Rocky OVAL Patch Definition Merger 1 5.10 2025-03-31T18:31:01 1743445861 Rocky Linux 8 Rocky Linux 9 The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * JDK: Enhance array handling (CVE-2025-21502) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: host/secure cookie bypass due to partial CVE-2022-31629 fix (CVE-2024-2756) * php: password_verify can erroneously return true, opening ATO risk (CVE-2024-3096) * php: Filter bypass in filter_var (FILTER_VALIDATE_URL) (CVE-2024-5458) * php: Erroneous parsing of multipart form data (CVE-2024-8925) * php: cgi.force_redirect configuration is bypassable due to the environment variable collision (CVE-2024-8927) * php: PHP-FPM Log Manipulation Vulnerability (CVE-2024-9026) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVE-2024-10978) * postgresql: PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVE-2024-10979) * postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes (CVE-2024-10976) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: REXML ReDoS vulnerability (CVE-2024-49761) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407) * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675) * Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Gnus treats inline MIME contents as trusted (CVE-2024-30203) * emacs: LaTeX preview is enabled by default for e-mail attachments (CVE-2024-30204) * emacs: Org mode considers contents of remote files to be trusted (CVE-2024-30205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fix(es): * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461) * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458) * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459) * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467) * firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465) * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466) * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463) * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462) * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * mod_http2: DoS by null pointer in websocket over HTTP/2 (CVE-2024-36387) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: History interface could have been used to cause a Denial of Service condition in the browser (CVE-2024-10464) * firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response (CVE-2024-10461) * firefox: thunderbird: Permission leak via embed or object elements (CVE-2024-10458) * firefox: thunderbird: Use-after-free in layout with accessibility (CVE-2024-10459) * firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4 (CVE-2024-10467) * firefox: thunderbird: Clipboard "paste" button persisted across tabs (CVE-2024-10465) * firefox: DOM push subscription message could hang Firefox (CVE-2024-10466) * firefox: thunderbird: Cross origin video frame leak (CVE-2024-10463) * firefox: thunderbird: Origin of permission prompt could be spoofed by long URL (CVE-2024-10462) * firefox: thunderbird: Confusing display of origin for external protocol handler prompt (CVE-2024-10460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) * dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: NULL pointer dereference in tif_dirinfo.c (CVE-2024-7006) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR. Security Fix(es): * OpenEXR: Heap Overflow in Scanline Deep Data Parsing (CVE-2023-5841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: tcp: add sanity checks to rx zerocopy (CVE-2024-26640) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: af_unix: Fix garbage collector racing against connect() (CVE-2024-26923) * kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961) * kernel: scsi: core: Fix unremoved procfs host directory regression (CVE-2024-26935) * kernel: tty: Fix out-of-bound vmalloc access in imageblit (CVE-2021-47383) * kernel: net/sched: taprio: extend minimum interval restriction to entire cycle too (CVE-2024-36244) * kernel: xfs: fix log recovery buffer allocation for the legacy h_size fixup (CVE-2024-39472) * kernel: netfilter: nft_inner: validate mandatory meta and payload (CVE-2024-39504) * kernel: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CVE-2024-40904) * kernel: mptcp: ensure snd_una is properly initialized on connect (CVE-2024-40931) * kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960) * kernel: ext4: do not create EA inode under buffer lock (CVE-2024-40972) * kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CVE-2024-40977) * kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (CVE-2024-40995) * kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super() (CVE-2024-40998) * kernel: netpoll: Fix race condition in netpoll_owner_active (CVE-2024-41005) * kernel: xfs: don&#39;t walk off the end of a directory data block (CVE-2024-41013) * kernel: xfs: add bounds checking to xlog_recover_process_data (CVE-2024-41014) * kernel: block: initialize integrity buffer to zero before writing it to media (CVE-2024-43854) * kernel: netfilter: flowtable: initialise extack before use (CVE-2024-45018) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The golang packages provide the Go programming language compiler. Security Fix(es): * golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: webkit2gtk: Use after free may lead to Remote Code Execution (CVE-2024-40776) * webkitgtk: webkit2gtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2024-40789) * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40780) * webkitgtk: webkit2gtk: Out-of-bounds read was addressed with improved bounds checking (CVE-2024-40779) * webkitgtk: webkit2gtk: Use-after-free was addressed with improved memory management (CVE-2024-40782) * webkitgtk: Visiting a malicious website may lead to address bar spoofing (CVE-2024-40866) * webkitgtk: A malicious website may cause unexpected cross-origin behavior (CVE-2024-23271) * webkitgtk: Processing web content may lead to arbitrary code execution (CVE-2024-27820) * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2024-27838) * webkitgtk: Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2024-27851) * webkitgtk: A malicious website may exfiltrate data cross-origin (CVE-2024-44187) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155) * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) * go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158) * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Use-after-free in Animation timeline (128.3.1 ESR Chemspill) (CVE-2024-9680) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The OpenIPMI packages provide command-line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. Security Fix(es): * openipmi: missing check on the authorization type on incoming LAN messages in IPMI simulator (CVE-2024-42934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35. Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.110 and .NET Runtime 8.0.10. Security Fix(es): * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Security Fix(es): * dotnet: System.IO.Packaging - Multiple DoS vectors in use of SortedList (CVE-2024-43484) * dotnet: Multiple .NET components susceptible to hash flooding (CVE-2024-43483) * dotnet: Denial of Service in System.Text.Json (CVE-2024-43485) * dotnet: kestrel: closing an HTTP/3 stream can cause a race condition and lead to remote code execution (CVE-2024-38229) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: tarfile: ReDos via excessive backtracking while parsing header values (CVE-2024-6232) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Local information disclosure on Intel(R) Atom(R) processors (CVE-2023-28746) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: Revert &#34;net/mlx5: Block entering switchdev mode with ns inconsistency&#34; (CVE-2023-52658) * kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989) * kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47385) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) * kernel: net/mlx5: Add a timeout to acquire the command queue semaphore (CVE-2024-38556) * kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVE-2024-39483) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959) * kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079) * kernel: sched: act_ct: take care of padding in struct zones_ht_key (CVE-2024-42272) * kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Rocky Linux 8 The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Rocky Linux 8 The OpenJDK 21 runtime environment. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function (CVE-2023-48161) * JDK: Array indexing integer overflow (8328544) (CVE-2024-21210) * JDK: HTTP client improper handling of maxHeaderSize (8328286) (CVE-2024-21208) * JDK: Unbounded allocation leads to out-of-memory error (8331446) (CVE-2024-21217) * JDK: Integer conversion error leads to incorrect range check (8332644) (CVE-2024-21235) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser. Security Fix(es): * net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. (CVE-2022-24805) * : net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously (CVE-2022-24806) * net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access (CVE-2022-24807) * net-snmp: A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24809) * net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference (CVE-2022-24808) * net-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference. (CVE-2022-24810) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * pcp: pmpost symlink attack allows escalating pcp to root user (CVE-2024-45770) * pcp: pmcd heap corruption through metric pmstore operations (CVE-2024-45769) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The golang packages provide the Go programming language compiler. Security Fix(es): * net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791) * go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155) * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) * go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * rexml: DoS vulnerability in REXML (CVE-2024-39908) * rexml: rubygem-rexml: DoS when parsing an XML having many specific characters such as whitespace character, >] and ]> (CVE-2024-41123) * rexml: DoS vulnerability in REXML (CVE-2024-41946) * rexml: DoS vulnerability in REXML (CVE-2024-43398) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * thunderbird: 115.15/128.2 () * mozilla: Type confusion when looking up a property name in a &quot;with&quot; block (CVE-2024-8381) * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382) * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384) * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385) * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386) * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387) * thunderbird: Crash when aborting verification of OTR chat (CVE-2024-8394) * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: 115.15/128.2 ESR () * mozilla: Type confusion when looking up a property name in a &quot;with&quot; block (CVE-2024-8381) * mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382) * mozilla: Firefox did not ask before openings news: links in an external application (CVE-2024-8383) * mozilla: Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384) * mozilla: WASM type confusion involving ArrayTypes (CVE-2024-8385) * mozilla: SelectElements could be shown over another site if popups are allowed (CVE-2024-8386) * mozilla: Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387) * mozilla: Type Confusion in Async Generators in Javascript Engine (CVE-2024-7652) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-browsed: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source () * cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes (CVE-2024-47076) * cups: libppd: remote command injection via attacker controlled data in PPD file () For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Network Block Device (NBD) is a protocol for accessing Block Devices (hard disks and disk-like devices) over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fix(es): * libnbd: NBD server improper certificate validation (CVE-2024-7383) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Possible denial of service in X.509 name checks (CVE-2024-6119) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490) * libexpat: Integer Overflow or Wraparound (CVE-2024-45491) * libexpat: integer overflow (CVE-2024-45492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Bypass network import restriction via data URL (CVE-2024-22020) * nodejs: fs.lstat bypasses permission model (CVE-2024-22018) * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863) * nodejs: Bypass network import restriction via data URL (CVE-2024-22020) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks (CVE-2024-4317) * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: using a large number of address headers may trigger a denial of service (CVE-2024-23184) * dovecot: very large headers can cause resource exhaustion when parsing message (CVE-2024-23185) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL relation replacement during pg_dump executes arbitrary SQL (CVE-2024-7348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable: the reference interpreter for the Python language, version 3. The majority of its standard library is provided in the python3.12-libs package, which should be installed automatically along with python3.12. The remaining parts of the Python standard library are broken out into the python3.12-tkinter and python3.12-test packages, which may need to be installed separately. Documentation for Python is provided in the python3.12-docs package. Packages containing additional libraries for Python are generally named with the "python3.12-" prefix. Security Fix(es): * cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection (CVE-2024-6923) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fix(es): * glib2: Signal subscription vulnerabilities (CVE-2024-34397) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) * kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886) * kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946) * kernel: KVM: SVM: Flush pages under kvm-&gt;lock to fix UAF in