From Red Hat Security Advisory 2020:0199 :

An update for openslp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks.

Security Fix(es) :

* openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution (CVE-2019-5544)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0203 :

An update for libarchive is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers.

Security Fix(es) :

* libarchive: use-after-free in archive_read_format_rar_read_data when there is an error in the decompression of an archive entry (CVE-2019-18408)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0202 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

* OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0201 :

An update for python-reportlab is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python-reportlab is a library used for generation of PDF documents.

Security Fix(es) :

* python-reportlab: code injection in colors.py allows attacker to execute code (CVE-2019-17626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0196 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

* OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0195 :

An update for python-reportlab is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python-reportlab is a library used for generation of PDF documents.

Security Fix(es) :

* python-reportlab: code injection in colors.py allows attacker to execute code (CVE-2019-17626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0194 :

An update for apache-commons-beanutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Apache Commons BeanUtils library provides utility methods for accessing and modifying properties of arbitrary JavaBeans.

Security Fix(es) :

* apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0197 :

An update for python-reportlab is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Python-reportlab is a library used for generation of PDF documents.

Security Fix(es) :

* python-reportlab: code injection in colors.py allows attacker to execute code (CVE-2019-17626)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0157 :

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

* OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl (Networking, 8231795) (CVE-2020-2659)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0127 :

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.4.1.

Security Fix(es) :

* Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026)

* Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)

* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024)

* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0130 :

An update for dotnet3.0 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

.NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET Core that address security vulnerabilities are now available. The updated versions are .NET Core SDK 3.0.102 and .NET Core Runtime 3.0.2.

Security Fixes :

* dotnet: Memory Corruption in SignalR (CVE-2020-0603)

* dotnet: SignalR Denial of Service via backpressure issue (CVE-2020-0602)

Default inclusions for applications built with .NET Core have been updated to reference the newest versions and their security fixes.

For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.

From Red Hat Security Advisory 2020:0128 :

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780) (CVE-2020-2655)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0124 :

An update for git is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es) :

* git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0122 :

An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit.

Security Fix(es) :

* OpenJDK: Use of unsafe RSA-MD5 checkum in Kerberos TGS (Security, 8229951) (CVE-2020-2601)

* OpenJDK: Serialization filter changes via jdk.serialFilter property modification (Serialization, 8231422) (CVE-2020-2604)

* OpenJDK: Improper checks of SASL message properties in GssKrb5Base (Security, 8226352) (CVE-2020-2590)

* OpenJDK: Incorrect isBuiltinStreamHandler causing URL normalization issues (Networking, 8228548) (CVE-2020-2593)

* OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing (Libraries, 8234037) (CVE-2020-2654)

* OpenJDK: Incorrect handling of unexpected CertificateVerify TLS handshake messages (JSSE, 8231780) (CVE-2020-2655)

* OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport (Serialization, 8224909) (CVE-2020-2583)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0120 :

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.4.1.

Security Fix(es) :

* Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026)

* Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)

* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024)

* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[2.6.39-400.318.1.el6uek]
- x86/speculation: Determine swapgs before alternative instructions are set (Patrick Colp) [Orabug: 30379640]
- scsi: libsas: delete sas port if expander discover failed (Jason Yan) [Orabug: 30580689] {CVE-2019-15807}

Description of changes:

kernel-uek [3.8.13-118.42.1.el7uek]
- scsi: libsas: delete sas port if expander discover failed (Jason Yan) [Orabug: 30580688] {CVE-2019-15807}

From Red Hat Security Advisory 2020:0111 :

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.4.1 ESR.

Security Fix(es) :

* Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026)

* Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)

* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024)

* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2020:0085 :

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.4.1 ESR.

