4.2 * libyuv0-20230517+a377993-150600.3.4.2 * libyuv-tools-debuginfo-20230517+a377993-150600.3.4.2 * libyuv0-debuginfo-20230517+a377993-150600.3.4.2 * libaom3-3.7.1-150600.3.9.1 * libyuv-debugsource-20230517+a377993-150600.3.4.2 * libaom3-debuginfo-3.7.1-150600.3.9.1 * Desktop Applications Module 15-SP7 (aarch64 x86_64) * SVT-AV1-debuginfo-1.8.0-150600.3.2.5 * SVT-AV1-debugsource-1.8.0-150600.3.2.5 * libSvtAv1Enc1-1.8.0-150600.3.2.5 * libSvtAv1Enc1-debuginfo-1.8.0-150600.3.2.5 * Desktop Applications Module 15-SP7 (x86_64) * libaom3-32bit-3.7.1-150600.3.9.1 * libyuv0-32bit-20230517+a377993-150600.3.4.2 * libaom3-32bit-debuginfo-3.7.1-150600.3.9.1 *libyuv0-32bit-debuginfo-20230517+a377993-150600.3.4.2 * Desktop Applications Module 15-SP7 (noarch) * libaom-devel-doc-3.7.1-150600.3.9.3 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64) * SVT-AV1-debugsource-1.8.0-150600.3.2.5 * SVT-AV1-debuginfo-1.8.0-150600.3.2.5 * libSvtAv1Enc1-1.8.0-150600.3.2.5 * libyuv0-32bit-debuginfo-20230517+a377993-150600.3.4.2 * libSvtAv1Enc1-debuginfo-1.8.0-150600.3.2.5 * libaom3-32bit-3.7.1-150600.3.9.1 * libyuv0-32bit-20230517+a377993-150600.3.4.2 * libaom3-32bit-debuginfo-3.7.1-150600.3.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * libaom3-debuginfo-3.7.1-150600.3.9.1 * aom-tools-debuginfo-3.7.1-150600.3.9.1 * libaom-debugsource-3.7.1-150600.3.9.1 * libaom-devel-3.7.1-150600.3.9.1 * aom-tools-3.7.1-150600.3.9.1 * libyuv-tools-20230517+a377993-150600.3.4.2 * libyuv0-20230517+a377993-150600.3.4.2 * libyuv-tools-debuginfo-20230517+a377993-150600.3.4.2 * libaom3-3.7.1-150600.3.9.1 * libyuv0-debuginfo-20230517+a377993-150600.3.4.2 * libyuv-debugsource-20230517+a377993-150600.3.4.2 * libyuv-devel-20230517+a377993-150600.3.4.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * libaom-devel-doc-3.7.1-150600.3.9.3 ## References: * https://www.suse.com/security/cve/CVE-2026-56208.html * https://www.suse.com/security/cve/CVE-2026-56209.html * https://www.suse.com/security/cve/CVE-2026-56210.html * https://www.suse.com/security/cve/CVE-2026-56211.html * https://bugzilla.suse.com/show_bug.cgi?id=1263678 * https://bugzilla.suse.com/show_bug.cgi?id=1268242 * https://bugzilla.suse.com/show_bug.cgi?id=1268650 * https://bugzilla.suse.com/show_bug.cgi?id=1268651 * https://bugzilla.suse.com/show_bug.cgi?id=1268653 * https://bugzilla.suse.com/show_bug.cgi?id=1268655 . An important update for SUSE addresses four issues in SVT-AV1, libyuv0 and libaom3 with significant security fixes.. SUSE Update, Security Fix,Buffer Overflow, Memory Corruption, Code Execution. . Severity: Important. LinuxSecurity.com Team
Jul 24, 2026
•Important
SuSE
89
security advisoryfedoraimportantFedora 43 OpenSlide Important Memory Write Issue CVE-2026-48977
Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977).. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-3c93ea23b5 2026-06-17 08:24:34.389260+00:00 -------------------------------------------------------------------------------- Name : openslide Product : Fedora 43 Version : 4.0.0 Release : 14.fc43 URL : https://openslide.org/ Summary : C library for reading virtual slides Description : The OpenSlide library allows programs to access virtual slide files regardless of the underlying image format. -------------------------------------------------------------------------------- Update Information: Fix arbitrary memory write with crafted Ventana BIF file (CVE-2026-48977). -------------------------------------------------------------------------------- ChangeLog: * Sun Jun 7 2026 Benjamin Gilbert - 4.0.0-14 - Fix CVE-2026-48977 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3c93ea23b5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 17, 2026
•Important
Fedora
98
security advisoryRed Hat Enterprise Linuxmemory safetyRed Hat: RHSA-2023-1479-01 Important: Firefox Memory Safety Issues
