Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
219
security advisorycritical updateresource managementRocky Linux 8 RLSA-2025:1612 critical: Node.js Performance Issues
Important: nodejs:22 security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2025:1611", "synopsis": "Important: nodejs:22 security update", "severity": "SEVERITY_IMPORTANT", "topic": "An update is available for module.nodejs-packaging, nodejs-nodemon, nodejs-packaging, module.nodejs-nodemon, nodejs, module.nodejs.\nThis update affects Rocky Linux 8.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. \n\nSecurity Fix(es):\n\n* undici: Undici Uses Insufficiently Random Values (CVE-2025-22150)\n\n* nodejs: Node.js Worker Thread Exposure via Diagnostics Channel (CVE-2025-23083)\n\n* nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 8"], "fixes": [{"ticket": "2339176", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2339176", "description": ""}, {"ticket": "2339392", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2339392", "description": ""}, {"ticket": "2342618", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2342618", "description": ""}], "cves": [{"name": "CVE-2025-22150", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-22150", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2025-23083", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-23083", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2025-23085", "sourceBy": "MITRE","sourceLink": "https://www.cve.org/CVERecord?id=CVE-2025-23085", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}], "references": [], "publishedAt": "2025-02-26T19:09:52.852483Z", "rpms": {"Rocky Linux 8": {"nvras": ["nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.src.rpm", "nodejs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-debugsource-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-debugsource-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-devel-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-devel-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-docs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.noarch.rpm", "nodejs-full-i18n-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-full-i18n-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-libs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-libs-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-libs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "nodejs-libs-debuginfo-1:22.13.1-1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+1666+930e28e8.noarch.rpm", "nodejs-nodemon-0:3.0.1-1.module+el8.10.0+1666+930e28e8.src.rpm", "nodejs-packaging-0:2021.06-4.module+el8.10.0+1667+4a788d89.noarch.rpm", "nodejs-packaging-0:2021.06-4.module+el8.10.0+1667+4a788d89.src.rpm", "nodejs-packaging-bundler-0:2021.06-4.module+el8.10.0+1667+4a788d89.noarch.rpm", "npm-1:10.9.2-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm", "npm-1:10.9.2-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm", "v8-12.4-devel-3:12.4.254.21-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.aarch64.rpm","v8-12.4-devel-3:12.4.254.21-1.22.13.1.1.module+el8.10.0+1935+d3cbe60f.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Latest Node.js security updates for Rocky Linux tackle serious vulnerabilities related to resource handling and randomness deficiencies.. NodeJS Security Update, Rocky Linux Advisories, Important Software Patches. . Severity: Important. LinuxSecurity.com Team
Feb 26, 2025
•Important
Rocky Linux
89
security advisorybuffer overflowcriticalFedora 40 glibc: 2025-69207650a4 critical: buffer overflow and randomness
This update addresses two security vulnerabilities: * CVE-2025-0395: A buffer overflow may occur in the assert function with certain large program names and assert expressions. * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program creates additional threads after fork.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-69207650a4 2025-01-27 01:55:15.215467+00:00 -------------------------------------------------------------------------------- Name : glibc Product : Fedora 40 Version : 2.39 Release : 37.fc40 URL : http://www.gnu.org/software/glibc/ Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function. -------------------------------------------------------------------------------- Update Information: This update addresses two security vulnerabilities: * CVE-2025-0395: A buffer overflow may occur in the assert function with certain large program names and assert expressions. * CVE-2025-0577: getrandom, arc4random can produce predictable randomness if a multi-threaded program creates additional threads after fork. The following non-security bugs are fixed: * Compatibility with certain programs that call free(environ) is improved (however, deallocating environ remains undefined in general). * Crashes in string functions on certain hypervisors that report L3 cache sizes above 4 GiB are avoided. * Poor performance of x86-64 string functions in certain cases. * Initialization of the restartable sequence area nowfollows recommended practices. -------------------------------------------------------------------------------- ChangeLog: * Fri Jan 24 2025 Florian Weimer - 2.39-37 - setenv: Rework free(environ) compatibility support (RHEL-75809) * Thu Jan 23 2025 Florian Weimer - 2.39-36 - CVE-2025-0577: vDSO getrandom predictable randomness after fork (RHEL-75555) * Thu Jan 23 2025 Florian Weimer - 2.39-35 - Restore compatibility with environ/malloc usage pattern (RHEL-75809) * Thu Jan 23 2025 Florian Weimer - 2.39-34 - Sync with upstream branch release/2.39/master, commit 808a84a8b81468b517a4d721fdc62069cb8c211f: - Fix underallocation of abort_msg_s struct (CVE-2025-0395) - x86/string: Fixup alignment of main loop in str{n}cmp-evex [BZ #32212] - x86: Improve large memset perf with non-temporal stores [RHEL-29312] - x86: Avoid integer truncation with large cache sizes (bug 