Security Fix(es) :

* Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026)

* Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)

* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)

* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024)

* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[4.1.12-124.35.1.el7uek]
- ixgbe: protect TX timestamping from API misuse (Manjunath Patil)  [Orabug: 30275491]
- block: init flush rq ref count to 1 (Josef Bacik)  [Orabug: 30360559]
- block: fix NULL pointer dereference in blk_mq_rq_timed_out() (Yufen Yu)  [Orabug: 30360559]
- blk-mq: Remove generation seqeunce (Keith Busch)  [Orabug: 30360559]
- scsi: libsas: delete sas port if expander discover failed (Jason Yan)  [Orabug: 30580687]  {CVE-2019-15807}
- scsi: qla2xxx: fix a potential NULL pointer dereference (Allen Pais)  [Orabug: 30618784]  {CVE-2019-16233}
- printk: Default console logging level should be set to 4 (Boris Ostrovsky)  [Orabug: 30657070]

[4.1.12-124.34.2.el7uek]
- scsi: lpfc: Remove lpfc_enable_pbde as module parameter (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Make PBDE optimizations configurable (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Update driver version to 11.4.0.8 and Copyright updates (Ketan Mukadam)  [Orabug: 30569875]
- scsi: lpfc: Fix ELS abort on SLI-3 adapters (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Correct race with abort on completion path (James Smart)  [Orabug: 30569875]
- scsi: lpfc: update manufacturer attribute to reflect Broadcom (James Smart)  [Orabug: 30569875] [Orabug: 29212758]
- scsi: lpfc: Enable Management features for IF_TYPE=6 (James Smart)  [Orabug: 30569875] [Orabug: 29212758]
- scsi: lpfc: Correct topology type reporting on G7 adapters (James Smart)  [Orabug: 30569875] [Orabug: 29212758]
- scsi: lpfc: Correct invalid EQ doorbell write on if_type=6 (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Fix driver not setting dpp bits correctly in doorbell word (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Enhance log messages when reporting CQE errors (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Fix frequency of Release WQE CQEs (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Code cleanup for 128byte wqe data type (James Smart)  [Orabug: 30569875]
- scsi: lpfc: use __raw_writeX on DPP copies (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add embedded data pointers for enhanced performance (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Enable fw download on if_type=6 devices (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add if_type=6 support for cycling valid bits (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add 64G link speed support (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add PCI Ids for if_type=6 hardware (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add push-to-adapter support to sli4 (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Add SLI-4 if_type=6 support to the code base (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Rework sli4 doorbell infrastructure (James Smart)  [Orabug: 30569875]
- scsi: lpfc: Rework lpfc to allow different sli4 cq and eq handlers (James Smart)  [Orabug: 30569875]
- x86/bugs: use check_bugs instead of microcode_late_select_mitigation (Mihai Carabas)  [Orabug: 30332499]
- x86/bugs: spec_ctrl_mutex taken in stop_machine context (Mihai Carabas)  [Orabug: 30332499]
- x86/microcode: moved cpu feature late eval to stop_machine (Mihai Carabas)  [Orabug: 30332499]
- x86/cpu: Re-apply forced caps every time CPU caps are re-read (Andy Lutomirski)  [Orabug: 30332499]
- x86/microcode/intel: Check microcode revision before updating sibling threads (Ashok Raj)  [Orabug: 30332499]
- tracing: Fix possible double free on failure of allocating trace buffer (Steven Rostedt (VMware))  [Orabug: 30633873]  {CVE-2017-18595}

From Red Hat Security Advisory 2019:4273 :

An update for the container-tools:1.0 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es) :

* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4269 :

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es) :

* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

* runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

* backport json-file logging support to 1.4.2 (BZ#1770176)

* Selinux won't allow SCTP inter pod communication (BZ#1774382)

From Red Hat Security Advisory 2019:4361 :

An update for fribidi is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

A library to handle bidirectional scripts (for example Hebrew, Arabic), so that the display is done in the proper way, while the text data itself is always written in logical order.