An update for firefox is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2023:1479-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1479 Issue date: 2023-03-27 CVE Names: CVE-2023-0767 CVE-2023-25751 CVE-2023-25752 CVE-2023-28162 CVE-2023-28164 CVE-2023-28176 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream E4S (v. 8.1) - ppc64le, x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.9.0 ESR. Security Fix(es): * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767) * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751) * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176) * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752) * Mozilla: Invalid downcast in Worklets (CVE-2023-28162) * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164) Formore details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2170377 - CVE-2023-0767 nss: Arbitrary memory write via PKCS 12 2178458 - CVE-2023-25751 Mozilla: Incorrect code generation during JIT compilation 2178460 - CVE-2023-25752 Mozilla: Potential out-of-bounds when accessing throttled streams 2178466 - CVE-2023-28162 Mozilla: Invalid downcast in Worklets 2178470 - CVE-2023-28164 Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation 2178472 - CVE-2023-28176 Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 6. Package List: Red Hat Enterprise Linux AppStream E4S (v. 8.1): Source: firefox-102.9.0-4.el8_1.src.rpm ppc64le: firefox-102.9.0-4.el8_1.ppc64le.rpm firefox-debuginfo-102.9.0-4.el8_1.ppc64le.rpm firefox-debugsource-102.9.0-4.el8_1.ppc64le.rpm x86_64: firefox-102.9.0-4.el8_1.x86_64.rpm firefox-debuginfo-102.9.0-4.el8_1.x86_64.rpm firefox-debugsource-102.9.0-4.el8_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-0767 https://access.redhat.com/security/cve/CVE-2023-25751 https://access.redhat.com/security/cve/CVE-2023-25752 https://access.redhat.com/security/cve/CVE-2023-28162 https://access.redhat.com/security/cve/CVE-2023-28164 https://access.redhat.com/security/cve/CVE-2023-28176 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZCIHTtzjgjWX9erEAQg1LA//WydqHlnFtd0J2yjS8LfsRpICtcXwV8Ls ZyIxFkx1PsZI8EcZkOFp+sWv7xpAMbas0ojWUuW2Bbj0OIOE1b4G1Rq16TUrdSiG bkdNJdsWtaz2zMWfSwzWz2aBFKlrMJUyME5imnlyPivCoCOfHf52qpweqr/vh3s4 shE7IUypPY79bzOpt3H9jxnNWRyybOen5G1Q/ExEdMrB3RI7cNn1k6XvAUV60L/3 DQbVAV3z2j+lxfb8orj68C6PMM1b8fE+lMgHy5Rw/JGJUwMkZypF1GbE2e9UTtIV aMaOm+tjS83q2utk+g9n7xuDga6a9SmuQmaotjLtOsp158fJcKspCx5hmAO0eLeT PdvXdFhvfUaRMrBN+IMXIaCj6mtqRxpLl6cHO908KS9lJZQKWnmrggWmt12bnufk eWQFjjgyMaxgxTkajbPpKXt7Msp+T1EzSkWdban10GTfv+kd/mVihHMsdlLK8C+l ToIsKJCMeZkBVgL8Qus5CRq9NBrssbQtWMKXphost7USwkMdw7pKn/CHStdm+7oG UI+sERAJNoAuDLihgGTwYc7zpw3aDU/O6SECpuPEZd8AoY1L5gBbot2pIgRHXK7z 2IQG0fOYX/0AKlBgYP0RAj19NRVCXR89KP7rEdChyrBbF5i7mn0kqiuNJ+6VjWDO GH3c+X2WQwU=P4vx -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 27, 2023
•Important
Red Hat
98
security advisoryRed Hat Enterprise LinuximportantRed Hat: RHSA-2023-1366-01 Important: NSS Arbitrary Memory Write Fix
An update for nss is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss security update Advisory ID: RHSA-2023:1366-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1366 Issue date: 2023-03-21 CVE Names: CVE-2023-0767 ==================================================================== 1. Summary: An update for nss is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6 ELS) - i386, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6 ELS) - i386, s390x, x86_64 3. Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, applications using NSS (for example, Firefox) must be restarted for this update to take effect. 