An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security, bug fix, and enhancement update Advisory ID: RHSA-2023:1554-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1554 Issue date: 2023-04-04 CVE Names: CVE-2023-0266 CVE-2023-0386 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat CodeReady Linux Builder EUS (v.8.6) - aarch64, ppc64le, x86_64 Red Hat Enterprise Linux BaseOS EUS (v.8.6) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: FUSE filesystem low-privileged user privileges escalation (CVE-2023-0386) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * RHEL 8.7: please integrate "powerpc/64/kdump: Limit kdump base to 512MB" patch. (BZ#2154272) * Redhat OpenShift: Error downloading big ZIP files inside pod on power OCP and pod gettingrestarted (BZ#2160222) * RHEL8.4: s390/kexec: fix ipl report address for kdump (BZ#2166297) * Unable to get QinQ working with ConnectX-4 Lx in SR-IOV scenario (BZ#2166666) * mlx5: lag and sriov fixes (BZ#2167648) * New algorithm limits needed in FIPS mode (BZ#2167771) * RHEL8.4: dasd: fix no record found for raw_track_access (BZ#2167777) * kernel panics if iwlwifi firmware can not be loaded (BZ#2169664) * CSB.V bit never becomes valid for NX Gzip job during LPAR migration (BZ#2170855) * Backport Request for locking/rwsem commits (BZ#2170940) * ipv6 traffic stop when an sriov vf have ipv6 address (BZ#2172551) * Hyper-V RHEL8.8: Update MANA driver (BZ#2173104) * Disable 3DES in FIPS mode (BZ#2176523) * Soft lockup occurred during __page_mapcount (BZ#2177139) * Task hangs in blk_mq_get_tag while no tags are in use (BZ#2178225) * Node locked up and not responsive due to potential rcu stall (BZ#2178273) Enhancement(s): * Intel 8.8 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168385) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 2159505 - CVE-2023-0386 kernel: FUSE filesystem low-privileged user privileges escalation 2163379 - CVE-2023-0266 ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF 6. Package List: Red Hat Enterprise Linux BaseOS EUS(v.8.6): Source: kernel-4.18.0-372.51.1.el8_6.src.rpm aarch64: bpftool-4.18.0-372.51.1.el8_6.aarch64.rpm bpftool-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-core-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-cross-headers-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-core-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-devel-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-modules-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-modules-extra-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debuginfo-common-aarch64-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-devel-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-headers-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-modules-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-modules-extra-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-tools-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-tools-libs-4.18.0-372.51.1.el8_6.aarch64.rpm perf-4.18.0-372.51.1.el8_6.aarch64.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm python3-perf-4.18.0-372.51.1.el8_6.aarch64.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm noarch: kernel-abi-stablelists-4.18.0-372.51.1.el8_6.noarch.rpm kernel-doc-4.18.0-372.51.1.el8_6.noarch.rpm ppc64le: bpftool-4.18.0-372.51.1.el8_6.ppc64le.rpm bpftool-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-core-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-cross-headers-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-core-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-devel-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-modules-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-modules-extra-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-devel-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-headers-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-modules-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-modules-extra-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-tools-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-tools-libs-4.18.0-372.51.1.el8_6.ppc64le.rpm perf-4.18.0-372.51.1.el8_6.ppc64le.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm python3-perf-4.18.0-372.51.1.el8_6.ppc64le.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm s390x: bpftool-4.18.0-372.51.1.el8_6.s390x.rpm bpftool-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm kernel-4.18.0-372.51.1.el8_6.s390x.rpm kernel-core-4.18.0-372.51.1.el8_6.s390x.rpm kernel-cross-headers-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-core-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-devel-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-modules-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debug-modules-extra-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm kernel-debuginfo-common-s390x-4.18.0-372.51.1.el8_6.s390x.rpm kernel-devel-4.18.0-372.51.1.el8_6.s390x.rpm kernel-headers-4.18.0-372.51.1.el8_6.s390x.rpm kernel-modules-4.18.0-372.51.1.el8_6.s390x.rpm kernel-modules-extra-4.18.0-372.51.1.el8_6.s390x.rpm kernel-tools-4.18.0-372.51.1.el8_6.s390x.