Security Fix(es) :

* fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/ fribidi-bidi.c leading to denial of service and possible code execution (CVE-2019-18397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4356 :

An update for git is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

The following packages have been upgraded to a later upstream version:
git (2.18.2). (BZ#1784058)

Security Fix(es) :

* git: Remote code execution in recursive clones with nested submodules (CVE-2019-1387)

* git: Arbitrary path overwriting via export-marks in-stream command feature (CVE-2019-1348)

* git: Recursive submodule cloning allows using git directory twice with synonymous directory name written in .git/ (CVE-2019-1349)

* git: Files inside the .git directory may be overwritten during cloning via NTFS Alternate Data Streams (CVE-2019-1352)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4326 :

An update for fribidi is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

A library to handle bidirectional scripts (for example Hebrew, Arabic), so that the display is done in the proper way, while the text data itself is always written in logical order.

Security Fix(es) :

* fribidi: buffer overflow in fribidi_get_par_embedding_levels_ex() in lib/ fribidi-bidi.c leading to denial of service and possible code execution (CVE-2019-18397)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[2.02-78.0.2]
- grub-set-bootflag: fix grubenv update method, fix CVE-2019-14865 [Orabug: 30607067]

From Red Hat Security Advisory 2019:4256 :

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* KEYS: prevent creating a different user's keyrings RHEL-6.10 (BZ#1537371)

* BUG: unable to handle kernel NULL pointer dereference at (null) (BZ# 1733760)

* long I/O stalls with bnx2fc from not masking off scope bits of retry delay value (BZ#1749512)

From Red Hat Security Advisory 2019:4254 :

An update for freetype is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently.

Security Fix(es) :

* freetype: a heap-based buffer over-read in T1_Get_Private_Dict in type1/ t1parse.c leading to information disclosure (CVE-2015-9381)

* freetype: mishandling ps_parser_skip_PS_token in an FT_New_Memory_Face operation in skip_comment, psaux/psobjs.c, leads to a buffer over-read (CVE-2015-9382)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4240 :

An update for openslp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSLP is an open source implementation of the Service Location Protocol (SLP) which is an Internet Engineering Task Force (IETF) standards track protocol and provides a framework to allow networking applications to discover the existence, location, and configuration of networked services in enterprise networks.

Security Fix(es) :

* openslp: Heap-based buffer overflow in ProcessSrvRqst() in slpd_process.c leading to remote code execution (CVE-2019-5544)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[4.14.35-1902.8.4.el7uek]
- Revert 'oled: give panic handler chance to run before kexec' (John Donnelly)  [Orabug: 30594702]
- Revert 'oled: export symbols' (John Donnelly)  [Orabug: 30594702]
- net/rds: Recycle RDS headers to speed up connection fail over (Ka-Cheong Poon)  [Orabug: 30628735]
- net/rds: Reduce RDS headers de-allocation time (Ka-Cheong Poon)  [Orabug: 30628735]
- net/rds: Should use rds_rtd_ptr() to trace pointer value (Ka-Cheong Poon)  [Orabug: 30628735]

[4.14.35-1902.8.3.el7uek]
- rds: Disable heartbeat by default (H&aring kon Bugge)  [Orabug: 30580080]

[4.14.35-1902.8.2.el7uek]
- rds:ib: Set RoCE ACK timeout before resolving route (Dag Moxnes)  [Orabug: 30581176]
- RDMA/cma: Use ACK timeout for RoCE packetLifeTime (Dag Moxnes)  [Orabug: 30581176]
- x86/hyperv: Make vapic support x2apic mode (Roman Kagan)  [Orabug: 30571044]
- PCI: hv: Refactor hv_irq_unmask() to use cpumask_to_vpset() (Maya Nakamura)  [Orabug: 30571044]
- PCI: hv: Replace hv_vp_set with hv_vpset (Maya Nakamura)  [Orabug: 30571044]
- PCI: hv: Add __aligned(8) to struct retarget_msi_interrupt (Maya Nakamura)  [Orabug: 30571044]
- MAINTAINERS: Add Hyper-V IOMMU driver into Hyper-V CORE AND DRIVERS scope (Lan Tianyu)  [Orabug: 30571044]
- iommu/hyper-v: Add Hyper-V stub IOMMU driver (Lan Tianyu)  [Orabug: 30571044]
- x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available (Lan Tianyu)  [Orabug: 30571044]
- x86/apic: Provide apic_ack_irq() (Thomas Gleixner)  [Orabug: 30571044]
- rds: ib: update WR sizes when bringing up connection (Dag Moxnes)  [Orabug: 30572790]
- USB: sisusbvga: fix oops in error path of sisusb_probe (Oliver Neukum)  [Orabug: 30548564]  {CVE-2019-15219}
- block-mq: fix hung due to too much warning log (Junxiao Bi)  [Orabug: 30544816]
- oled: export symbols (Wengang Wang)  [Orabug: 30550387]
- oled: give panic handler chance to run before kexec (Wengang Wang)  [Orabug: 30550387]