5. Bugs fixed(https://bugzilla.redhat.com/): 2170377 - CVE-2023-0767 nss: Arbitrary memory write via PKCS 12 6. Package List: Red Hat Enterprise Linux Server (v. 6 ELS): Source: nss-3.44.0-13.el6_10.src.rpm i386: nss-3.44.0-13.el6_10.i686.rpm nss-debuginfo-3.44.0-13.el6_10.i686.rpm nss-devel-3.44.0-13.el6_10.i686.rpm nss-sysinit-3.44.0-13.el6_10.i686.rpm nss-tools-3.44.0-13.el6_10.i686.rpm s390x: nss-3.44.0-13.el6_10.s390.rpm nss-3.44.0-13.el6_10.s390x.rpm nss-debuginfo-3.44.0-13.el6_10.s390.rpm nss-debuginfo-3.44.0-13.el6_10.s390x.rpm nss-devel-3.44.0-13.el6_10.s390.rpm nss-devel-3.44.0-13.el6_10.s390x.rpm nss-sysinit-3.44.0-13.el6_10.s390x.rpm nss-tools-3.44.0-13.el6_10.s390x.rpm x86_64: nss-3.44.0-13.el6_10.i686.rpm nss-3.44.0-13.el6_10.x86_64.rpm nss-debuginfo-3.44.0-13.el6_10.i686.rpm nss-debuginfo-3.44.0-13.el6_10.x86_64.rpm nss-devel-3.44.0-13.el6_10.i686.rpm nss-devel-3.44.0-13.el6_10.x86_64.rpm nss-sysinit-3.44.0-13.el6_10.x86_64.rpm nss-tools-3.44.0-13.el6_10.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6 ELS): i386: nss-debuginfo-3.44.0-13.el6_10.i686.rpm nss-pkcs11-devel-3.44.0-13.el6_10.i686.rpm s390x: nss-debuginfo-3.44.0-13.el6_10.s390.rpm nss-debuginfo-3.44.0-13.el6_10.s390x.rpm nss-pkcs11-devel-3.44.0-13.el6_10.s390.rpm nss-pkcs11-devel-3.44.0-13.el6_10.s390x.rpm x86_64: nss-debuginfo-3.44.0-13.el6_10.i686.rpm nss-debuginfo-3.44.0-13.el6_10.x86_64.rpm nss-pkcs11-devel-3.44.0-13.el6_10.i686.rpm nss-pkcs11-devel-3.44.0-13.el6_10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-0767 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZBxe+dzjgjWX9erEAQhFjBAAhLDaqqEz2n1SxBUYqkYuLZQDnRrI2mZu Uh4uV4GkaK1hcvQkTQbkvMUQdgJ+3NsEEgwvhsvn5AEC3EiGBlQvfxbdg+QyBulK IpXIBptp4sbwOQZz4arqmHtoyxqqOuI6pmyKu41NqI227AwuaZDm/tMH9MwBlBC3 HHkfRzstQDd9WmUgEAwvxyOvzefmtW3Ocp7dk6RbVj1jRRabG4KRnTY1otM6Zx6z FNR4UtGWcKObyMLDL9IaP07g92KNB9GePIW+yDF5pQA/LaNk/gECr37xjn6j7thL Hx7ZxiSd/lh/FkAbibXnUKZm3El5PJ1jqqAUiTKDV8k9ApvutWh5zBIybvK4YHkR R2hZv2Ed03QmrSuMSkDG1ZFTw8BS6BNkn6itycf9/8vl5YVUgCzina+qWi73bF33 GdrenbA5DtkCpZLWvnbQYL6Vh51m95zIu1UNDvb44+jlp5c/fggqgna1SMbofJj4 InIkuGmbKhNOPZS4VzurxLnntfEH6TT59wLMpzQx/vGDoWW4Itvqr3H5ZHeAFxoo 5/eVrjJalWhrLZVLlk3Bu/4zFXmm5wgT2xqoIwp/9ge9501XP5KW0HpVTbYmVI7X PlAw6KRefapSiS6dPDX2gbP1fQuI+Xyb/iWbGGsGJPWIBJZbG/PAWpt9kOVADLme G8ypk+LVYLk=H/dB -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 23, 2023
•Important
Red Hat
98
security advisoryRed Hatsecurity impactRed Hat Enterprise Linux 8.6 RHSA-2023-1369-01 Important: NSS Update
An update for nss is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss security update Advisory ID: RHSA-2023:1369-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1369 Issue date: 2023-03-21 CVE Names: CVE-2023-0767 ==================================================================== 1. Summary: An update for nss is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream EUS (v.8.6) - aarch64, ppc64le, s390x, x86_64 3. Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, applications using NSS (for example, Firefox) must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2170377 - CVE-2023-0767 nss:Arbitrary memory write via PKCS 12 6. Package List: Red Hat Enterprise Linux AppStream EUS(v.8.6): Source: nss-3.79.0-11.el8_6.src.rpm aarch64: nss-3.79.0-11.el8_6.aarch64.rpm nss-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-debugsource-3.79.0-11.el8_6.aarch64.rpm nss-devel-3.79.0-11.el8_6.aarch64.rpm nss-softokn-3.79.0-11.el8_6.aarch64.rpm nss-softokn-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-softokn-devel-3.79.0-11.el8_6.aarch64.rpm nss-softokn-freebl-3.79.0-11.el8_6.aarch64.rpm nss-softokn-freebl-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-softokn-freebl-devel-3.79.0-11.el8_6.aarch64.rpm nss-sysinit-3.79.0-11.el8_6.aarch64.rpm nss-sysinit-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-tools-3.79.0-11.el8_6.aarch64.rpm nss-tools-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-util-3.79.0-11.el8_6.aarch64.rpm nss-util-debuginfo-3.79.0-11.el8_6.aarch64.rpm nss-util-devel-3.79.0-11.el8_6.aarch64.rpm ppc64le: nss-3.79.0-11.el8_6.ppc64le.rpm nss-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-debugsource-3.79.0-11.el8_6.ppc64le.rpm