svm_register_enc_region() (CVE-2024-35791) * kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797) * kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875) * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000) * kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801) * kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883) * kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019) * kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) * kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979) * kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) * kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927) * kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936) * kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040) * kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096) * kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082) * kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096) * kernel: Revert &#34;mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again&#34; (CVE-2024-42102) * kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131) * kernel: nvme: avoid double free special payload (CVE-2024-41073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: Malformed userPassword hash may cause Denial of Service (CVE-2024-5953) * 389-ds-base: unauthenticated user can trigger a DoS by sending a specific extended search request (CVE-2024-6237) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Setuptools is a collection of enhancements to the Python 3 distutils that allow you to more easily build and distribute Python 3 packages, especially ones that have dependencies on other packages. This package also contains the runtime components of setuptools, necessary to execute the software that requires pkg_resources. Security Fix(es): * pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: bind9: BIND's database will be slow if a very large number of RRs exist at the same nam (CVE-2024-1737) * bind9: bind: SIG(0) can be used to exhaust CPU resources (CVE-2024-1975) * bind: bind9: Assertion failure when serving both stale cache data and authoritative zone content (CVE-2024-4076) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Errata Tool Automation could not update the description because it is longer (4803) than ET limit of 4000 characters. (OSCI-6058) Please update the description manually. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network. Security Fix(es): * freeradius: forgery attack (CVE-2024-3596) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: block: null pointer dereference in ioctl.c when length and logical block size are misaligned (CVE-2023-52458) * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (CVE-2024-26773) * kernel: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (CVE-2024-26737) * kernel: dm: call the resume method on internal suspend (CVE-2024-26880) * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852) * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) * kernel: nfp: flower: handle acti_netdevs allocation failure (CVE-2024-27046) * kernel: octeontx2-af: Use separate handlers for interrupts (CVE-2024-27030) * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857) * kernel: mlxbf_gige: call request_irq() after NAPI initialized (CVE-2024-35907) * kernel: mlxbf_gige: stop interface during shutdown (CVE-2024-35885) * kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (CVE-2023-52809) * kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (CVE-2021-47459) * kernel: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (CVE-2024-36924) * kernel: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (CVE-2024-36952) * kernel: net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743) * kernel: epoll: be better about file lifetimes (CVE-2024-38580) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * Mozilla: Race condition in permission assignment (CVE-2024-6601) * Mozilla: Memory corruption in thread creation (CVE-2024-6603) * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * httpd: null pointer dereference in mod_proxy (CVE-2024-38477) * httpd: Potential SSRF in mod_rewrite (CVE-2024-39573) * httpd: Encoding problem in mod_proxy (CVE-2024-38473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: vulnerable to a Denial of Service attack against Cache Manager error responses (CVE-2024-23638) * squid: Out-of-bounds write error may lead to Denial of Service (CVE-2024-37894) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fix(es): * qtbase: qtbase: Delay any communication until encrypted() can be responded to (CVE-2024-39936) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages. Security Fix(es): * libndp: buffer overflow in route information length field (CVE-2024-5564) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (CVE-2024-26858) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435) * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958) * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904) * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543) * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593) * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957) * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Rocky Linux 8 The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: RangeCheckElimination array index overflow (8323231) (CVE-2024-21147) * OpenJDK: potential UTF8 size overflow (8314794) (CVE-2024-21131) * OpenJDK: Excessive symbol length can lead to infinite loop (8319859) (CVE-2024-21138) * OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548) (CVE-2024-21140) * OpenJDK: Out-of-bounds access in 2D image handling (8324559) (CVE-2024-21145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13 (CVE-2024-6604) * Mozilla: Race condition in permission assignment (CVE-2024-6601) * Mozilla: Memory corruption in thread creation (CVE-2024-6603) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.107 and Runtime 8.0.7. Security Fix(es): * dotnet: DoS in System.Text.Json (CVE-2024-30105) * dotnet: DoS in ASP.NET Core 8 (CVE-2024-35264) * dotnet: DoS when parsing X.509 Content and ObjectIdentifiers (CVE-2024-38095) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: Possible remote code execution due to a race condition in signal handling affecting Rocky Linux 9 (CVE-2024-6409) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (CVE-2023-52626) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801) * kernel: crypto: qat - resolve race condition during AER recovery (CVE-2024-26974) * kernel: xen-netfront: Add missing skb_mark_for_recycle (CVE-2024-27393) * kernel: net/mlx5e: fix a potential double-free in fs_any_create_groups (CVE-2023-52667) * kernel: smb: client: fix UAF in smb2_reconnect_server() (CVE-2024-35870) * kernel: net/mlx5: Properly link new fs rules into the tree (CVE-2024-35960) * kernel: net: hns3: do not allow call hns3_nic_net_open repeatedly (CVE-2021-47400) Bug Fix(es): * cifs - kernel panic with cifs_put_smb_ses (JIRA:Rocky Linux-28943) * BUG: unable to handle page fault for address: ff16bf752f593ff8 [rhel-9.4.z] (JIRA:Rocky Linux-35672) * [HPE 9.4 Bug] Request merge of AMD address translation library patch series [rhel-9.4.z] (JIRA:Rocky Linux-36220) * [Rocky Linux9] kernel BUG at lib/list_debug.c:51! [rhel-9.4.z] (JIRA:Rocky Linux-36687) * ice: DPLL-related fixes [rhel-9.4.z] (JIRA:Rocky Linux-36716) * CNB95: net/sched: update TC core to upstream v6.8 [rhel-9.4.z] (JIRA:Rocky Linux-37641) * IPv6: SR: backport fixes from upstream [rhel-9.4.z] (JIRA:Rocky Linux-37669) * [RFE] Backport tmpfs noswap mount option [rhel-9.4.z] (JIRA:Rocky Linux-38252) * Isolated cores causing issues on latest Rocky Linux9.4 kernel and not functioning as desired. [rhel-9.4.z] (JIRA:Rocky Linux-38595) * [ice] Add automatic VF reset on Tx MDD events [rhel-9.4.z] (JIRA:Rocky Linux-39083) * [HPEMC Rocky Linux 9.4 REGRESSION] turbostat: turbostat broken on 10+ sockets. [rhel-9.4.z] (JIRA:Rocky Linux-34953) * bnx2x: fix crashes in PCI error handling, resource leaks [rhel-9.4.z] (JIRA:Rocky Linux-43272) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: Recursive clones RCE (CVE-2024-32002) * git: RCE while cloning local repos (CVE-2024-32004) * git: additional local RCE (CVE-2024-32465) * git: insecure hardlinks (CVE-2024-32020) * git: symlink bypass (CVE-2024-32021) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.12.0 ESR. Security Fix(es): * firefox: Use-after-free in networking (CVE-2024-5702) * firefox: Use-after-free in JavaScript object transplant (CVE-2024-5688) * firefox: External protocol handlers leaked by timing attack (CVE-2024-5690) * firefox: Sandboxed iframes were able to bypass sandbox restrictions to open a new window (CVE-2024-5691) * firefox: Cross-Origin Image leak via Offscreen Canvas (CVE-2024-5693) * firefox: Memory Corruption in Text Fragments (CVE-2024-5696) * firefox: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12 (CVE-2024-5700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: IKEv1 default AH/ESP responder can crash and restart (CVE-2024-3652) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.12.1. Security Fix(es): * thunderbird: Use-after-free in networking (CVE-2024-5702) * thunderbird: Use-after-free in JavaScript object transplant (CVE-2024-5688) * thunderbird: External protocol handlers leaked by timing attack (CVE-2024-5690) * thunderbird: Sandboxed iframes were able to bypass sandbox restrictions to open a new window (CVE-2024-5691) * thunderbird: Cross-Origin Image leak via Offscreen Canvas (CVE-2024-5693) * thunderbird: Memory Corruption in Text Fragments (CVE-2024-5696) * thunderbird: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12 (CVE-2024-5700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: OPVP device arbitrary code execution via custom Driver library (CVE-2024-33871) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: Path traversal on tempfile.TemporaryDirectory (CVE-2023-6597) * python: The zipfile module is vulnerable to zip-bombs leading to denial of service (CVE-2024-0450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network. Tickets facilitated by a Booth formation are the units of authorization that can be bound to certain resources. This will ensure that the resources are run at only one (granted) site at a time. Security Fix(es): * booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server (CVE-2024-3049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: * podman: jose-go: improper handling of highly compressed data (CVE-2024-28180) * podman: golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * podman: jose: resource exhaustion (CVE-2024-28176) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * jose-go: improper handling of highly compressed data (CVE-2024-28180) * buildah: jose: resource exhaustion (CVE-2024-28176) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-35449) Security Fix(es): * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) Bug Fix(es) and Enhancement(s): * Rebase tomcat to version 9.0.87 (JIRA:Rocky Linux-34815) * Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:Rocky Linux-35328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.11.0. Security Fix(es): * firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firefox: IndexedDB files retained in private browsing mode (CVE-2024-4767) * firefox: Potential permissions request bypass via clickjacking (CVE-2024-4768) * firefox: Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769) * firefox: Use-after-free could occur when printing to PDF (CVE-2024-4770) * firefox: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor and is used to provide networking for podman-machine virtual machines. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding. Security Fix(es): * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fix(es): * jinja2: accepts keys containing non-attribute characters (CVE-2024-34064) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549) * Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672) Bug Fix(es) and Enhancement(s): * Rebase tomcat to version 9.0.87 (JIRA:Rocky Linux-34815) * Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:Rocky Linux-35328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-35449) Security Fix(es): * ruby: Buffer overread vulnerability in StringIO (CVE-2024-27280) * ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) * ruby: Arbitrary memory address read vulnerability with Regex search (CVE-2024-27282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * freeipa: delegation rules allow a proxy service to impersonate any user to access another target service (CVE-2024-2698) * freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (CVE-2024-3183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.119 and .NET Runtime 7.0.19. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185) * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5. Security Fix(es): * dotnet: stack buffer overrun in Double Parse (CVE-2024-30045) * dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. Security Fix(es): * 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request (CVE-2024-3657) * 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c (CVE-2024-2199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The hsakmt packages include a thunk library for AMD's Heterogeneous System Architecture (HSA) Linux kernel driver (amdkfd). Security Fix(es): * python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() (CVE-2024-3651) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: Out of bounds write in iconv conversion to ISO-2022-CN-EXT (CVE-2024-2961) * glibc: stack-based buffer overflow in netgroup cache (CVE-2024-33599) * glibc: null pointer dereferences after failed netgroup cache insertion (CVE-2024-33600) * glibc: netgroup cache may terminate daemon on memory allocation failure (CVE-2024-33601) * glibc: netgroup cache assumes NSS callback uses in-buffer strings (CVE-2024-33602) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security Fix(es): * less: OS command injection (CVE-2024-32487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines. Security Fix(es): * apr: integer overflow/wraparound in apr_encode (CVE-2022-24963) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * CVE-2023-6186 libreoffice: various flaws (JIRA:Rocky Linux-20657) * CVE-2023-6185 libreoffice: various flaws (JIRA:Rocky Linux-20657) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: dds buffer overflow RCE (CVE-2023-44441) * gimp: PSD buffer overflow RCE (CVE-2023-44442) * gimp: psp integer overflow RCE (CVE-2023-44443) * gimp: psp off-by-one RCE (CVE-2023-44444) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker. Security Fix(es): * tracker-miners: sandbox escape (CVE-2023-5557) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fix(es): * pcp: exposure of the redis server backend allows remote command execution via pmproxy (CVE-2024-3019) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: Missing PreSharedKey for connection can cause crash (CVE-2024-2357) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The CPAN module is a tool to query, download and build perl modules from CPAN sites. Security Fix(es): * perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS (CVE-2023-31484) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.10.0. Security Fix(es): * Mozilla: Denial of Service using HTTP/2 CONTINUATION frames (CVE-2024-3302) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers. Security Fix(es): * mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * grafana: vulnerable to authorization bypass (CVE-2024-1313) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): * xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents (CVE-2024-31080) * xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice (CVE-2024-31081) * xorg-x11-server: User-after-free in ProcRenderAddGlyphs (CVE-2024-31083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-base packages contain a collection of well-maintained base plug-ins. Security Fix(es): * gstreamer-plugins-base: heap overwrite in subtitle parsing (CVE-2023-37328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The golang packages provide the Go programming language compiler. Security Fix(es): * golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785) * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288) * golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect (CVE-2023-45289) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 freeglut is a completely open source alternative to the OpenGL Utility Toolkit (GLUT) library with an OSI approved free software license. Security Fix(es): * freeglut: memory leak via glutAddSubMenu() function (CVE-2024-24258) * freeglut: memory leak via glutAddMenuEntry() function (CVE-2024-24259) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 grafana-pcp is an open source Grafana plugin for PCP. Security Fix(es): * grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.10.0 ESR. Security Fix(es): * GetBoundName in the JIT returned the wrong object (CVE-2024-3852) * Out-of-bounds-read after mis-optimized switch statement (CVE-2024-3854) * Incorrect JITting of arguments led to use-after-free during garbage collection (CVE-2024-3857) * Permission prompt input delay could expire when not in focus (CVE-2024-2609) * Integer-overflow led to out-of-bounds-read in the OpenType sanitizer (CVE-2024-3859) * Potential use-after-free due to AlignedBuffer self-move (CVE-2024-3861) * Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10 (CVE-2024-3864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The python-jwcrypto package provides Python implementations of the JSON Web Key (JWK), JSON Web Signature (JWS), JSON Web Encryption (JWE), and JSON Web Token (JWT) JOSE (JSON Object Signing and Encryption) standards. Security Fix(es): * python-jwcrypto: malicious JWE token can cause denial of service (CVE-2024-28102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es): * QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019) * QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255) * QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088) * QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683) * QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: Attestation failure when the quote's signature does not validate (CVE-2023-3674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Bug Fix(es): * TRIAGE CVE-2024-24786 buildah: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] Rocky Linux9.4 0Day (JIRA:Rocky Linux-28230) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 grafana-pcp is an open source Grafana plugin for PCP. Security Fix(es): * grafana-pcp: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: * podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * podman: buildah: full container escape at build time (CVE-2024-1753) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fixes: * liveness probe not called by podman when using httpGet (JIRA:Rocky Linux-28633) * Unable to copy image from one virtual machine to another using "podman image scp" (JIRA:Rocky Linux-28629) * [v4.9] Backport two docker CLI compatibility fixes (JIRA:Rocky Linux-28636) * Issue in podman causing S2I to fail in overwriting ENTRYPOINT (JIRA:Rocky Linux-14922) * Need to backport podman fix for SIGSEGV in Rocky Linux 9.3/8.9 for UBI based containers (JIRA:Rocky Linux-26843) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) Bug Fix(es): * TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - Rocky Linux 9.4 0day (JIRA:Rocky Linux-28235) * skopeo: jose-go: improper handling of highly compressed data [rhel-9] (JIRA:Rocky Linux-28736) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. The following packages have been upgraded to a later upstream version: flatpak (1.12.8). (BZ#2221792) Security Fix(es): * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100) * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fix(es): * edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message (CVE-2023-45235) * EDK2: heap buffer overflow in Tcg2MeasureGptTable() (CVE-2022-36763) * EDK2: heap buffer overflow in Tcg2MeasurePeImage() (CVE-2022-36764) * edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message (CVE-2023-45229) * edk2: Out of Bounds read when handling a ND Redirect message with truncated options (CVE-2023-45231) * edk2: Infinite loop when parsing unknown options in the Destination Options header (CVE-2023-45232) * edk2: Infinite loop when parsing a PadN option in the Destination Options header (CVE-2023-45233) * openssl: Excessive time spent checking DH keys and parameters (CVE-2023-3446) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. The default combination of the "control-use-cert: no" option with either explicit or implicit use of an IP address in the "control-interface" option could allow improper access. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged local process to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether. To mitigate the vulnerability, a new file "/etc/unbound/conf.d/remote-control.conf" has been added and included in the main unbound configuration file, "unbound.conf". The file contains two directives that should limit access to unbound.conf: control-interface: "/run/unbound/control" control-use-cert: "yes" For details about these directives, run "man unbound.conf". Updating to the version of unbound provided by this advisory should, in most cases, address the vulnerability. To verify that your configuration is not vulnerable, use the "unbound-control status | grep control" command. If the output contains "control(ssl)" or "control(namedpipe)", your configuration is not vulnerable. If the command output returns only "control", the configuration is vulnerable because it does not enforce access only to the unbound group members. To fix your configuration, add the line "include: /etc/unbound/conf.d/remote-control.conf" to the end of the file "/etc/unbound/unbound.conf". If you use a custom "/etc/unbound/conf.d/remote-control.conf" file, add the new directives to this file. (CVE-2024-1488) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video (CVE-2023-40474) * gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (CVE-2023-40475) * gstreamer-plugins-bad: Integer overflow in H.265 video parser leading to stack overwrite (CVE-2023-40476) * gstreamer-plugins-bad-free: buffer overflow vulnerability (CVE-2023-50186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c (CVE-2021-29390) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() (CVE-2024-1441) * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fixes: * libvirt: off-by-one error in udevListInterfacesByStatus() [rhel-9] (JIRA:Rocky Linux-25081) * libvirt: negative g_new0 length can lead to unbounded memory allocation [rhel-9] (JIRA:Rocky Linux-29515) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.3 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868) * bind: KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387) * bind: Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) * bind: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVE-2023-5679) * bind: Querying RFC 1918 reverse zones may cause an assertion failure when “nxdomain-redirect” is enabled (CVE-2023-5517) * bind: Parsing large DNS messages may cause excessive CPU load (CVE-2023-4408) Bug Fix(es): * bind-dyndb-ldap: rebuilt to adapt ABI changes in bind For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The gnutls package provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834) * gnutls: potential crash during chain building/verification (CVE-2024-28835) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The System Security Services Daemon (SSSD) service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch (NSS) and the Pluggable Authentication Modules (PAM) interfaces toward the system, and a pluggable back-end system to connect to multiple different account sources. Security Fix(es): * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (CVE-2023-3758) Bug Fix(es): * socket leak (JIRA:Rocky Linux-22340) * Passkey cannot fall back to password (JIRA:Rocky Linux-28161) * sssd: Race condition during authorization leads to GPO policies functioning inconsistently (JIRA:Rocky Linux-27209) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security Fix(es): * less: missing quoting of shell metacharacters in LESSCLOSE handling (CVE-2022-48624) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The wpa_supplicant packages contain an 802.1X Supplicant with support for WEP, WPA, WPA2 (IEEE 802.11i / RSN), and various EAP authentication methods. They implement key negotiation with a WPA Authenticator for client stations and controls the roaming and IEEE 802.11 authentication and association of the WLAN driver. Security Fix(es): * wpa_supplicant: potential authorization bypass (CVE-2023-52160) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: use-after-free in XMLReader (CVE-2024-25062) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes (CVE-2023-7008) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats. Security Fix(es): * file: stack-based buffer over-read in file_copystr in funcs.c (CVE-2022-48554) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240) * CVE-2024-25743 hw: amd: Instruction raise #VC exception at exit (AMD-SN-3008,CVE-2024-25742,CVE-2024-25743) Bug Fix(es): * ffdhe* algortihms introduced in 0a2e5b909023 as .fips_allowed=1 lack pairwise consistency tests (JIRA:Rocky Linux-27009) * mm/mglru: fix underprotected page cache (JIRA:Rocky Linux-29235) * [EMR] [TBOOT OS] SUT could not go to S3 state with Rocky Linux 9.2 Tboot OS One CPU return -16 running BUSY (JIRA:Rocky Linux-29673) * system hangs completely - NMI not possible (JIRA:Rocky Linux-30678) * ice 0000:6f:00.0: PTP failed to get time (JIRA:Rocky Linux-30110) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: CONTINUATION frames DoS (CVE-2024-27983) * nodejs: using the fetch() function to retrieve content from an untrusted URL leads to denial of service (CVE-2024-22025) * nodejs: HTTP Request Smuggling via Content Length Obfuscation (CVE-2024-27982) * nghttp2: CONTINUATION frames DoS (CVE-2024-28182) * c-ares: Out of bounds read in ares__read_line() (CVE-2024-25629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809) * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: path traversal by monkey-patching buffer internals (CVE-2024-21896) * nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891) * nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890) * nodejs: setuid() does not drop all privileges due to io_uring (CVE-2024-22017) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The java-21-openjdk packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: long Exception message leading to crash (8319851) (CVE-2024-21011) * OpenJDK: integer overflow in C1 compiler address generation (8322122) (CVE-2024-21068) * OpenJDK: Pack200 excessive memory allocation (8322114) (CVE-2024-21085) * OpenJDK: C2 compilation fails with "Exceeded _node_regs array" (8317507) (CVE-2024-21094) * OpenJDK: HTTP/2 client improper reverse DNS lookup (8315708) (CVE-2024-21012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.1). (Rocky Linux-29052) Security Fix(es): * ruby/cgi-gem: HTTP response splitting in CGI (CVE-2021-33621) * ruby: ReDoS vulnerability in URI (CVE-2023-28755) * ruby: ReDoS vulnerability - upstream's incomplete fix for CVE-2023-28755 (CVE-2023-36617) * ruby: ReDoS vulnerability in Time (CVE-2023-28756) Bug Fix(es): * ruby/rubygem-irb: IRB has hard dependency on rubygem-rdoc (Rocky Linux-29048) * ruby: Ruby cannot read private key in FIPS mode on Rocky Linux 9 (Rocky Linux-12437) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: code injection and privilege escalation through Linux capabilities (CVE-2024-21892) * nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) * nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin) (CVE-2023-46809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL (CVE-2024-0985) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: 1-byte array overrun in common path resolve code (CVE-2023-0568) * php: DoS vulnerability when parsing multipart request body (CVE-2023-0662) * php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247) * php: XML loading external entity without being enabled (CVE-2023-3823) * php: phar Buffer mismanagement (CVE-2023-3824) * php: Password_verify() always return true with some hash (CVE-2023-0567) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-5868) * postgresql: extension script @substitutions@ within quoting allow SQL injection (CVE-2023-39417) * postgresql: Role pg_signal_backend can signal certain superuser processes. (CVE-2023-5870) * postgresql: MERGE fails to enforce UPDATE or SELECT