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-core-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-devel-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-modules-4.18.0-372.51.1.el8_6.s390x.rpm kernel-zfcpdump-modules-extra-4.18.0-372.51.1.el8_6.s390x.rpm perf-4.18.0-372.51.1.el8_6.s390x.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm python3-perf-4.18.0-372.51.1.el8_6.s390x.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.s390x.rpm x86_64: bpftool-4.18.0-372.51.1.el8_6.x86_64.rpm bpftool-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-core-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-cross-headers-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-core-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-devel-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-modules-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-modules-extra-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debuginfo-common-x86_64-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-devel-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-headers-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-modules-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-modules-extra-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-tools-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-tools-libs-4.18.0-372.51.1.el8_6.x86_64.rpm perf-4.18.0-372.51.1.el8_6.x86_64.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm python3-perf-4.18.0-372.51.1.el8_6.x86_64.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm Red Hat CodeReady Linux Builder EUS(v.8.6): aarch64: bpftool-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-debuginfo-common-aarch64-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm kernel-tools-libs-devel-4.18.0-372.51.1.el8_6.aarch64.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.aarch64.rpm ppc64le: bpftool-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-debuginfo-common-ppc64le-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm kernel-tools-libs-devel-4.18.0-372.51.1.el8_6.ppc64le.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.ppc64le.rpm x86_64: bpftool-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debug-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-debuginfo-common-x86_64-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-tools-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm kernel-tools-libs-devel-4.18.0-372.51.1.el8_6.x86_64.rpm perf-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm python3-perf-debuginfo-4.18.0-372.51.1.el8_6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2023-0266 https://access.redhat.com/security/cve/CVE-2023-0386 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZCvqtdzjgjWX9erEAQih1Q//bDhxvHa7hZCDTgPyxpwCQQH+Jb2bFqrt v6PdwbdHLdrYVyxl0Oj7Uwsw0Dg4u+8rUs6KMm2bnI7/elzKLIYj8N6uo8oWRSgI iJgGZmK0/JBlALezRDoQc0vVEgaGY5TP0JmVhDhieKmbxDK0Dmh5AEYKkCZpTu4E OSIRZ7Bk54zHJQdtNhrZLetZP8YuPSy6/EVLy/nzyc5gJ3DZhKnArgzNYn/DzjG1 aXD2BS41Efs9BChREgAEGr+2AZ5/Xica36zmNTAwBKq6EZuCEJ0tbsLFOar1B7Ab DqqGvvMW5HKkzPqXWdU5h2IIRXkZgircV7v2Vb8dfizXRCXCBo8LDhz5WcgOmP05 EpZNTnw8cOJF5RaLYcvgjChXWJLNvqpqIqlcccYO2fVD5zkd2VOdT8oPNiUSQxFn Wsz7Oq9ba5sWGU+Ni1v0Z1qYp/tQ0aswyERqfKmTdzqqktm/93bgkQJoGGX+umpN 3J0WrPu2zwsRLiaJKvk2VkhQrbHouwYfbeyXlv9c2T3kKv22++QzkxoLKow68zKx f2ePnu3kRo3rZZnFaEpTOMXxygAaS4nuAZh8ZCSvDYvIUNkXa8gwXSoEEx0vak47 ZXycx6sQtO/U7/onuRVvzcIRiJBK2dvAUK5D4J+O8tKx6PslG6QxWY27sVH7w2L2 30DFBCVlNk0=af5V -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Update to 3.107. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-93db553bb7 2020-10-05 01:20:33.534446 --------------------------------------------------------------------------------Name : xawtv Product : Fedora 31 Version : 3.107 Release : 2.fc31 URL : https://linuxtv.org/wiki/index.php/Xawtv Summary : TV applications for video4linux compliant devices Description : Xawtv is a simple xaw-based TV program which uses the bttv driver or video4linux. Xawtv contains various command-line utilities for grabbing images and .avi movies, for tuning in to TV stations, etc. Xawtv also includes a grabber driver for vic. --------------------------------------------------------------------------------Update Information: Update to 3.107 --------------------------------------------------------------------------------ChangeLog: * Sat Sep 26 2020 Dmitry Butskoy - 3.107-2 - bump release * Sat May 16 2020 Mauro Carvalho Chehab - 3.107-1 - upgrade to version 3.107 --------------------------------------------------------------------------------References: [ 1 ] Bug #1882286 - CVE-2020-13696 xawtv: specially crafted input leads to information disclosure and user privilege escalation [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1882286 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-93db553bb7' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