nss-devel-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-devel-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-freebl-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-freebl-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-softokn-freebl-devel-3.79.0-11.el8_6.ppc64le.rpm nss-sysinit-3.79.0-11.el8_6.ppc64le.rpm nss-sysinit-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-tools-3.79.0-11.el8_6.ppc64le.rpm nss-tools-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-util-3.79.0-11.el8_6.ppc64le.rpm nss-util-debuginfo-3.79.0-11.el8_6.ppc64le.rpm nss-util-devel-3.79.0-11.el8_6.ppc64le.rpm s390x: nss-3.79.0-11.el8_6.s390x.rpm nss-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-debugsource-3.79.0-11.el8_6.s390x.rpm nss-devel-3.79.0-11.el8_6.s390x.rpm nss-softokn-3.79.0-11.el8_6.s390x.rpm nss-softokn-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-softokn-devel-3.79.0-11.el8_6.s390x.rpm nss-softokn-freebl-3.79.0-11.el8_6.s390x.rpm nss-softokn-freebl-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-softokn-freebl-devel-3.79.0-11.el8_6.s390x.rpm nss-sysinit-3.79.0-11.el8_6.s390x.rpm nss-sysinit-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-tools-3.79.0-11.el8_6.s390x.rpm nss-tools-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-util-3.79.0-11.el8_6.s390x.rpm nss-util-debuginfo-3.79.0-11.el8_6.s390x.rpm nss-util-devel-3.79.0-11.el8_6.s390x.rpm x86_64: nss-3.79.0-11.el8_6.i686.rpm nss-3.79.0-11.el8_6.x86_64.rpm nss-debuginfo-3.79.0-11.el8_6.i686.rpm nss-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-debugsource-3.79.0-11.el8_6.i686.rpm nss-debugsource-3.79.0-11.el8_6.x86_64.rpm nss-devel-3.79.0-11.el8_6.i686.rpm nss-devel-3.79.0-11.el8_6.x86_64.rpm nss-softokn-3.79.0-11.el8_6.i686.rpm nss-softokn-3.79.0-11.el8_6.x86_64.rpm nss-softokn-debuginfo-3.79.0-11.el8_6.i686.rpm nss-softokn-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-softokn-devel-3.79.0-11.el8_6.i686.rpm nss-softokn-devel-3.79.0-11.el8_6.x86_64.rpm nss-softokn-freebl-3.79.0-11.el8_6.i686.rpm nss-softokn-freebl-3.79.0-11.el8_6.x86_64.rpm nss-softokn-freebl-debuginfo-3.79.0-11.el8_6.i686.rpm nss-softokn-freebl-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-softokn-freebl-devel-3.79.0-11.el8_6.i686.rpm nss-softokn-freebl-devel-3.79.0-11.el8_6.x86_64.rpm nss-sysinit-3.79.0-11.el8_6.x86_64.rpm nss-sysinit-debuginfo-3.79.0-11.el8_6.i686.rpm nss-sysinit-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-tools-3.79.0-11.el8_6.x86_64.rpm nss-tools-debuginfo-3.79.0-11.el8_6.i686.rpm nss-tools-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-util-3.79.0-11.el8_6.i686.rpm nss-util-3.79.0-11.el8_6.x86_64.rpm nss-util-debuginfo-3.79.0-11.el8_6.i686.rpm nss-util-debuginfo-3.79.0-11.el8_6.x86_64.rpm nss-util-devel-3.79.0-11.el8_6.i686.rpm nss-util-devel-3.79.0-11.el8_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-0767 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZBxe+dzjgjWX9erEAQhxThAAncbzzk8O2pR0kgLFuauZT05d+6OiHliy cujTVCrOn4QVK5WT4Kxw1MZdEB+D8x47HwcYOGGrLGvZku682KMK8jGEfmGOqlL/ ufYrTKGmtDxzDTyuJzBXVysK/LSx0liyjB7b8XNeYNX0663s4dF5BOzWxRaokOIa +5DTYuU1ZdYzEwAGq4oezHqZDRxB4XQ95rQT6UhGZvc4an5GMrrwzXwnwwZj5qP3 wUPwtF6FtcqmhO5gAMiYK1jwCyBLssI7zwkU4iJrk3ylMv0WY7o+21ODcCJhtuKy BCImIdneoHE9+fRHPf/8fT0SnnLdVOIRGrb7UyV8/cGIaNNgBYoxNSb/ViTBpUsx ofPsyBYQKP26UPLzNgRdFMPUPKUhUkautzrA1a8hp7UiUJltHefEHUfb73Tc46LJ CAeDW+gvk+xBUM69NM1ACoXHI2jB24AsoryIZ9SaMCfPlGtWW5HNwIjpllsG3B8E +CeU+Q985ah+kTYZ0emzYTWYDSyeMu21ytMIfD+0pg7oP9SnIknn4iT8/Wv2tmpv Jm8W+dgk92Paj+IBt9YUpjZwbqeDbPZjP7ULuJTsAPewGtajbzS72XHJj3vkxgXE YMIJt/XoJ06GJ1axSr2OnM40iGfZADNvnEEXvS22nalRSmu0sxXrC8JQKfmmutfY 5qGORpZhD9U=wDdo -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 23, 2023
•Important
Red Hat
98
security advisorysecurity updatered hatRed Hat Enterprise Linux 8.1 RHSA-2023-1436-01 Important: NSS Memory Issue