32470) - math: Exclude internal math symbols for tests [BZ #32414] - malloc: add indirection for malloc(-like) functions in tests [BZ #32366] - Pass -nostdlib -nostartfiles together with -r [BZ #31753] - nptl: initialize cpu_id_start prior to rseq registration - nptl: initialize rseq area prior to registration -------------------------------------------------------------------------------- References: [ 1 ] Bug #2338960 - glibc: getrandom, arc4random can return predictable data after fork (CVE-2025-0577) https://bugzilla.redhat.com/show_bug.cgi?id=2338960 [ 2 ] Bug #2341630 - CVE-2025-0395 glibc: buffer overflow in the GNU C Library's assert() [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2341630 [ 3 ] Bug #2341852 - CVE-2025-0577 glibc: vDSO getrandom acceleration may return predictable randomness [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2341852 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-69207650a4' at thecommand line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jan 27, 2025
•Critical
Fedora
89
security advisoryfedoracriticalFedora 40 - FEDORA-2024-2e27372d4c Critical: qt5-qt3d Randomness Threat
Qt 5.15.14 bugfix update. Fix CVE-2024-36048. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-2e27372d4c 2024-06-05 01:40:23.602023 -------------------------------------------------------------------------------- Name : qt5-qt3d Product : Fedora 40 Version : 5.15.14 Release : 1.fc40 URL : http://www.qt.io Summary : Qt5 - Qt3D QML bindings and C++ APIs Description : Qt 3D provides functionality for near-realtime simulation systems with support for 2D and 3D rendering in both Qt C++ and Qt Quick applications). -------------------------------------------------------------------------------- Update Information: Qt 5.15.14 bugfix update. Fix CVE-2024-36048 -------------------------------------------------------------------------------- ChangeLog: * Wed May 29 2024 Jan Grulich - 5.15.14-1 - 5.15.14 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2282866 - CVE-2024-36048 qt5-qtnetworkauth: qtnetworkauth: badly seeded PRNG may result in guessable values [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=2282866 [ 2 ] Bug #2282867 - CVE-2024-36048 qt5-qtnetworkauth: qtnetworkauth: badly seeded PRNG may result in guessable values [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2282867 [ 3 ] Bug #2282869 - CVE-2024-36048 qt5-qtnetworkauth: qtnetworkauth: badly seeded PRNG may result in guessable values [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2282869 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-2e27372d4c' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key.More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 05, 2024
•Critical
Fedora
98
security advisoryRed HatHTTP issueRed Hat 8 RHSA-2022-7821-01 Critical: Node.js HTTP Randomness Issues
An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nodejs:18 security update Advisory ID: RHSA-2022:7821-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:7821 Issue date: 2022-11-08 CVE Names: CVE-2022-35255 CVE-2022-35256 ==================================================================== 1. Summary: An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18.9.1). (BZ#2130559, BZ#2131750) Security Fix(es): * nodejs: weak randomness in WebCrypto keygen (CVE-2022-35255) * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugsfixed (https://bugzilla.redhat.com/): 2130517 - CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen 2130518 - CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields 6. Package List: Red Hat Enterprise Linux AppStream (v.8): Source: nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.src.rpm nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.src.rpm nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.src.rpm aarch64: nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.aarch64.rpm npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.aarch64.rpm noarch: nodejs-docs-18.9.1-1.module+el8.7.0+16806+4109802b.noarch.rpm nodejs-nodemon-2.0.19-1.module+el8.7.0+16061+0a247725.noarch.rpm nodejs-packaging-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm nodejs-packaging-bundler-2021.06-4.module+el8.7.0+15582+19c314fa.noarch.rpm ppc64le: nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.ppc64le.rpm npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.ppc64le.rpm s390x: nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.s390x.rpm npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.s390x.rpm x86_64: nodejs-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm nodejs-debuginfo-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm nodejs-debugsource-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm nodejs-devel-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm nodejs-full-i18n-18.9.1-1.module+el8.7.0+16806+4109802b.x86_64.rpm npm-8.19.1-1.18.9.1.1.module+el8.7.0+16806+4109802b.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2022-35255 https://access.redhat.com/security/cve/CVE-2022-35256 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBY2pSJNzjgjWX9erEAQjaww/9FwAgM6VhLuL/A6jOAoTuAbjXIPjLq3bf BycFTPsYskS5aXT7hJUyT8WJQobCaw1J0e5c/+QnjJW1/9RNeAfoVNpuGyrnunXA 4Ferj6qFwWHtzr0b2noQW0mzuOm6Ecen9r30vl58e+mgpmolrDWtf+Wsm/5fxuC4 9CUfdJ7doifnNbrnmBGNOaINHflSAPo+GUZvvrPozYv74uuE2hmMTzM6rtg5EXqG hEI0zLJzTf3KWsKW6iIOWlOA2Kppn7JRsjNK2DQIotSSTmfNhS0AybKfp30Mgyia fxcOV0hdFqMq7HrOd/daP61DhhmyAECgYUCrhnVl01ntLQAPmmTmSihOHxrTbZcJ HewcOKlos2GgnQAX+DoMREn6KnvFTXT2xU0vO/X8Pbl2TyQ8B89Jb8m3hR71OBnG ARBDiEG9yWQaMLqrI9YHcsOR+4DxsXgecjItc3Bd9jbBKkLgnTi1efEjW/SdjU9b GWhL/2DVPOT9yg/j/+/me8+3c9O7vnePN7zaxUEoZ0DmdsDKlOzrC/D69thVIqXY JSQ8cINZ37RiCNRxcEvMQpwm/y79OCWVGdPptsluBapNDur5qeg2KrDYeHYsMXGF X9D6fP1Vod455kt+TxJCijA9XYT0JG7BA+KA5esIT2reCTvgQlP5QaEWqlNI39d4 z9dijpwH2po=+8w0 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 08, 2022
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!