row security policies (CVE-2023-39418) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.4.0 ESR. Security Fix(es): * Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721) * Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730) * libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488) * Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724) * Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725) * Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728) * Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The toolbox container image can be used with Toolbox to obtain Rocky Linux based containerized command line environments to aid with development and software testing. Toolbox is built on top of Podman and other standard container technologies from OCI. This updates the toolbox image in the Rocky Enterprise Software Foundation container registry. To pull this container image, run one of the following commands: podman pull registry.redhat.io/toolbox (authenticated) podman pull registry.access.redhat.com/ubi9/toolbox (unauthenticated) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.124 and .NET Runtime 6.0.24. Security Fix(es): * dotnet: Denial of Service with Client Certificates using .NET Kestrel (CVE-2023-36799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * SQUID-2023:3 squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * SQUID-2023:1 squid: Request/Response smuggling in HTTP/1.1 and ICAP (CVE-2023-46846) * SQUID-2023:5 squid: denial of Service in FTP (CVE-2023-46848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Critical Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: net/http, x/net/http2: rapid stream resets can cause excessive work [CVE-2023-44487] (CVE-2023-39325) * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Midstream dist-git patches (BZ#2223637) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: XML loading external entity without being enabled (CVE-2023-3823) * php: phar Buffer mismanagement (CVE-2023-3824) * php: 1-byte array overrun in common path resolve code (CVE-2023-0568) * php: DoS vulnerability when parsing multipart request body (CVE-2023-0662) * php: Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVE-2023-3247) * php: Password_verify() always return true with some hash (CVE-2023-0567) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: a heap-based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545) * curl: cookie injection with none file (CVE-2023-38546) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 6.0 to SDK 6.0.123 and Runtime 6.0.23. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET 7.0 to SDK 7.0.112 and Runtime 7.0.12. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about this flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * nodejs: Rebase to the latest Nodejs 16 release [rhel-9] (BZ#2236434) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: stack exhaustion in control channel code may lead to DoS (CVE-2023-3341) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Libeconf is a highly flexible and configurable library to parse and manage key=value configuration files. It reads configuration file snippets from different directories and builds the final configuration file from it. Security Fix(es): * libeconf: stack-based buffer overflow in read_file() in lib/getfilecontents.c (CVE-2023-22652) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command injection due to mishandles permission validation for pipe devices (CVE-2023-36664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.3.1. Security Fix(es): * firefox: use-after-free in workers (CVE-2023-3600) * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169) * Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171) * Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176) * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313, BZ#2234404) Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs-semver: Regular expression denial of service (CVE-2022-25883) * nodejs: Permissions policies can impersonate other modules in using module.constructor.createRequire() (CVE-2023-32006) * nodejs: Permissions policies can be bypassed via process.binding (CVE-2023-32559) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: SAML token signature bypass (CVE-2023-20900) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The dmidecode packages provide utilities for extracting Intel 64 and Intel Itanium hardware information from the system BIOS or Extensible Firmware Interface (EFI), depending on the SMBIOS/DMI standard. This information typically includes system manufacturer, model name, serial number, BIOS version, and asset tag, as well as other details, depending on the manufacturer. Security Fix(es): * dmidecode: dump-bin to overwrite a local file (CVE-2023-30630) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: UAF in nftables when nft_set_lookup_global triggered after handling named and anonymous sets in batch requests (CVE-2023-3390) * kernel: netfilter: nf_tables: fix chain binding transaction logic in the abort path of NFT_MSG_NEWRULE (CVE-2023-3610) * kernel: net/sched: cls_fw component can be exploited as result of failure in tcf_change_indev function (CVE-2023-3776) * kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove() (CVE-2023-4004) * kernel: netfilter: nf_tables_newrule when adding a rule with NFTA_RULE_CHAIN_ID leads to use-after-free (CVE-2023-4147) * kernel: nf_tables: use-after-free in nft_chain_lookup_byid() (CVE-2023-31248) * kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval() (CVE-2023-35001) * kernel: save/restore speculative MSRs during S3 suspend/resume (CVE-2023-1637) * hw: amd: Cross-Process Information Leak (CVE-2023-20593) * kernel: bypass of shadow stack protection due to a logic error (CVE-2023-21102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel-rt: update RT source tree to the latest Rocky Linux-9.2.z3 Batch (BZ#2228482) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: Information leak through Cups-Get-Document operation (CVE-2023-32360) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fix(es): * libvirt: Memory leak in virPCIVirtualFunctionList cleanup (CVE-2023-2700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: heap-based buffer overflow in processCropSelections() in tools/tiffcrop.c (CVE-2022-48281) * libtiff: out-of-bounds read in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0795) * libtiff: out-of-bounds read in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0796) * libtiff: out-of-bounds read in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0797) * libtiff: out-of-bounds read in extractContigSamplesShifted8bits() in tools/tiffcrop.c (CVE-2023-0798) * libtiff: use-after-free in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0799) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0800) * libtiff: out-of-bounds write in _TIFFmemcpy() in libtiff/tif_unix.c when called by functions in tools/tiffcrop.c (CVE-2023-0801) * libtiff: out-of-bounds write in extractContigSamplesShifted32bits() in tools/tiffcrop.c (CVE-2023-0802) * libtiff: out-of-bounds write in extractContigSamplesShifted16bits() in tools/tiffcrop.c (CVE-2023-0803) * libtiff: out-of-bounds write in extractContigSamplesShifted24bits() in tools/tiffcrop.c (CVE-2023-0804) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The cups-filters package contains back ends, filters, and other software that was once part of the core Common UNIX Printing System (CUPS) distribution but is now maintained independently. Security Fix(es): * cups-filters: remote code execution in cups-filters, beh CUPS backend (CVE-2023-24805) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454) * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: urllib.parse url blocklisting bypass (CVE-2023-24329) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. Since "less" does not read the entire input file at startup, it also starts more quickly than ordinary text editors. Security Fix(es): * less: crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal (CVE-2022-46663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss. Security Fix(es): * iperf3: memory allocation hazard and crash (CVE-2023-38403) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility. Security Fix(es): * dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered (CVE-2023-34969) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The subscription-manager packages provide programs and libraries to allow users to manage subscriptions and yum repositories from the Rocky Enterprise Software Foundation entitlement platform. Security Fix(es): * subscription-manager: inadequate authorization of com.redhat.RHSM1 D-Bus interface allows local users to modify configuration (CVE-2023-3899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Rust Toolset provides the Rust programming language compiler rustc, the cargo build tool and dependency manager, and required libraries. Security Fix(es): * rust-cargo: cargo does not respect the umask when extracting dependencies (CVE-2023-38497) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: memory corruption issue leading to arbitrary code execution (CVE-2023-32435) * webkitgtk: type confusion issue leading to arbitrary code execution (CVE-2023-32439) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: schema_element defeats protective search_path changes (CVE-2023-2454) * postgresql: row security policies disregard user ID changes after inlining. (CVE-2023-2455) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.14.0. Security Fix(es): * Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045) * Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047) * Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048) * Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049) * Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050) * Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056) * Mozilla: Memory safety bugs fixed in Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057) * thunderbird: File Extension Spoofing using the Text Direction Override Character (CVE-2023-3417) * Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.14.0 ESR. Security Fix(es): * Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045) * Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046) * Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047) * Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048) * Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049) * Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050) * Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056) * Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057) * Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312) (CVE-2023-22049) * OpenJDK: array indexing integer overflow issue (8304468) (CVE-2023-22045) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-07, 8u382) [rhel-9] (BZ#2220662) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: named's configured cache size limit can be significantly exceeded (CVE-2023-2828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: ipvlan: out-of-bounds write caused by unclear skb->cb (CVE-2023-3090) * kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt() (CVE-2023-35788) * kernel: KVM: x86/mmu: race condition in direct_page_fault() (CVE-2022-45869) * kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c (CVE-2023-0458) * kernel: Spectre v2 SMT mitigations problem (CVE-2023-1998) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Rocky Linux9 rt: blktests block/024 failed (BZ#2209920) * Backport pinned timers RT specific behavior for FIFO tasks (BZ#2210071) * kernel-rt: update RT source tree to the Rocky Linux-9.2z2 source tree (BZ#2215122) * kernel-rt: update RT source tree to the Rocky Linux-9.2z2b source tree (BZ#2222796) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.13.0 ESR. Security Fix(es): * Mozilla: Use-after-free in WebRTC certificate generation (CVE-2023-37201) * Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-37202) * Mozilla: Memory safety bugs fixed in Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13 (CVE-2023-37211) * Mozilla: Fullscreen notification obscured (CVE-2023-37207) * Mozilla: Lack of warning when opening Diagcab files (CVE-2023-37208) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: account takeover possible when using Azure AD OAuth (CVE-2023-3128) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Critical Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: cmd/go: go command may generate unexpected code at build time when using cgo (CVE-2023-29402) * golang: cmd/go: go command may execute arbitrary code at build time when using cgo (CVE-2023-29404) * golang: cmd/cgo: Arbitratry code execution triggered by linker flags (CVE-2023-29405) * golang: runtime: unexpected behavior of setuid/setgid binaries (CVE-2023-29403) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Critical Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: authentication bypass vulnerability in the vgauth module (CVE-2023-20867) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067) * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-2023-31130) * c-ares: Insufficient randomness in generation of DNS query IDs (CVE-2023-31147) * c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation (CVE-2023-31124) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.12.0. Security Fix(es): * Mozilla: Click-jacking certificate exceptions through rendering lag (CVE-2023-34414) * Mozilla: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12 (CVE-2023-34416) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. apr-util is a library which provides additional utility interfaces for APR; including support for XML parsing, LDAP, database interfaces, URI parsing, and more. Security Fix(es): * apr-util: out-of-bounds writes in the apr_base64 (CVE-2022-25147) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 8 Rocky Linux 9 The texlive packages contain TeXLive, an implementation of TeX for Linux or UNIX systems. Security Fix(es): * texlive: arbitrary code execution allows document complied with older version (CVE-2023-32700) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: a use-after-free when processing maliciously crafted web content (CVE-2023-32373) * webkitgtk: an out-of-bounds read when