An update for nss is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss security update Advisory ID: RHSA-2023:1436-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1436 Issue date: 2023-03-23 CVE Names: CVE-2023-0767 ==================================================================== 1. Summary: An update for nss is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, ppc64le, s390x, x86_64 3. Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing this update, applications using NSS (for example, Firefox) must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2170377 -CVE-2023-0767 nss: Arbitrary memory write via PKCS 12 6. Package List: Red Hat Enterprise Linux AppStream E4S (v.8.1): Source: nss-3.44.0-11.el8_1.src.rpm aarch64: nss-3.44.0-11.el8_1.aarch64.rpm nss-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-debugsource-3.44.0-11.el8_1.aarch64.rpm nss-devel-3.44.0-11.el8_1.aarch64.rpm nss-softokn-3.44.0-11.el8_1.aarch64.rpm nss-softokn-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-softokn-devel-3.44.0-11.el8_1.aarch64.rpm nss-softokn-freebl-3.44.0-11.el8_1.aarch64.rpm nss-softokn-freebl-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-softokn-freebl-devel-3.44.0-11.el8_1.aarch64.rpm nss-sysinit-3.44.0-11.el8_1.aarch64.rpm nss-sysinit-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-tools-3.44.0-11.el8_1.aarch64.rpm nss-tools-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-util-3.44.0-11.el8_1.aarch64.rpm nss-util-debuginfo-3.44.0-11.el8_1.aarch64.rpm nss-util-devel-3.44.0-11.el8_1.aarch64.rpm ppc64le: nss-3.44.0-11.el8_1.ppc64le.rpm nss-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-debugsource-3.44.0-11.el8_1.ppc64le.rpm nss-devel-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-devel-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-freebl-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-freebl-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-softokn-freebl-devel-3.44.0-11.el8_1.ppc64le.rpm nss-sysinit-3.44.0-11.el8_1.ppc64le.rpm nss-sysinit-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-tools-3.44.0-11.el8_1.ppc64le.rpm nss-tools-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-util-3.44.0-11.el8_1.ppc64le.rpm nss-util-debuginfo-3.44.0-11.el8_1.ppc64le.rpm nss-util-devel-3.44.0-11.el8_1.ppc64le.rpm s390x: nss-3.44.0-11.el8_1.s390x.rpm nss-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-debugsource-3.44.0-11.el8_1.s390x.rpm nss-devel-3.44.0-11.el8_1.s390x.rpm nss-softokn-3.44.0-11.el8_1.s390x.rpm nss-softokn-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-softokn-devel-3.44.0-11.el8_1.s390x.rpm nss-softokn-freebl-3.44.0-11.el8_1.s390x.rpm nss-softokn-freebl-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-softokn-freebl-devel-3.44.0-11.el8_1.s390x.rpm nss-sysinit-3.44.0-11.el8_1.s390x.rpm nss-sysinit-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-tools-3.44.0-11.el8_1.s390x.rpm nss-tools-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-util-3.44.0-11.el8_1.s390x.rpm nss-util-debuginfo-3.44.0-11.el8_1.s390x.rpm nss-util-devel-3.44.0-11.el8_1.s390x.rpm x86_64: nss-3.44.0-11.el8_1.i686.rpm nss-3.44.0-11.el8_1.x86_64.rpm nss-debuginfo-3.44.0-11.el8_1.i686.rpm nss-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-debugsource-3.44.0-11.el8_1.i686.rpm nss-debugsource-3.44.0-11.el8_1.x86_64.rpm nss-devel-3.44.0-11.el8_1.i686.rpm nss-devel-3.44.0-11.el8_1.x86_64.rpm nss-softokn-3.44.0-11.el8_1.i686.rpm nss-softokn-3.44.0-11.el8_1.x86_64.rpm nss-softokn-debuginfo-3.44.0-11.el8_1.i686.rpm nss-softokn-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-softokn-devel-3.44.0-11.el8_1.i686.rpm nss-softokn-devel-3.44.0-11.el8_1.x86_64.rpm nss-softokn-freebl-3.44.0-11.el8_1.i686.rpm nss-softokn-freebl-3.44.0-11.el8_1.x86_64.rpm nss-softokn-freebl-debuginfo-3.44.0-11.el8_1.i686.rpm nss-softokn-freebl-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-softokn-freebl-devel-3.44.0-11.el8_1.i686.rpm nss-softokn-freebl-devel-3.44.0-11.el8_1.x86_64.rpm nss-sysinit-3.44.0-11.el8_1.x86_64.rpm