Apache Santuario, XML Security for Java, is vulnerable to an issue where the “secureValidation” property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.

Upstream details at : https://access.redhat.com/errata/RHSA-2021:3438

An update for the nodejs:14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An issue has been found in openssl, a Secure Sockets Layer toolkit. Ingo Schwarze reported a buffer overrun flaw when processing ASN.1 strings, which can result in denial of service.

An update that fixes 19 vulnerabilities is now available.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

An update that fixes one vulnerability is now available.

Update to latest in git.

update for sharpziplib 1.3.3 which contains a security fix

update for sharpziplib 1.3.3 which contains a security fix

Update to v1.41.1 Fix CVE-2021-39163, CVE-2021-39164

Cumulative bug-fix release from upstream.

– fix disclosure of HTTP auth credentials via SNI data (CVE-2021-38165)

Rebuild for CVE-2021-3672 in c-ares library

Update to 1.1.1l version

Update to 2.0.1; fix RHBZ#1932066 (unsafe use of strncpy), fix RHBZ#1932066

An update that solves 20 vulnerabilities and has 106 fixes is now available.

An update that fixes 5 vulnerabilities is now available.

Rebase with Security fix for CVE-2021-3781

Update to 1.93, fixes CVE-2020-19752

Fix issue with incorrect obsoletes.

Multiple issues have been discovered in mupdf. CVE-2016-10246

Red Hat Advanced Cluster Management for Kubernetes 2.1.11 General Availability release images, which provide a security fix and update the container images. Red Hat Product Security has rated this update as having a security impact

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

A security vulnerability has been found in Kaminari, a pagination engine plugin for Rails 3+ and other modern frameworks, that would allow an attacker to inject arbitrary code into pages with pagination links.

Several security issues were fixed in WebKitGTK.

SQL parse could be made to denial of service if it received a specially crafted regular expression.

IBM s390x systems could be made to crash or run programs as an administrator.

The container suse/sle15 was updated. The following patches have been included in this update:

The container suse/sles12sp5 was updated. The following patches have been included in this update:

Update to 2.32.4: * Do not append .asc extension to downloaded text/plain files. * Fix several crashes and rendering issues. * Fix CVE-2021-30858

– CVE-2021-22947 – STARTTLS protocol injection via MITM – CVE-2021-22946 – protocol downgrade required TLS bypassed – CVE-2021-22945 – use-after-free and double-free in MQTT sending

Backport patch for CVE-2021-23437.

Backport patch for CVE-2021-23437.

Backport patch for CVE-2021-23437.

Backport patch for CVE-2021-23437.

Rebase with Security fix for CVE-2021-3781

Rebuild for dovecot 2.3.16 —- Rebuild for dovecot 2.3.16

– fix disclosure of HTTP auth credentials via SNI data (CVE-2021-38165)

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update that solves one vulnerability and has one errata is now available.

Two vulnerabilities were discovered in the Nextcloud desktop client, which could result in information disclosure. For the oldstable distribution (buster), these problems have been fixed

The legacy 1.0 version of OpenSSL, a cryptography library for secure communication, fails to validate alternate trust chains in some conditions. In particular this breaks connecting to servers that use Let’s Encrypt certificates, starting 2021-10-01.

Multiple vulnerabilities were discovered in nettle, a low level cryptographic library, which could result in denial of service (remote crash in RSA decryption via specially crafted ciphertext, crash on ECDSA signature verification) or incorrect verification of ECDSA signatures.

GnuTLS, a portable cryptography library, fails to validate alternate trust chains in some conditions. In particular this breaks connecting to servers that use Let’s Encrypt certificates, starting 2021-10-01.

Update to 2.2.17

Upstream annoucement: [WordPress 5.8.1 Security and Maintenance Release](https://wordpress.org/news/2021/09/wordpress-5-8-1-security-and- maintenance-release/)

Another race in XENMAPSPACE_grant_table handling [XSA-384, CVE-2021-28701] bugfix for XSA-380

The container caasp/v4.5/kube-scheduler was updated. The following patches have been included in this update:

The container caasp/v4.5/kube-proxy was updated. The following patches have been included in this update:

The container caasp/v4.5/kube-controller-manager was updated. The following patches have been included in this update:

Several security issues were fixed in Python.

Several security issues were fixed in Qt.

Several security issues were fixed in the Linux kernel.

Several security issues were fixed in the Linux kernel.

Libgcrypt could be made to expose sensitive information.

An update that solves one vulnerability and has three fixes is now available.

Squashfs-Tools could be made to overwrite files.

An update that fixes one vulnerability is now available.

An update that solves one vulnerability and has one errata is now available.

Several security issues were fixed in curl.

Squashfs-Tools could be made to overwrite files.

The container ses/7/rook/ceph was updated. The following patches have been included in this update:

An update that fixes four vulnerabilities is now available.

An update that fixes one vulnerability is now available.

An update that fixes four vulnerabilities is now available.

An update that fixes four vulnerabilities is now available.

The 5.13.15 stable kernel update contains a number of important fixes across the tree.

update to 1.1.1l

This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes

This update upgrades Thunderbird to version 78.14.0. * Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – thunderbird-78.14.0-1.el7_9.x86_64.rpm – thunderbird-debuginfo-78.1 [More…]

This update upgrades Firefox to version 78.14.0 ESR. * Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – firefox-78.14.0-1.el7_9.i686.rpm – firefox-78.14.0-1.el7_9.x86_64.r [More…]

An update that contains security fixes can now be installed.

Several security issues were fixed in the kernel.

Update to Chromium 93. There have been … a few security fixes since the last Fedora chromium update. This update fixes the following CVEs: CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30577 CVE-2021-30578 CVE-2021-30579 CVE-2021-30580 CVE-2021-30581

It was found that the patch for CVE-2021-3592 introduced a regression which prevented ssh connections to the host system. Since there is no imminent solution for the problem, the patch for CVE-2021-3592 has been reverted. Updated qemu packages are now available to correct this issue.

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the oldstable distribution (buster), this problem has been fixed

Firefox could be made to crash or run programs as your login if it opened a malicious website.

* New upstream version (92.0)

Update to latest upstream release 2.0.12

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.