processing malicious content (CVE-2023-28204) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: 0-byte UDP payload Denial of Service (CVE-2023-32067) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16.19.1), nodejs-nodemon (2.0.20). Security Fix(es): * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881) * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918) * Node.js: Fetch API did not protect against CRLF injection in host headers (CVE-2023-23936) * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920) * Node.js: Regular Expression Denial of Service in Headers fetch API (CVE-2023-24807) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: webpack: Regression of CVE-2023-28154 fixes in the Rocky Linux (CVE-2023-2319) * rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530) * rubygem-rack: denial of service in header parsing (CVE-2023-27539) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Command 'pcs config checkpoint diff' does not show configuration differences between checkpoints (BZ#2180697) * Need a way to add a scsi fencing device to a cluster without requiring a restart of all cluster resources (BZ#2180704) * [WebUI] fence levels prevent loading of cluster status (BZ#2183180) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format (RIFF). Webmasters, web developers and browser developers can use WebP to compress, archive, and distribute digital images more efficiently. Security Fix(es): * Mozilla: libwebp: Double-free in libwebp (CVE-2023-1999) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. Security Fix(es): * samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided (CVE-2022-38023) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (CVE-2023-28617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * WebKitGTK: use-after-free leads to arbitrary code execution (CVE-2023-28205) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0. Security Fix(es): * Thunderbird: Revocation status of S/Mime recipient certificates was not checked (CVE-2023-0547) * Mozilla: Matrix SDK bundled with Thunderbird vulnerable to denial-of-service attack (CVE-2023-28427) * Mozilla: Fullscreen notification obscured (CVE-2023-29533) * Mozilla: Potential Memory Corruption following Garbage Collector compaction (CVE-2023-29535) * Mozilla: Invalid free from JavaScript code (CVE-2023-29536) * Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10 (CVE-2023-29550) * Mozilla: Memory Corruption in Safe Browsing Code (CVE-2023-1945) * Thunderbird: Hang when processing certain OpenPGP messages (CVE-2023-29479) * Mozilla: Content-Disposition filename truncation leads to Reflected File Download (CVE-2023-29539) * Mozilla: Files with malicious extensions could have been downloaded unsafely on Linux (CVE-2023-29541) * Mozilla: Incorrect optimization result on ARM64 (CVE-2023-29548) * MFSA-TMP-2023-0001 Mozilla: Double-free in libwebp (BZ#2186102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * The RSAPSSSignature implementation works with RSA keys via the SunRSASign provider. However, it did not fully check that the RSA key could be used by the provider before attempting to do so, leading to the possibility of errors being returned with custom security providers. The implementation now validates RSA keys and will allow other providers to handle such keys where it cannot. (RHBZ#2188024) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper connection handling during TLS handshake (8294474) (CVE-2023-21930) * OpenJDK: Swing HTML parsing issue (8296832) (CVE-2023-21939) * OpenJDK: incorrect enqueue of references in garbage collector (8298191) (CVE-2023-21954) * OpenJDK: certificate validation issue in TLS session negotiation (8298310) (CVE-2023-21967) * OpenJDK: missing string checks for NULL characters (8296622) (CVE-2023-21937) * OpenJDK: incorrect handling of NULL characters in ProcessBuilder (8295304) (CVE-2023-21938) * OpenJDK: missing check for slash characters in URI-to-path conversion (8298667) (CVE-2023-21968) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the list of cryptographic services and algorithms available is limited to those that are FIPS compliant. It was found that this filtering was too strict and was also excluding service attributes. These attributes are now made available in FIPS mode, as they are in non-FIPS mode. (RHBZ#2186804) * Previously, the XML signature provider was unable to operate in FIPS mode. Following recent enhancements to FIPS mode support, the XML signature provider can now be supported. It is now enabled in FIPS mode. (RHBZ#2186811) * The PKCS#11 provider used by FIPS mode can be supported by different PKCS#11 tokens. It was found that some PKCS#11 tokens may not be initialised fully before use, leading to an exception being thrown by the provider. With this release, this exception is now expected and handled by the FIPS support code. (RHBZ#2186807) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: HTTP request splitting with mod_rewrite and mod_proxy (CVE-2023-25690) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.9.0 ESR. Security Fix(es): * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751) * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176) * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752) * Mozilla: Invalid downcast in Worklets (CVE-2023-28162) * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (8.0.27). (BZ#2161667) Security Fix(es): * XKCP: buffer overflow in the SHA-3 reference implementation (CVE-2022-37454) * php: standard insecure cookie could be treated as a `__Host-` or `__Secure-` cookie by PHP applications (CVE-2022-31629) * php: OOB read due to insufficient input validation in imageloadfont() (CVE-2022-31630) * php: Due to an integer overflow PDO::quote() may return unquoted string (CVE-2022-31631) * php: phar wrapper can occur dos when using quine gzip file (CVE-2022-31628) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_dav: out-of-bounds read/write of zero byte (CVE-2006-20001) * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-36760) * httpd: mod_proxy: HTTP response splitting (CVE-2022-37436) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * httpd-init fails to create localhost.crt, localhost.key due to "sscg" default now creates a /dhparams.pem and is not idempotent if the file /dhparams.pem already exists. (BZ#2165975) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fix(es): * tar: heap buffer overflow at from_header() in list.c via specially crafted checksum (CVE-2022-48303) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The python-setuptools package provides a collection of enhancements to Python distribution utilities allowing convenient building and distribution of Python packages. Security Fix(es): * pypa-setuptools: Regular Expression Denial of Service (ReDoS) in package_index.py (CVE-2022-40897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: no check if the return value of XChangeGC() is NULL (CVE-2022-47024) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: use after free allows Sandbox Escape (CVE-2021-44964) * lua: stack overflow in lua_resume of ldo.c allows a DoS via a crafted script file (CVE-2021-43519) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel setting (CVE-2022-4415) * systemd: deadlock in systemd-coredump via a crash with a long backtrace (CVE-2022-45873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): * xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability (CVE-2023-1393) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Rocky Linux9.0 - zfcp: fix missing auto port scan and thus missing target ports (BZ#2127880) * Cgroups_v2, when creating new cgroup/container, resets the cpu affinity masks for all usr processes on the system. (BZ#2143766) * Rocky Linux9.0 - boot: Add secure boot trailer (BZ#2151528) * kernel-rt-debug: WARNING: possible circular locking dependency detected (&n->list_lock->&p->pi_lock->&lock->wait_lock) (BZ#2160614) * Support cpuset.sched_load_balance by changing default CPUset directory structure (BZ#2161105) * Rocky Linux9.0 - s390/kexec: fix ipl report address for kdump (BZ#2166903) * libgpiod doesn't seem to work with Interphase gpiochip (BZ#2166956) * Azure Rocky Linux9 scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (BZ#2170227) Enhancement(s): * IBM 9.2 FEAT: Upgrade the QETH driver to latest from upstream, e.g. kernel 6.0 (BZ#2166304) * Intel 9.2 FEAT SPR CPU: AMX: Improve the init_fpstate setup code (BZ#2168382) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * webpack: avoid cross-realm objects (CVE-2023-28154) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (CVE-2023-0266) * kernel: net: CPU soft lockup in TC mirred egress-to-ingress action (CVE-2022-4269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z3 Batch (BZ#2170460) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) * openssl: read buffer overflow in X.509 certificate verification (CVE-2022-4203) * openssl: timing attack in RSA Decryption implementation (CVE-2022-4304) * openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450) * openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215) * openssl: invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216) * openssl: NULL dereference validating DSA public key (CVE-2023-0217) * openssl: NULL dereference during PKCS7 data verification (CVE-2023-0401) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * HMAC generation should reject key lengths < 112 bits or provide an indicator in FIPS mode (BZ#2144000) * In FIPS mode, openssl should set a minimum length for passwords in PBKDF2 (BZ#2144003) * stunnel consumes high amount of memory when pestered with TCP connections without a TLS handshake (BZ#2144008) * In FIPS mode, openssl should reject SHAKE as digest for RSA-OAEP or provide an indicator (BZ#2144010) * In FIPS mode, openssl should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator (BZ#2144012) * In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator (BZ#2144015) * In FIPS mode, openssl should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16 (BZ#2144017) * In FIPS mode, openssl should reject KDF input and output key lengths < 112 bits or provide an indicator (BZ#2144019) * In FIPS mode, openssl should reject RSA keys < 2048 bits when using EVP_PKEY_decapsulate, or provide an indicator (BZ#2145170) * Rocky Linux9.1 Nightly[0912] - error:03000093:digital envelope routines::command not supported when git clone is run with configured ibmca engine backed by libica.so.4 (OpenSSL 3.0) (BZ#2149010) * OpenSSL FIPS checksum code needs update (BZ#2158412) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767) Bug Fix(es): * In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator. (BZ#2177434) * Need to update FIPS review comments into NSS Rocky Linux-9. (BZ#2177875) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.9.0. Security Fix(es): * Mozilla: Incorrect code generation during JIT compilation (CVE-2023-25751) * Mozilla: Memory safety bugs fixed in Firefox 111 and Firefox ESR 102.9 (CVE-2023-28176) * Mozilla: Potential out-of-bounds when accessing throttled streams (CVE-2023-25752) * Mozilla: Invalid downcast in Worklets (CVE-2023-28162) * Mozilla: URL being dragged from a removed cross-origin iframe into the same tab triggered navigation (CVE-2023-28164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: timing side-channel in the TLS RSA key exchange code (CVE-2023-0361) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * CCM tag length should be limited to known values (BZ#2144535) * In FIPS mode, gnutls should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator (BZ#2144537) * dracut-cmdline[554]: Error in GnuTLS initialization: Error while performing self checks i FIPS mode (BZ#2149640) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pesign packages provide the pesign utility for signing UEFI binaries as well as other associated tools. Security Fix(es): * pesign: Local privilege escalation on pesign systemd service (CVE-2022-3560) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libjpeg-turbo packages contain a library of functions for manipulating JPEG images. They also contain simple client programs for accessing the libjpeg functions. These packages provide the same functionality and API as libjpeg but with better performance. Security Fix(es): * libjpeg-turbo: heap buffer overflow in get_word_rgb_row() in rdppm.c (CVE-2021-46822) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: use-after-free caused by l2cap_reassemble_sdu() in net/bluetooth/l2cap_core.c (CVE-2022-3564) * kernel: stack overflow in do_proc_dointvec and proc_skip_spaces (CVE-2022-4378) * kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack (CVE-2022-4379) * kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan (CVE-2023-0179) * kernel: an out-of-bounds vulnerability in i2c-ismt driver (CVE-2022-2873) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z2 Batch (BZ#2160463) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: processing maliciously crafted web content may be exploited for arbitrary code execution (CVE-2023-23529) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.8.0 ESR. Security Fix(es): * Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767) * Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728) * Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730) * Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735) * Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737) * Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739) * Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743) * Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744) * Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746) * Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729) * Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732) * Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.8.0. Security Fix(es): * Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767) * Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728) * Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730) * Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735) * Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737) * Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739) * Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743) * Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744) * Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746) * Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729) * Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732) * Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616) * Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. Security