nss-sysinit-debuginfo-3.44.0-11.el8_1.i686.rpm nss-sysinit-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-tools-3.44.0-11.el8_1.x86_64.rpm nss-tools-debuginfo-3.44.0-11.el8_1.i686.rpm nss-tools-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-util-3.44.0-11.el8_1.i686.rpm nss-util-3.44.0-11.el8_1.x86_64.rpm nss-util-debuginfo-3.44.0-11.el8_1.i686.rpm nss-util-debuginfo-3.44.0-11.el8_1.x86_64.rpm nss-util-devel-3.44.0-11.el8_1.i686.rpm nss-util-devel-3.44.0-11.el8_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2023-0767 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details athttps://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZBxe+dzjgjWX9erEAQhrWhAAgZfHZ94hz+Gy3YkKFW4i7iY/wu28fMZ4 nBGv+xbT2nOU5EiJUW9ylJPXbI1rnZ0pqiKlIHnF/gFkmvy9dWfE8cbXCkNdeRLf 0UD1WlL3y9egjkcu/2A+kSBebnwjPMd7OSGWVruwD+CZ6dZ8nNoY6lGQdvpo8lOc Y55Zm3yYAT2sClkmwF3n77bk8qspTMSTjagbe+74h9dV4xcwPXcEta+hm3H2sPBw NOTin5oJkpzusspRb5zKOo5zBq00odLUuVL2u2MFjhmJuQ5Cugj0EAbjGY91//zW oUiiTaIZznfXshz+uS0M1ZGi1gEmV/JnIvQyjsgGh51h1j/gjQWF2yFASiiw4iVx d6sLXXKQCpBYoafJsrIVRIXEwG/cQacdh09YjZ4R073fggo/5pJ55Y91pZc0l4g5 s7xjM2dYaQihj+/AlEbd3KtxXn8zVNNLi+2EEn4geqymKtDw3WH7JtcxiqFK0cfM T3fjiWoqrZu6lFlVg/7TGe9SJqL+bLHjDx9Wzd+WUjThkkdZSIsxj2tljmzm4kas /4n3rSCsST8TkzA1Rw5ePjv3fh2qCBsMZdM8C3KWJEO+3aLcD9fMlk3z7OUkhGx/ WfWPHLYFRooXg1KlKIG0mryar5iRP45c/j57ZzNeS9mj2paRZ1Vk/V6TpMP9EsAt +nr+vBFWM7A=aVhu -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 23, 2023
•Important
Red Hat
219
security advisorysoftware updatecritical fixRocky Linux 8: RLSA-2023:0821 Important: Thunderbird Security Update
Important: thunderbird security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2023:0821", "synopsis": "Important: thunderbird security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for thunderbird.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 102.8.0.\n\nSecurity Fix(es):\n\n* Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)\n\n* Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)\n\n* Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)\n\n* Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)\n\n* Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)\n\n* Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)\n\n* Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)\n\n* Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)\n\n* Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)\n\n* Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)\n\n* Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)\n\n* Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2170374", "sourceBy": "Red Hat", "sourceLink":"https://bugzilla.redhat.com/show_bug.cgi?id=2170374", "description": ""}, {"ticket": "2170375", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170375", "description": ""}, {"ticket": "2170376", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170376", "description": ""}, {"ticket": "2170377", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170377", "description": ""}, {"ticket": "2170378", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170378", "description": ""}, {"ticket": "2170379", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170379", "description": ""}, {"ticket": "2170381", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170381", "description": ""}, {"ticket": "2170382", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170382", "description": ""}, {"ticket": "2170383", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170383", "description": ""}, {"ticket": "2170390", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170390", "description": ""}, {"ticket": "2170391", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170391", "description": ""}, {"ticket": "2170402", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2170402", "description": ""}, {"ticket": "2171397", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