[4.14.35-1902.8.1.el7uek]
- ocfs2: protect extent tree in ocfs2_prepare_inode_for_write() (Shuning Zhang)  [Orabug: 30545335]
- kvm: mmu: ITLB_MULTIHIT mitigation selection (Kanth Ghatraju)  [Orabug: 30539764]
- x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs (Josh Poimboeuf)  [Orabug: 30539764]
- cpu/speculation: Uninline and export CPU mitigations helpers (Tyler Hicks)  [Orabug: 30539764]
- x86/speculation/taa: Fix for mitigation for TSX Async Abort (Kanth Ghatraju)  [Orabug: 30533711]
- media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug: 30532773]  {CVE-2019-15217}
- x86: cpu: bugs.c: Fix compile error when CONFIG_XEN=n (Aaron Young)  [Orabug: 30516915]
- SUNRPC: Remove xprt_connect_status() (Trond Myklebust)  [Orabug: 30513391]
- SUNRPC: Handle ENETDOWN errors (Trond Myklebust)  [Orabug: 30513391]
- x86/platform/uv: Account for UV Hubless in is_uvX_hub Ops (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Check EFI Boot to set reboot type (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Decode UVsystab Info (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Add UV Hubbed/Hubless Proc FS Files (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Setup UV functions for Hubless UV Systems (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Add return code to UV BIOS Init function (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Return UV Hubless System Type (Mike Travis)  [Orabug: 30518602]
- x86/platform/uv: Save OEM_ID from ACPI MADT probe (Mike Travis)  [Orabug: 30518602]

[4.14.35-1902.8.0.1.sn.el7uek]
- rds: ib: Improve neighbor cache flush throttling (Dag Moxnes)  [Orabug: 30472626]
- KVM: VMX: Do not change PID.NDST when loading a blocked vCPU (Joao Martins)  [Orabug: 30512558]
- KVM: x86: Recompute PID.ON when clearing PID.SN (Joao Martins)  [Orabug: 30512558]
- Revert 'KVM: VMX: sync pending posted interrupts based on PIR' (Joao Martins)  [Orabug: 30512558]
- cpuidle: haltpoll: Take 'idle=' override into account (Zhenzhong Duan)  [Orabug: 30519673]
- media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum)  [Orabug: 30511740]  {CVE-2019-15215}
- rds: ib: __flush_neigh_conn error messages in syslog during failover/failback (Dag Moxnes)  [Orabug: 30499609]
- kdump: decouple trace_extern_vmcoreinfo_setup from CONFIG_TRACING (Dave Kleikamp)  [Orabug: 30493478]
- media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490490]  {CVE-2019-15213}
- net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445304]  {CVE-2019-16994}
- mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445156]  {CVE-2019-17055}
- ieee802154: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30444945]  {CVE-2019-17053}
- net: hsr: fix memory leak in hsr_dev_finalize() (Mao Wenan)  [Orabug: 30444852]  {CVE-2019-16995}
- vhost/vsock: fix uninitialized vhost_vsock->guest_cid (Stefan Hajnoczi)  [Orabug: 30339795]
- fm10k: Fix a potential NULL pointer dereference (Yue Haibing)  [Orabug: 30322694]  {CVE-2019-15924}
- x86/apic: Get rid of multi CPU affinity (Thomas Gleixner)  [Orabug: 29645216]
- rds: ib: need to flush neighbor cache for local peer connections on failover (Dag Moxnes)  [Orabug: 30472629]

From Red Hat Security Advisory 2019:4195 :

An update for thunderbird is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4190 :

An update for nss, nss-softokn, and nss-util is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

The nss-util packages provide utilities for use with the Network Security Services (NSS) libraries.