Fix(es): * xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation (CVE-2023-0494) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. Security Fix(es): * grub2: Buffer overflow in grub_font_construct_glyph() can lead to out-of-bound write and possible secure boot bypass (CVE-2022-2601) * grub2: Heap based out-of-bounds write when redering certain unicode sequences (CVE-2022-3775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow to code executiona (CVE-2022-47629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection. Security Fix(es): * git: gitattributes parsing integer overflow (CVE-2022-23521) * git: Heap overflow in `git archive`, `git log --format` leading to RCE (CVE-2022-41903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.7.1. Security Fix(es): * Mozilla: Revocation status of S/Mime signature certificates was not checked (CVE-2023-0430) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.7.1. Security Fix(es): * Mozilla: libusrsctp library out of date (CVE-2022-46871) * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598) * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605) * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599) * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601) * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVE-2023-23602) * Mozilla: Fullscreen notification bypass (CVE-2022-46877) * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive (CVE-2023-23603) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: improper restrictions in CORBA deserialization (Serialization, 8285021) (CVE-2023-21830) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 8u362) [Rocky Linux-9] (BZ#2159912) * solr broken due to access denied ("java.io.FilePermission" "/etc/pki/java/cacerts" "read") [Rocky Linux-9, openjdk-8] (BZ#2163594) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 X.Org X11 libXpm runtime library. Security Fix(es): * libXpm: compression commands depend on $PATH (CVE-2022-4883) * libXpm: Runaway loop on width of 0 and enormous height (CVE-2022-44617) * libXpm: Infinite loop on unclosed comments (CVE-2022-46285) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 A library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions. Security Fix(es): * libtasn1: Out-of-bound access in ETYPE_OK (CVE-2021-46848) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The bash packages provide Bash (Bourne-again shell), which is the default shell for Rocky Linux. Security Fix(es): * bash: a heap-buffer-overflow in valid_parameter_transform (CVE-2022-3715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a single disk file. The API is designed for convenience and ease of use. Applications that link against SQLite can enjoy the power and flexibility of an SQL database without the administrative hassles of supporting a separate database server. Security Fix(es): * sqlite: an array-bounds overflow if billions of bytes are used in a string argument to a C API (CVE-2022-35737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: integer overflows with XML_PARSE_HUGE (CVE-2022-40303) * libxml2: dict corruption caused by entity reference cycles (CVE-2022-40304) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Expat is a C library for parsing XML documents. Security Fix(es): * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (CVE-2022-43680) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit. Security Fix(es): * systemd: buffer overrun in format_timespan() function (CVE-2022-3821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 D-Bus is a system for sending messages between applications. It is used both for the system-wide message bus service, and as a per-user-login-session messaging facility. Security Fix(es): * dbus: dbus-daemon crashes when receiving message with incorrectly nested parentheses and curly brackets (CVE-2022-42010) * dbus: dbus-daemon can be crashed by messages with array length inconsistent with element type (CVE-2022-42011) * dbus: `_dbus_marshal_byteswap` doesn't process fds in messages with "foreign" endianness correctly (CVE-2022-42012) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964) * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139) * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945) * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077) * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Intel 9.2: Important iavf bug fixes (BZ#2127884) * vfio zero page mappings fail after 2M instances (BZ#2128514) * nvme-tcp automatic reconnect fails intermittently during EMC powerstore NDU operation (BZ#2131359) * ice: Driver Update to 5.19 (BZ#2132070) * WARNING: CPU: 116 PID: 3440 at arch/x86/mm/extable.c:105 ex_handler_fprestore+0x3f/0x50 (BZ#2134588) * drm: duplicated call of drm_privacy_screen_register_notifier() in drm_connector_register() (BZ#2134619) * updating the appid field through sysfs is returning an -EINVAL error (BZ#2136914) * DELL EMC: System is not booting into RT Kernel with perc12. (BZ#2139213) * No signal showed in the VGA monitor when installing Rocky Linux9 in the legacy bios mode (BZ#2140153) * Practically limit "Dummy wait" workaround to old Intel systems (BZ#2142168) * ppc64le: unexpected oom panic when there's enough memory left in zswap test (BZ#2143976) * fatal error: error in backend: Branch target out of insn range (BZ#2144902) * AMdCLIENT: The kernel command line parameter "nomodeset" not working properly (BZ#2145217) * Azure: PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (BZ#2150910) * Azure z-stream: Sometimes newly deployed VMs are not getting accelerated network during provisioning (BZ#2151605) * DELL 9.0 RT - On PE R760 system, call traces are observed dmesg when system is running stress (BZ#2154407) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: POST following PUT confusion (CVE-2022-32221) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Internal linking fails on ppc64le (BZ#2144547) * crypto testcases fail on golang on s390x [Rocky Linux-9] (BZ#2149311) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20). Security Fix(es): * minimist: prototype pollution (CVE-2021-44906) * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256) * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-9] (BZ#2151627) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * postgresql: SQL Injection in ResultSet.refreshRow() with malicious column names (CVE-2022-31197) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite. Security Fix(es): * libreoffice: Macro URL arbitrary script execution (CVE-2022-3140) * libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation (CVE-2022-26305) * libreoffice: Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master Password (CVE-2022-26306) * libreoffice: Weak Master Keys (CVE-2022-26307) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The USBGuard software framework provides system protection against intrusive USB devices by implementing basic whitelisting and blacklisting capabilities based on device attributes. To enforce a user-defined policy, USBGuard uses the Linux kernel USB device authorization feature. Security Fix(es): * usbguard: Fix unauthorized access via D-Bus (CVE-2019-25058) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * LibTiff: DoS from Divide By Zero Error (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058) * libtiff: Double free or corruption in rotateImage() function at tiffcrop.c (CVE-2022-2519) * libtiff: tiffcrop: heap-buffer-overflow in extractImageSection in tiffcrop.c (CVE-2022-2953) * libtiff: Assertion fail in rotateImage() function at tiffcrop.c (CVE-2022-2520) * libtiff: Invalid pointer free operation in TIFFClose() at tif_close.c (CVE-2022-2521) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: watch queue race condition can lead to privilege escalation (CVE-2022-2959) * kernel: memory corruption in AX88179_178A based USB ethernet device. (CVE-2022-2964) * kernel: i915: Incorrect GPU TLB flush can lead to random memory access (CVE-2022-4139) * kernel: nfsd buffer overflow by RPC message over TCP with garbage data (CVE-2022-43945) * kernel: i2c: unbounded length leads to buffer overflow in ismt_access() (CVE-2022-3077) * kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * DELL EMC: System is not booting into RT Kernel with perc12 [kernel-rt] (BZ#2139863) * kernel-rt: update RT source tree to the latest Rocky Linux-9.1.z1 Batch (BZ#2141817) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, the use of a SQLite database provided by NSS was assumed, which was opened in read-only mode and with no PIN expected. This prevented the use of other databases or setting a PIN on the NSS database. This update allows more control over database use using two new properties - fips.nssdb.path and fips.nssdb.pin - which can be configured permanently in the java.security file or temporarily via command-line arguments to the Java virtual machine (RHBZ#2147476) * Prepare for the next quarterly OpenJDK upstream release (2023-01, 17.0.6) [Rocky Linux-9] (BZ#2153097) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.7.0 ESR. Security Fix(es): * Mozilla: libusrsctp library out of date (CVE-2022-46871) * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598) * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605) * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599) * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601) * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVE-2023-23602) * Mozilla: Fullscreen notification bypass (CVE-2022-46877) * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive (CVE-2023-23603) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fix(es): * sudo: arbitrary file write with privileges of the RunAs user (CVE-2023-22809) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411) (CVE-2023-21835) * OpenJDK: soundbank URL remote loading (Sound, 8293742) (CVE-2023-21843) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2023-01, 11.0.18) [Rocky Linux-9] (BZ#2157798) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.113 and .NET Runtime 6.0.13. The following packages have been upgraded to a later upstream version: dotnet6.0 (6.0.113). (BZ#2154459) Security Fix(es): * dotnet: Parsing an empty HTTP response as a JSON.NET JObject causes a stack overflow and crashes a process (CVE-2023-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: processing maliciously crafted web content may lead to an arbitrary code execution (CVE-2022-42856) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Byte Code Engineering Library (Apache Commons BCEL) is intended to give users a convenient way to analyze, create, and manipulate (binary) Java class files (those ending with .class). Security Fix(es): * Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18.12.1). (BZ#2142809, BZ#2142830, BZ#2142834, BZ#2142856) Security Fix(es): * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517) * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up. Security Fix(es): * varnish: Request Forgery Vulnerability (CVE-2022-45060) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Security Fix(es): * krb5: integer overflow vulnerabilities in PAC parsing (CVE-2022-42898) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: local privilege escalation via the multiprocessing forkserver start method (CVE-2022-42919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: Regression of CVE-2022-41974 fix in Rocky Linux (CVE-2022-3787) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution. Security Fix(es): * keylime: exception handling and impedance match in tornado_requests (CVE-2022-3500) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call (TI-RPC) documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Security Fix(es): * libtirpc: DoS vulnerability with lots of connections (CVE-2021-46828) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The logrotate utility simplifies the administration of multiple log files by allowing their automatic rotation, compression, removal, and mailing. Security Fix(es): * logrotate: potential DoS from unprivileged users via the state file (CVE-2022-1348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es): * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 HarfBuzz is an implementation of the OpenType Layout engine. Security Fix(es): * harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc (CVE-2022-33068) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The e2fsprogs packages provide a number of utilities for creating, checking, modifying, and correcting the ext2, ext3, and ext4 file systems. Security Fix(es): * e2fsprogs: out-of-bounds read/write via crafted filesystem (CVE-2022-1304) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. The following packages have been upgraded to a later upstream version: python3.9 (3.9.14). (BZ#2128249) Security Fix(es): * python: mailcap: findmatch() function does not sanitize the second argument (CVE-2015-20107) * python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Security Fix(es): * FreeType: Buffer overflow in sfnt_init_face (CVE-2022-27404) * FreeType: Segmentation violation via FNT_Size_Request (CVE-2022-27405) * Freetype: Segmentation violation via FT_Request_Size (CVE-2022-27406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libldb packages provide an extensible library that implements an LDAP-like API to access remote LDAP servers, or use local TDB databases. The following packages have been upgraded to a later upstream version: libldb (2.5.2). (BZ#2077490) Security Fix(es): * samba: AD users can induce a use-after-free in the server process with an LDAP add or modify request (CVE-2022-32746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have been upgraded to a later upstream version: samba (4.16.4). (BZ#2077487) Security Fix(es): * samba: server memory information leak via SMB1 (CVE-2022-32742) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: bad local IPv6 connection reuse (CVE-2022-27775) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field (CVE-2022-37434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The dpdk packages provide the Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing in the user space. Security Fix(es): * dpdk: DoS when a Vhost header crosses more than two descriptors and exhausts all mbufs (CVE-2022-2132) * DPDK: out-of-bounds read/write in vhost_user_set_inflight_fd() may lead to crash (CVE-2021-3839) * dpdk: error recovery in mlx5 driver not handled properly, allowing for denial of service (CVE-2022-28199) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: heap-based buffer overflow when handling large inputs due to an integer overflow (CVE-2022-24795) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 lxml is an XML processing library providing access to libxml2 and libxslt libraries using the Python ElementTree API. Security Fix(es): * lxml: NULL Pointer Dereference in lxml (CVE-2022-2309) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Mutt is a low resource, highly configurable, text-based MIME e-mail client. Mutt supports most e-mail storing formats, such as mbox and Maildir, as well as most protocols, including POP3 and IMAP. Security Fix(es): * mutt: buffer overflow in uudecoder function (CVE-2022-1328) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Security Fix(es): * dovecot: Privilege escalation when similar master and non-master passdbs are used (CVE-2022-30550) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Security Fix(es): * openjpeg: segmentation fault in opj2_decompress due to uninitialized pointer (CVE-2022-1122) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The following packages have been upgraded to a later upstream version: php (8.0.20). (BZ#2095752) Security Fix(es): * php: Use after free due to php_filter_float() failing for ints (CVE-2021-21708) * php: Uninitialized array in pg_query_params() leading to RCE (CVE-2022-31625) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration. The following packages have been upgraded to a later upstream version: 389-ds-base (2.1.3). (BZ#2061801) Security Fix(es): * 389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: SIGSEGV in sync_repl (CVE-2022-2850) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-0996) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Security Fix(es): * poppler: A logic error in the Hints::Hints function can cause denial of service (CVE-2022-27337) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WavPack is a completely open audio compression format providing lossless, high-quality lossy, and a unique hybrid compression mode. Security Fix(es): * wavpack: Heap out-of-bounds read in WavpackPackSamples() (CVE-2021-44269) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ignition is a utility used to manipulate systems during the initramfs. This includes partitioning disks, formatting partitions, writing files (regular files, systemd units, etc.), and configuring users. On first boot, Ignition reads its configuration from a source of truth (remote URL, network metadata service, hypervisor bridge, etc.) and applies the configuration. The following packages have been upgraded to a later upstream version: ignition (2.14.0). (BZ#2090647) Security Fix(es): * ignition: configs are accessible from unprivileged containers in VMs running on VMware products (CVE-2022-1706) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. The following packages have been upgraded to a later upstream version: frr (8.2.2). (BZ#2069563) Security Fix(es): * frrouting: overflow bugs in unpack_tlv_router_cap (CVE-2022-26125) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Redis is an advanced key-value store. It is often referred to as a data-structure server since keys can contain strings, hashes, lists, sets, and sorted sets. For performance, Redis works with an in-memory data set. You can persist it either by dumping the data set to disk every once in a while, or by appending each command to a log. Security Fix(es): * redis: Code injection via Lua script execution environment (CVE-2022-24735) * redis: Malformed Lua script can crash Redis (CVE-2022-24736) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime. Security Fix(es): * runc: incorrect handling of inheritable capabilities (CVE-2022-29162) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 FLAC stands for Free Lossless Audio Codec. FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, a command-line program to encode and decode FLAC files, and a command-line metadata editor for FLAC files. Security Fix(es): * flac: out of bound write in append_to_verify_fifo_interleaved_ of stream_encoder.c (CVE-2021-0561) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server. Security Fix(es): * dnsmasq: Heap use after free in dhcp6_no_relay (CVE-2022-0934) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. The following packages have been upgraded to a later upstream version: httpd (2.4.53). (BZ#2079939) Security Fix(es): * httpd: mod_sed: Read/write beyond bounds (CVE-2022-23943) * httpd: mod_lua: Use of uninitialized value of in r:parsebody (CVE-2022-22719) * httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody (CVE-2022-22721) * httpd: mod_proxy_ajp: Possible request smuggling (CVE-2022-26377) * httpd: mod_lua: DoS in r:parsebody (CVE-2022-29404) * httpd: mod_sed: DoS vulnerability (CVE-2022-30522) * httpd: mod_proxy: X-Forwarded-For dropped by hop-by-hop mechanism (CVE-2022-31813) * httpd: Out-of-bounds read via ap_rwrite() (CVE-2022-28614) * httpd: Out-of-bounds read in ap_strcmp_match() (CVE-2022-28615) * httpd: mod_lua: Information disclosure with websockets (CVE-2022-30556) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: DNS forwarders - cache poisoning vulnerability (CVE-2021-25220) * bind: DoS from specifically crafted TCP packets (CVE-2022-0396) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. The following packages have been upgraded to a later upstream version: unbound (1.16.2). (BZ#2087120) Security Fix(es): * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30698) * unbound: novel ghost domain attack that allows attackers to trigger continued resolvability of malicious domain names (CVE-2022-30699) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349) Security Fix(es): * sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673) * prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698) * grafana: XSS vulnerability in data source handling (CVE-2022-21702) * grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703) * grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-22624) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-22628) * webkitgtk: Buffer overflow leading to arbitrary code execution (CVE-2022-22629) * webkitgtk: Cookie management issue leading to sensitive user information disclosure (CVE-2022-22662) * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26700) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26709) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26710) * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26716) * webkitgtk: Use-after-free leading to arbitrary code execution (CVE-2022-26717) * webkitgtk: Memory corruption issue leading to arbitrary code execution (CVE-2022-26719) * webkitgtk: Heap buffer overflow in WebCore::TextureMapperLayer::setContentsLayer leading to arbitrary code execution (CVE-2022-30293) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Qt5 libraries packages provide Qt 5, version 5 of the Qt cross-platform application framework. Security Fix(es): * qt: QProcess could execute a binary from the current working directory when not found in the PATH (CVE-2022-25255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 FriBidi is a library to handle bidirectional scripts (for example Hebrew, Arabic), so that the display is done in the proper way, while the text data itself is always written in logical order. Security Fix(es): * fribidi: Stack based buffer overflow (CVE-2022-25308) * fribidi: Heap-buffer-overflow in fribidi_cap_rtl_to_unicode (CVE-2022-25309) * fribidi: SEGV in fribidi_remove_bidi_marks (CVE-2022-25310) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. The following packages have been upgraded to a later upstream version: libvirt (8.5.0). (BZ#2060313) Security Fix(es): * libvirt: missing locking in nwfilterConnectNumOfNWFilters can lead to denial of service (CVE-2022-0897) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates. Security Fix(es): * speex: divide by zero in read_samples() via crafted WAV file (CVE-2020-23903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The GIMP (GNU Image Manipulation Program) is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Security Fix(es): * gimp: buffer overflow through a crafted XCF file (CVE-2022-30067) * gimp: unhandled exception via a crafted XCF file may lead to DoS (CVE-2022-32990) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data. Security Fix(es): * protobuf: Incorrect parsing of nullchar in the proto symbol leads to Nullptr dereference (CVE-2021-22570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. The following packages have been upgraded to a later upstream version: qemu-kvm (7.0.0). (BZ#2064757) Security Fix(es): * QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free (CVE-2021-3750) * QEMU: fdc: heap buffer overflow in DMA read data transfers (CVE-2021-3507) * QEMU: intel-hda: segmentation fault due to stack overflow (CVE-2021-3611) * QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The virt-v2v package provides a tool for converting virtual machines to use the KVM (Kernel-based Virtual Machine) hypervisor or Rocky Enterprise Software Foundation Enterprise Virtualization. The tool modifies both the virtual machine image and its associated libvirt metadata. Also, virt-v2v can configure a guest to use VirtIO drivers if possible. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 guestfs-tools is a set of tools that can be used to make batch configuration changes to guests, get disk used/free statistics, perform backups and guest clones, change registry/UUID/hostname info, build guests from scratch, and much more. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libguestfs packages contain a library used for accessing and modifying virtual machine disk images. Security Fix(es): * libguestfs: Buffer overflow in get_keys leads to DoS (CVE-2022-2211) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fix(es): * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Low Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: improper authentication via PAM (CVE-2022-1049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Security Fix(es): * lua: heap buffer overflow in luaG_errormsg() in ldebug.c due to uncontrolled recursion in error handling (CVE-2022-33099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fix(es): * pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585) * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Update RT source tree to the latest Rocky Linux-9.0.z4 Batch (BZ#2123498) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * posix cpu timer use-after-free may lead to local privilege escalation (CVE-2022-2585) * Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option (CVE-2022-30594) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * kernel crash after reboot of T14/G2 AMD laptop (mt7921e module) (BZ#2095653) * execve exit tracepoint not called (BZ#2106661) * Matrox black screen on VGA output on some systems. (BZ#2112017) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (BZ#2121129) * watchdog BUG: soft lockup - CPU#30 stuck for 34s! [swapper/30:0] (BZ#2127857) * Update cifs to 5.16 (BZ#2127858) * Bad page state in process qemu-kvm pfn:68a74600 (BZ#2127859) * vfio zero page mappings fail after 2M instances (BZ#2128791) * The kernel needs to offer a way to reseed the Crypto DRBG and atomically extract random numbers from it (part 2) (BZ#2128970) Enhancement(s): * Need to enable hpilo to support new HPE RL300 Gen11 for ARM (aarch64) (BZ#2129453) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Security Fix(es): * zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field (CVE-2022-37434) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full strength general purpose cryptography library. Security Fix(es): * OpenSSL: X.509 Email Address Buffer Overflow (CVE-2022-3602) * OpenSSL: X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The device-mapper-multipath packages provide tools that use the device-mapper multipath kernel module to manage multipath devices. Security Fix(es): * device-mapper-multipath: Authorization bypass, multipathd daemon listens for client connections on an abstract Unix socket (CVE-2022-41974) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 KSBA (pronounced Kasbah) is a library to make X.509 certificates as well as the CMS easily accessible by other applications. Both specifications are building blocks of S/MIME and TLS. Security Fix(es): * libksba: integer overflow may lead to remote code execution (CVE-2022-3515) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 11.0.17) [Rocky Linux-9] (BZ#2131865) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: improper MultiByte conversion can lead to buffer overflow (JGSS, 8286077) (CVE-2022-21618) * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) * OpenJDK: missing SNI caching in HTTP/2 (Networking, 8289366) (CVE-2022-39399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Prepare for the next quarterly OpenJDK upstream release (2022-10, 17.0.5) [Rocky Linux-9] (BZ#2132934) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: excessive memory allocation in X.509 certificate parsing (Security, 8286533) (CVE-2022-21626) * OpenJDK: HttpServer no connection count limit (Lightweight HTTP Server, 8286918) (CVE-2022-21628) * OpenJDK: improper handling of long NTLM client hostnames (Security, 8286526) (CVE-2022-21619) * OpenJDK: insufficient randomization of JNDI DNS port numbers (JNDI, 8286910) (CVE-2022-21624) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16.17.1). Security Fix(es): * nodejs: weak randomness in WebCrypto keygen (CVE-2022-35255) * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.110 and .NET Runtime 6.0.10. Security Fix(es): * dotnet: Nuget cache poisoning on Linux via world-writable cache directory (CVE-2022-41032) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Nettle