An update that solves two vulnerabilities and has 7 fixes is now available. . SUSE Security Update: Security update for salt ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:0684-1 Rating: moderate References: #1135656 #1153611 #1157465 #1158940 #1159118 #1160931 #1162327 #1162504 #1165425 Cross-References: CVE-2019-17361 CVE-2019-18897 Affected Products: SUSE Linux Enterprise Module for Server Applications 15-SP1 SUSE Linux Enterprise Module for Python2 15-SP1 SUSE Linux Enterprise Module for Basesystem 15-SP1 ______________________________________________________________________________ An update that solves two vulnerabilities and has 7 fixes is now available. Description: This update for salt fixes the following issues: - Avoid possible user escalation upgrading salt-master (bsc#1157465) (CVE-2019-18897) - Fix unit tests failures in test_batch_async tests - Batch Async: Handle exceptions, properly unregister and close instances after running async batching to avoid CPU starvation of the MWorkers (bsc#1162327) - RHEL/CentOS 8 uses platform-python instead of python3 - New configuration option for selection of grains in the minion start event. - Fix 'os_family' grain for Astra Linux Common Edition - Fix for salt-api NET API where unauthenticated attacker could run arbitrary code (CVE-2019-17361) (bsc#1162504) - Adds disabled parameter to mod_repo in aptpkg module Move token with atomic operation Bad API token files get deleted (bsc#1160931) - Support for Btrfs and XFS in parted and mkfs added - Adds list_downloaded for apt Module to enable pre-downloading support Adds virt.(pool|network)_get_xml functions - Various libvirt updates: * Add virt.pool_capabilities function * virt.pool_running improvements * Add virt.pool_deleted state *virt.network_define allow adding IP configuration - virt: adding kernel boot parameters to libvirt xml - Fix to scheduler when data['run'] does not exist (bsc#1159118) - Fix virt states to not fail on VMs already stopped - Fix applying of attributes for returner rawfile_json (bsc#1158940) - xfs: do not fail if type is not present (bsc#1153611) - Fix errors when running virt.get_hypervisor function - Align virt.full_info fixes with upstream Salt - Fix for log checking in x509 test - Read repo info without using interpolation (bsc#1135656) - Limiting M2Crypto to > = SLE15 - Replacing pycrypto with M2Crypto (bsc#1165425) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Server Applications 15-SP1: zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP1-2020-684=1 - SUSE Linux Enterprise Module for Python2 15-SP1: zypper in -t patch SUSE-SLE-Module-Python2-15-SP1-2020-684=1 - SUSE Linux Enterprise Module for Basesystem 15-SP1: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2020-684=1 Package List: - SUSE Linux Enterprise Module for Server Applications 15-SP1 (aarch64 ppc64le s390x x86_64): salt-api-2019.2.0-6.24.1 salt-cloud-2019.2.0-6.24.1 salt-master-2019.2.0-6.24.1 salt-proxy-2019.2.0-6.24.1 salt-ssh-2019.2.0-6.24.1 salt-standalone-formulas-configuration-2019.2.0-6.24.1 salt-syndic-2019.2.0-6.24.1 - SUSE Linux Enterprise Module for Server Applications 15-SP1 (noarch): salt-fish-completion-2019.2.0-6.24.1 - SUSE Linux Enterprise Module for Python2 15-SP1 (aarch64 ppc64le s390x x86_64): python2-salt-2019.2.0-6.24.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (aarch64 ppc64le s390x x86_64): python3-salt-2019.2.0-6.24.1 salt-2019.2.0-6.24.1 salt-doc-2019.2.0-6.24.1 salt-minion-2019.2.0-6.24.1 - SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch): salt-bash-completion-2019.2.0-6.24.1 salt-zsh-completion-2019.2.0-6.24.1 References: https://www.suse.com/security/cve/CVE-2019-17361.html https://www.suse.com/security/cve/CVE-2019-18897.html https://bugzilla.suse.com/1135656 https://bugzilla.suse.com/1153611 https://bugzilla.suse.com/1157465 https://bugzilla.suse.com/1158940 https://bugzilla.suse.com/1159118 https://bugzilla.suse.com/1160931 https://bugzilla.suse.com/1162327 https://bugzilla.suse.com/1162504 https://bugzilla.suse.com/1165425 _______________________________________________ sle-security-updates mailing list
Malte Kraus discovered that libpam-python, a PAM module allowing PAM modules to be written in Python, didn't sanitise environment variables which could result in local privilege escalation if used with a setuid binary. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4555-1
Get the latest Linux and open source security news straight to your inbox.