Security Fix(es) :

* nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745)

* nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (CVE-2019-11729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4152 :

An update for nss-softokn is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

Security Fix(es) :

* nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4148 :

An update for thunderbird is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 68.3.0.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[2.6.39-400.317.1.el6uek]
- ieee802154: enforce CAP_NET_RAW for raw sockets (Allen Pais) [Orabug: 30444948] {CVE-2019-17053}
- mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron) [Orabug: 30445161] {CVE-2019-17055}
- net: sit: fix memory leak in sit_init_net() (Mao Wenan) [Orabug: 30445309] {CVE-2019-16994}
- media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum) [Orabug: 30490493] {CVE-2019-15213}
- media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN) [Orabug: 30532776] {CVE-2019-15217}
- USB: sisusbvga: fix oops in error path of sisusb_probe (Oliver Neukum) [Orabug: 30548567] {CVE-2019-15219}

Description of changes:

kernel-uek [3.8.13-118.41.1.el7uek]
- x86/speculation: Determine swapgs before alternative instructions are set (Patrick Colp) [Orabug: 30379626] - ieee802154: enforce CAP_NET_RAW for raw sockets (Allen Pais) [Orabug: 30444947] {CVE-2019-17053}
- mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron) [Orabug: 30445159] {CVE-2019-17055}
- net: sit: fix memory leak in sit_init_net() (Mao Wenan) [Orabug: 30445307] {CVE-2019-16994}
- media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum) [Orabug: 30490492] {CVE-2019-15213}
- media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum) [Orabug: 30511742] {CVE-2019-15215}
- media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN) [Orabug: 30532775] {CVE-2019-15217}
- USB: sisusbvga: fix oops in error path of sisusb_probe (Oliver Neukum) [Orabug: 30548566] {CVE-2019-15219}

The remote Oracle Linux host is missing a security update for the Unbreakable Enterprise kernel package(s).

From Red Hat Security Advisory 2019:4114 :

An update for nss is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4111 :

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.3.0 ESR.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:4107 :

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.3.0 ESR.

Security Fix(es) :

* Mozilla: Use-after-free in worker destruction (CVE-2019-17008)

* Mozilla: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (CVE-2019-17012)

* Mozilla: Buffer overflow in plain text serializer (CVE-2019-17005)

* Mozilla: Use-after-free when performing device orientation checks (CVE-2019-17010)

* Mozilla: Use-after-free when retrieving a document in antitracking (CVE-2019-17011)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Description of changes:

[3:1.17-33.19.0.4]
- set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618737]

[3:1.17-33.19.0.1]
- merge Oracle changes for early load via dracut
- enable late load on install for UEK4 kernels marked safe (except BDW-79)
- update 06-55-04 to 0x2000065
- update 06-55-07 to 0x500002c

Description of changes:

[2:2.1-53.3.0.4]
- set early_microcode='no' in virtualized guests to avoid early load bugs [Orabug: 30618736]

[2:2.1-53.3.0.1]
- do not late load prior to 3.10.0
- ensure late loading fixes are present on 4.1.12-* and 4.14.35-*
- enable early loading on 06-4f-01
- update 06-55-04 to 0x2000065
- update 06-55-07 to 0x500002c

From Red Hat Security Advisory 2019:4024 :

An update for SDL is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es) :

* SDL: CVE-2019-13616 not fixed in Red Hat Enterprise Linux 7 erratum RHSA-2019:3950 (CVE-2019-14906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:3981 :

An update for 389-ds-base is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server.
The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es) :