is a cryptographic library that is designed to fit easily in almost any context: In crypto toolkits for object-oriented languages, such as C++, Python, or Pike, in applications like LSH or GNUPG, or even in kernel space. The following packages have been upgraded to a later upstream version: gnutls (3.7.6), nettle (3.8). Security Fix(es): * gnutls: Double free during gnutls_pkcs7_verify. (CVE-2022-2509) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * [IBM 9.1] [P10] POWER10 performance enhancements for cryptography: nettle - incremental work (BZ#2102589) * Allow enabling KTLS in Rocky Linux 9.1 (BZ#2108532) * DES-CBC bag is decryptable under FIPS (BZ#2115314) * allow signature verification using RSA keys <2k in FIPS mode (BZ#2119770) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: buffer-over-read in SSPI and SMB authentication (CVE-2022-41318) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Expat is a C library for parsing XML documents. Security Fix(es): * expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 resolvers configured to answer from cache with zero stale-answer-timeout may terminate unexpectedly (CVE-2022-3080) * bind: memory leak in ECDSA DNSSEC verification code (CVE-2022-38177) * bind: memory leaks in EdDSA DNSSEC verification code (CVE-2022-38178) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. The following packages have been upgraded to a later upstream version: webkit2gtk3 (2.36.7). Security Fix(es): * webkitgtk: processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-32893) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features provided by recent Linux kernel releases. Security Fix(es): * dbus-broker: a stack buffer over-read if a malicious Exec line is supplied (CVE-2022-31212) * dbus-broker: null pointer reference when supplying a malformed XML config file (CVE-2022-31213) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The GNU Privacy Guard (GnuPG or GPG) is a tool for encrypting data and creating digital signatures, compliant with OpenPGP and S/MIME standards. Security Fix(es): * gpg: Signature spoofing via status line injection (CVE-2022-34903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (16.16.0), nodejs-nodemon (2.0.19). (BZ#2124230, BZ#2124233) Security Fix(es): * nodejs-ini: Prototype pollution via malicious INI file (CVE-2020-7788) * nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469) * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807) * normalize-url: ReDoS for data URLs (CVE-2021-33502) * nodejs: npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (CVE-2022-29244) * nodejs: DNS rebinding in --inspect via invalid IP addresses (CVE-2022-32212) * nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding (CVE-2022-32213) * nodejs: HTTP request smuggling due to improper delimiting of header fields (CVE-2022-32214) * nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (CVE-2022-32215) * got: missing verification of requested URLs allows redirects to UNIX sockets (CVE-2022-33987) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * nodejs:16/nodejs: Rebase to the latest Nodejs 16 release [Rocky Linux-9] (BZ#2121019) * nodejs: Specify --with-default-icu-data-dir when using bootstrap build (BZ#2124299) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql (8.0.30). (BZ#2122589) Security Fix(es): * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21412, CVE-2022-21414, CVE-2022-21435, CVE-2022-21436, CVE-2022-21437, CVE-2022-21438, CVE-2022-21440, CVE-2022-21452, CVE-2022-21459, CVE-2022-21462, CVE-2022-21478, CVE-2022-21479) * mysql: Server: DML unspecified vulnerability (CPU Apr 2022) (CVE-2022-21413) * mysql: Server: Replication unspecified vulnerability (CPU Apr 2022) (CVE-2022-21415) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21417, CVE-2022-21418, CVE-2022-21451, CVE-2022-21423) * mysql: Server: DDL multiple unspecified vulnerabilities (CPU Apr 2022) (CVE-2022-21425, CVE-2022-21444) * mysql: Server: FTS unspecified vulnerability (CPU Apr 2022) (CVE-2022-21427) * mysql: Server: Group Replication Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21454) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Jul 2022) (CVE-2022-21455) * mysql: Server: PAM Auth Plugin unspecified vulnerability (CPU Apr 2022) (CVE-2022-21457) * mysql: Server: Logging unspecified vulnerability (CPU Apr 2022) (CVE-2022-21460) * mysql: Server: Optimizer multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21509, CVE-2022-21525, CVE-2022-21526, CVE-2022-21527, CVE-2022-21528, CVE-2022-21529, CVE-2022-21530, CVE-2022-21531, CVE-2022-21553, CVE-2022-21556, CVE-2022-21569) * mysql: Server: Options unspecified vulnerability (CPU Jul 2022) (CVE-2022-21515) * mysql: InnoDB multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21517, CVE-2022-21537, CVE-2022-21539) * mysql: Server: Stored Procedure multiple unspecified vulnerabilities (CPU Jul 2022) (CVE-2022-21522, CVE-2022-21534) * mysql: Server: Federated unspecified vulnerability (CPU Jul 2022) (CVE-2022-21547) * mysql: Server: Security: Encryption unspecified vulnerability (CPU Jul 2022) (CVE-2022-21538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Default logrotate set to wrong log file (BZ#2122592) Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. The following packages have been upgraded to a later upstream version: ruby (3.0.4). (BZ#2109428) Security Fix(es): * Ruby: Double free in Regexp compilation (CVE-2022-28738) * Ruby: Buffer overrun in String-to-Float conversion (CVE-2022-28739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: local root privilege escalation in the virtual machine (CVE-2022-31676) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * pcs: obtaining an authentication token for hacluster user could lead to privilege escalation (CVE-2022-2735) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fix(es): * rsync: remote arbitrary files write inside the directories of connecting peers (CVE-2022-29154) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: HTTP compression denial of service (CVE-2022-32206) * curl: Unpreserved file permissions (CVE-2022-32207) * curl: FTP-KRB bad message verification (CVE-2022-32208) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.11), mariadb (10.5.16), mysql-selinux (1.0.5). Security Fix(es): * mariadb: MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is used (CVE-2021-46669) * mariadb: lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer (CVE-2022-24048) * mariadb: lack of validating the existence of an object prior to performing operations on the object (CVE-2022-24050) * mariadb: lack of proper validation of a user-supplied string before using it as a format specifier (CVE-2022-24051) * mariadb: CONNECT Storage Engine Heap-based Buffer Overflow Privilege Escalation Vulnerability (CVE-2022-24052) * mariadb: assertion failure in Item_args::walk_arg (CVE-2022-27376) * mariadb: use-after-poison when complex conversion is involved in blob (CVE-2022-27377) * mariadb: server crash in create_tmp_table::finalize (CVE-2022-27378) * mariadb: server crash in component arg_comparator::compare_real_fixed (CVE-2022-27379) * mariadb: server crash at my_decimal::operator= (CVE-2022-27380) * mariadb: server crash at Field::set_default via specially crafted SQL statements (CVE-2022-27381) * mariadb: assertion failure via component Item_field::used_tables/update_depend_map_for_order (CVE-2022-27382) * mariadb: use-after-poison in my_strcasecmp_8bit() of ctype-simple.c (CVE-2022-27383) * mariadb: crash via component Item_subselect::init_expr_cache_tracker (CVE-2022-27384) * mariadb: server crashes in query_arena::set_query_arena upon SELECT from view (CVE-2022-27386) * mariadb: assertion failures in decimal_bin_size (CVE-2022-27387) * mariadb: crash when using HAVING with NOT EXIST predicate in an equality (CVE-2022-27444) * mariadb: assertion failure in compare_order_elements (CVE-2022-27445) * mariadb: crash when using HAVING with IS NULL predicate in an equality (CVE-2022-27446) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27447) * mariadb: crash in multi-update and implicit grouping (CVE-2022-27448) * mariadb: assertion failure in sql/item_func.cc (CVE-2022-27449) * mariadb: crash via window function in expression in ORDER BY (CVE-2022-27451) * mariadb: assertion failure in sql/item_cmpfunc.cc (CVE-2022-27452) * mariadb: use-after-free when WHERE has subquery with an outer reference in HAVING (CVE-2022-27455) * mariadb: assertion failure in VDec::VDec at /sql/sql_type.cc (CVE-2022-27456) * mariadb: incorrect key in "dup value" error after long unique (CVE-2022-27457) * mariadb: use-after-poison in Binary_string::free_buffer (CVE-2022-27458) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31622) * mariadb: improper locking due to the unreleased lock in extra/mariabackup/ds_compress.cc (CVE-2022-31623) * mariadb: Crash executing query with VIEW, aggregate and subquery (CVE-2021-46659) * mariadb: MariaDB allows an application crash in find_field_in_tables and find_order_in_list via an unused common table expression (CTE) (CVE-2021-46661) * mariadb: MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements (CVE-2021-46663) * mariadb: MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr (CVE-2021-46664) * mariadb: MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations (CVE-2021-46665) * mariadb: MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements (CVE-2021-46668) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Out-of-bounds Write (CVE-2022-1785) * vim: out-of-bounds write in vim_regsub_both() in regexp.c (CVE-2022-1897) * vim: buffer over-read in utf_ptr2char() in mbyte.c (CVE-2022-1927) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: password of excessive length triggers buffer overflow leading to RCE (CVE-2022-31626) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631) * golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705) * golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962) * golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131) * golang: io/fs: stack exhaustion in Glob (CVE-2022-30630) * golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) * golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633) * golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Clean up dist-git patches (BZ#2109174) * Update Go to version 1.17.12 (BZ#2109183) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * grafana: OAuth account takeover (CVE-2022-31107) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices. Security Fix(es): * libinput: format string vulnerability may lead to privilege escalation (CVE-2022-1215) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es): * libarchive: an out-of-bounds read via the component zipx_lzma_alone_init (CVE-2022-26280) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The pcre2 package contains a new generation of the Perl Compatible Regular Expression libraries for implementing regular expression pattern matching using the same syntax and semantics as Perl. Security Fix(es): * pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c (CVE-2022-1586) * pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c (CVE-2022-1587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The libxml2 library is a development toolbox providing the implementation of various XML standards. Security Fix(es): * libxml2: integer overflows in xmlBuf and xmlBuffer lead to out-of-bounds write (CVE-2022-29824) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Moderate Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The grub2 packages provide version 2 of the Grand Unified Boot Loader (GRUB), a highly configurable and customizable boot loader with modular architecture. The packages support a variety of kernel formats, file systems, computer architectures, and hardware devices. The shim package contains a first-stage UEFI boot loader that handles chaining to a trusted full boot loader under secure boot environments. Security Fix(es): * grub2: Integer underflow in grub_net_recv_ip4_packets (CVE-2022-28733) * grub2: Crafted PNG grayscale images may lead to out-of-bounds write in heap (CVE-2021-3695) * grub2: Crafted PNG image may lead to out-of-bound write during huffman table handling (CVE-2021-3696) * grub2: Crafted JPEG image can lead to buffer underflow write in the heap (CVE-2021-3697) * grub2: Out-of-bound write when handling split HTTP headers (CVE-2022-28734) * grub2: shim_lock verifier allows non-kernel files to be loaded (CVE-2022-28735) * grub2: use-after-free in grub_cmd_chainloader() (CVE-2022-28736) * shim: Buffer overflow when loading crafted EFI images (CVE-2022-28737) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: authorization bypass when using "local" authorization (CVE-2022-26691) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short. Security Fix(es): * gzip: arbitrary-file-write vulnerability (CVE-2022-1271) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. compat-openssl11 provides the legacy 1.1 version of OpenSSL for use with older binaries. Security Fix(es): * openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * compat-openssl11 breaks in FIPS (BZ#2091968) Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The rsyslog packages provide an enhanced, multi-threaded syslog daemon. It supports MySQL, syslog/TCP, RFC 3195, permitted sender lists, filtering on any message part, and fine-grained control over output format. Security Fix(es): * rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 PostgreSQL is an advanced object-relational database management system (DBMS). The following packages have been upgraded to a later upstream version: postgresql (13.7). Security Fix(es): * postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox (CVE-2022-1552) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Security Fix(es): * subversion: Subversion's mod_dav_svn is vulnerable to memory corruption (CVE-2022-24070) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9 Rocky Linux 9 The gzip packages contain the gzip (GNU zip) data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fix(es): * gzip: arbitrary-file-write vulnerability (CVE-2022-1271) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Security Fix(es) Important Copyright 2025 Rocky Enterprise Software Foundation, Inc. cpe:/a:rocky:linux:9