2171397", "description": ""}], "cves": [{"name": "CVE-2023-0616", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-0616", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "cvss3BaseScore": "4.3", "cwe": "CWE-449"}, {"name": "CVE-2023-0767", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-0767","cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-119"}, {"name": "CVE-2023-25728", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25728", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-1021"}, {"name": "CVE-2023-25729", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25729", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "cvss3BaseScore": "6.1", "cwe": "CWE-84"}, {"name": "CVE-2023-25730", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25730", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-821"}, {"name": "CVE-2023-25732", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25732", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "cvss3BaseScore": "6.1", "cwe": "CWE-787"}, {"name": "CVE-2023-25735", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25735", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-416"}, {"name": "CVE-2023-25737", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25737", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-704"}, {"name": "CVE-2023-25739", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25739", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-416"}, {"name": "CVE-2023-25742", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25742", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "cvss3BaseScore": "4.3", "cwe": "CWE-173"}, {"name": "CVE-2023-25743", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25743","cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-357"}, {"name": "CVE-2023-25744", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25744", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-120"}, {"name": "CVE-2023-25746", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2023-25746", "cvss3ScoringVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvss3BaseScore": "7.5", "cwe": "CWE-120"}], "references": [], "publishedAt": "2023-02-22T01:08:53.668036Z", "rpms": {"Rocky Linux 8": {"nvras": ["thunderbird-0:102.8.0-2.el8_7.src.rpm", "thunderbird-0:102.8.0-2.el8_7.aarch64.rpm", "thunderbird-0:102.8.0-2.el8_7.x86_64.rpm", "thunderbird-debuginfo-0:102.8.0-2.el8_7.aarch64.rpm", "thunderbird-debuginfo-0:102.8.0-2.el8_7.x86_64.rpm", "thunderbird-debugsource-0:102.8.0-2.el8_7.aarch64.rpm", "thunderbird-debugsource-0:102.8.0-2.el8_7.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Stay informed about the essential security patches for Thunderbird that impact Rocky Linux 8 and recognize the significance of applying them promptly.. Thunderbird Security Update, Rocky Linux 8, Memory Safety Bugs, Security Patch, Software Safety. . Severity: Important. LinuxSecurity.com Team
Feb 22, 2023
•Important
Rocky Linux
98
security advisorybrowser securityred hat enterpriseRed Hat Enterprise: RHSA-2023-0812-01 Important: Firefox Security Fix
An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2023:0812-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:0812 Issue date: 2023-02-20 CVE Names: CVE-2023-0767 CVE-2023-25728 CVE-2023-25729 CVE-2023-25730 CVE-2023-25732 CVE-2023-25735 CVE-2023-25737 CVE-2023-25739 CVE-2023-25742 CVE-2023-25743 CVE-2023-25744 CVE-2023-25746 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.8.0 ESR. Security Fix(es): * Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767) * Mozilla:Content security policy leak in violation reports using iframes (CVE-2023-25728) * Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730) * Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735) * Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737) * Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739) * Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743) * Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744) * Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746) * Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729) * Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732) * Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2170374 - CVE-2023-25728 Mozilla: Content security policy leak in violation reports using iframes 2170375 - CVE-2023-25730 Mozilla: Screen hijack via browser fullscreen mode 2170376 - CVE-2023-25743 Mozilla: Fullscreen notification not shown in Firefox Focus 2170377 - CVE-2023-0767 Mozilla: Arbitrary memory write via PKCS 12 in NSS 2170378 - CVE-2023-25735 Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey 2170379 - CVE-2023-25737 Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry 2170381 - CVE-2023-25739 Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext 2170382 - CVE-2023-25729Mozilla: Extensions could have opened external schemes without user knowledge 2170383 - CVE-2023-25732 Mozilla: Out of bounds memory write from EncodeInputStream 2170390 - CVE-2023-25742 Mozilla: Web Crypto ImportKey crashes tab 2170391 - CVE-2023-25744 Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 2170402 - CVE-2023-25746 Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: firefox-102.8.0-2.el7_9.src.rpm x86_64: firefox-102.8.0-2.el7_9.x86_64.rpm firefox-debuginfo-102.8.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: firefox-102.8.0-2.el7_9.i686.rpm firefox-debuginfo-102.8.0-2.el7_9.i686.rpm Red Hat Enterprise Linux Server (v. 7): Source: firefox-102.8.0-2.el7_9.src.rpm ppc64: firefox-102.8.0-2.el7_9.ppc64.rpm firefox-debuginfo-102.8.0-2.el7_9.ppc64.rpm ppc64le: firefox-102.8.0-2.el7_9.ppc64le.rpm firefox-debuginfo-102.8.0-2.el7_9.ppc64le.rpm s390x: firefox-102.8.0-2.el7_9.s390x.rpm firefox-debuginfo-102.8.0-2.el7_9.s390x.rpm x86_64: firefox-102.8.0-2.el7_9.x86_64.rpm firefox-debuginfo-102.8.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): x86_64: firefox-102.8.0-2.el7_9.i686.rpm firefox-debuginfo-102.8.0-2.el7_9.i686.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: firefox-102.8.0-2.el7_9.src.rpm x86_64: firefox-102.8.0-2.el7_9.x86_64.rpm firefox-debuginfo-102.8.0-2.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: firefox-102.8.0-2.el7_9.i686.rpm firefox-debuginfo-102.8.0-2.el7_9.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2023-0767 https://access.redhat.com/security/cve/CVE-2023-25728 https://access.redhat.com/security/cve/CVE-2023-25729 https://access.redhat.com/security/cve/CVE-2023-25730 https://access.redhat.com/security/cve/CVE-2023-25732 https://access.redhat.com/security/cve/CVE-2023-25735 https://access.redhat.com/security/cve/CVE-2023-25737 https://access.redhat.com/security/cve/CVE-2023-25739 https://access.redhat.com/security/cve/CVE-2023-25742 https://access.redhat.com/security/cve/CVE-2023-25743 https://access.redhat.com/security/cve/CVE-2023-25744 https://access.redhat.com/security/cve/CVE-2023-25746 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY/NnhdzjgjWX9erEAQiaJA//fsocU/rayo7s9DNeeFJaS7i3D2mp94om rSg4O9c4ZqwX7etBJTv3qM9FFAxY0M50GmVuJd70Jst03FLH/XY7vrUGkmLZmfw0 YzGxp4o9pOF3tBiIx0ohR39+hGFGiZz40514jS1m6t4+aJP1y5EvTApd2XBMiWRq 7bUhIShTyvKirsmvZ1kWObTAKI6p0PBPeTB+8odUiB3v9U6OickZ5WlZACSawhLp 3wJUNisgYR6ORGbhAW3qEKhkOXePOefwOT7GydckszVJmjAibgv+DPYj8dD1szoH q4S0D1tgPop7LSBRxHEYwy42Vlww/MVdSf0rsz8c+mCiQXfVNfcqpob29SVmy7NK j8A01IrGHvEbwGENmDpyn4kU4VuuaTBotIBSsAStV9NTFkvdtsBcQdMDXCqoPKs+ rVP1bskHH9Vt6CKLcuYUWBXI8BhSvbL//vwiflZk3z/4W+DDe4tdNnFqCcAyoIPn iEr2HJ2ivhcrYWrZ4MlkhMaS+GJ+sEpWxZKuf/SfQQU9hEPV6uqOch+8kPqUgcVj HF+OWqeS+MU04msFDliUWNlzjkCVg9XsAy88y/VeQnm3o5NRvUqnfDoOn85Rwigm GHQaVqjZMU5fQOYKurAkmXISGfJjuDeO8YdSeSa8iOo6AYpm0SRwUXKai7OgtVq9 oAvzakdRB7s=tfXq -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Feb 20, 2023
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!