* 389-ds-base: Read permission check bypass via the deref plugin (CVE-2019-14824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* DB Deadlock on modrdn appears to corrupt database and entry cache (BZ# 1749289)

* After audit log file is rotated, DS version string is logged after each update (BZ#1754831)

* Extremely slow LDIF import with ldif2db (BZ#1763622)

* ns-slapd crash on concurrent SASL BINDs, connection_call_io_layer_callbacks must hold hold c_mutex (BZ#1763627)

* CleanAllRUV task limit not enforced (BZ#1767622)

From Red Hat Security Advisory 2019:3979 :

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

* kernel: local attacker can trigger multiple use-after-free conditions results in privilege escalation (CVE-2019-15239)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* On RHEL 7.7 kernel SCSI VPD information for NVMe drives is missing (breaks InfoScale) (BZ#1752423)

* RHEL7 fnic spamming logs: Current vnic speed set to : 40000 (BZ#1754836)

* kernel build: parallelize redhat/mod-sign.sh (BZ#1755330)

* kernel build: speed up module compression step (BZ#1755339)

* Nested VirtualBox VMs on Windows guest has the potential of impacting memory region allocated to other KVM guests (BZ#1755781)

* NULL pointer dereference at check_preempt_wakeup+0x109 (BZ#1756265)

* Regression: panic in pick_next_task_rt (BZ#1756267)

* ixgbe reports 'Detected Tx Unit Hang' with adapter reset on RHEL 7 (BZ# 1757350)

* [Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM. (BZ#1757757)

* nvme: dead loop in blk_mq_tagset_wait_completed_request() when it is called from timeout handler (BZ#1758051)

* [mlx5] VF Representer naming is not consistent/persistent through reboots with OSPD deployment (BZ#1759003)

* OS getting restarted because of driver issue with QLogic Corp.
ISP2532-based 8Gb Fibre Channel to PCI Express HBA [1077:2532] (rev 02). (BZ#1759447)

* mlx5: Load balancing not working over VF LAG configuration (BZ#1759449)

* RHEL7.8 - ISST-LTE: vimlp1: Running LTP af_alg04.c (crypto) crash the LPAR (BZ#1763620)

* RHEL7.5 - Fix security issues on crypto vmx (BZ#1763621)

* RHEL 7.7 RC1 - Host crashes about 4.5 hours into switch port bounce test (BZ#1763624)

* RHEL7.6 - cacheinfo code unsafe vs LPM (BZ#1763625)

* xfs hangs on acquiring xfs_buf semaphore (BZ#1764245)

* single CPU VM hangs during open_posix_testsuite (BZ#1766087)

* rcu_sched self-detected stall on CPU while booting with nohz_full (BZ# 1766098)

From Red Hat Security Advisory 2019:3976 :

An update for tcpdump is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The tcpdump packages contain the tcpdump utility for monitoring network traffic. The tcpdump utility can capture and display the packet headers on a particular network interface or on all interfaces.

Security Fix(es) :

* tcpdump: Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap (CVE-2018-19519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:3951 :

An update for SDL is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Simple DirectMedia Layer (SDL) is a cross-platform multimedia library designed to provide fast access to the graphics frame buffer and audio device.

Security Fix(es) :

* SDL: heap-based buffer overflow in SDL blit functions in video/SDL_blit*.c (CVE-2019-13616)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:3890 :

An update for ghostscript is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es) :

* ghostscript: -dSAFER escape in .charkeys (701841) (CVE-2019-14869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:3871 :

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: Intel GPU blitter manipulation can allow for arbitrary kernel memory write (CVE-2019-0155)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

From Red Hat Security Advisory 2019:3832 :

An update for kernel is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: Machine Check Error on Page Size Change (IFU) (CVE-2018-12207)

* hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135)

* hw: Intel GPU Denial Of Service while accessing MMIO in lower power state (CVE-2019-0154)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

ID	Name	Severity
133220	Oracle Linux 6 : openslp (ELSA-2020-0199)	High
133187	Oracle Linux 7 : libarchive (ELSA-2020-0203)	Medium
133186	Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2020-0202)	Medium
133185	Oracle Linux 8 : python-reportlab (ELSA-2020-0201)	High
133184	Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2020-0196)	Medium
133183	Oracle Linux 7 : python-reportlab (ELSA-2020-0195)	High
133182	Oracle Linux 7 : apache-commons-beanutils (ELSA-2020-0194)	High
133155	Oracle Linux 6 : python-reportlab (ELSA-2020-0197)	High
133154	Oracle Linux 6 : java-1.8.0-openjdk (ELSA-2020-0157)	Medium
133153	Oracle Linux 8 : thunderbird (ELSA-2020-0127)	Medium
133123	Oracle Linux 8 : .NET / Core / Enterprise / Hat / Linux / Red / on (ELSA-2020-0130)	High
133122	Oracle Linux 8 : java-11-openjdk (ELSA-2020-0128)	Medium
133021	Oracle Linux 7 : git (ELSA-2020-0124)	Medium
133020	Oracle Linux 7 : java-11-openjdk (ELSA-2020-0122)	Medium
133019	Oracle Linux 7 : thunderbird (ELSA-2020-0120)	Medium
132946	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2020-5512)	High
132945	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5511)	High
132944	Oracle Linux 8 : firefox (ELSA-2020-0111)	Medium
132881	Oracle Linux 7 : firefox (ELSA-2020-0085)	Medium
132762	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5508)	High
132668	Oracle Linux 8 : container-tools:1.0 (ELSA-2019-4273) (Ping Flood) (Reset Flood)	High
132667	Oracle Linux 8 : container-tools:ol8 (ELSA-2019-4269) (Ping Flood) (Reset Flood)	Medium
132412	Oracle Linux 8 : fribidi (ELSA-2019-4361)	Medium
132381	Oracle Linux 8 : git (ELSA-2019-4356)	Medium
132380	Oracle Linux 7 : fribidi (ELSA-2019-4326)	Medium
132305	Oracle Linux 8 : grub2 (ELSA-2019-4869)	Medium
132304	Oracle Linux 6 : kernel (ELSA-2019-4256)	High
132303	Oracle Linux 6 : freetype (ELSA-2019-4254)	Medium
132221	Oracle Linux 7 : openslp (ELSA-2019-4240)	High
132067	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4878)	Low
131974	Oracle Linux 8 : thunderbird (ELSA-2019-4195)	Medium
131973	Oracle Linux 7 : nss / nss-softokn / nss-util (ELSA-2019-4190)	Medium
131972	Oracle Linux 6 : nss-softokn (ELSA-2019-4152)	Medium
131971	Oracle Linux 7 : thunderbird (ELSA-2019-4148)	Medium
131918	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4872)	Low
131917	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4871)	Low
131916	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4870)	Medium
131915	Oracle Linux 8 : nss (ELSA-2019-4114)	Medium
131829	Oracle Linux 8 : firefox (ELSA-2019-4111)	Medium
131828	Oracle Linux 7 : firefox (ELSA-2019-4107)	Medium
131744	Oracle Linux 6 : microcode_ctl (ELSA-2019-4868)	High
131743	Oracle Linux 7 : microcode_ctl (ELSA-2019-4867)	High
131521	Oracle Linux 7 : SDL (ELSA-2019-4024)	High
131520	Oracle Linux 7 : 389-ds-base (ELSA-2019-3981)	Low
131519	Oracle Linux 7 : kernel (ELSA-2019-3979)	High
131518	Oracle Linux 7 : tcpdump (ELSA-2019-3976)	Medium
131373	Oracle Linux 8 : SDL (ELSA-2019-3951)	Medium
131274	Oracle Linux 8 : ghostscript (ELSA-2019-3890)	Medium
131273	Oracle Linux 8 : kernel (ELSA-2019-3871)	High
131272	Oracle Linux 8 : kernel (ELSA-2019-3832)	Low

Oracle Linux Local Security Checks Family for Nessus