rpm package
almalinux/v8-12.4-devel
pkg:rpm/almalinux/v8-12.4-devel
Vulnerabilities (46)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-23166 | Hig | 7.5 | < 3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78 | 3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78 | May 19, 2025 | The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentiall | |
| CVE-2025-3277 | Cri | 9.8 | < 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756 | 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756 | Apr 14, 2025 | An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of | |
| CVE-2025-31498 | Hig | — | < 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756 | 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756 | Apr 8, 2025 | c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queri | |
| CVE-2025-23085 | Med | 5.3 | < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | Feb 7, 2025 | A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to inc | |
| CVE-2025-23083 | Hig | 7.7 | < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | Jan 22, 2025 | With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for | |
| CVE-2025-22150 | Med | 6.8 | < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57 | Jan 21, 2025 | Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generat |
- affected < 3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78fixed 3:12.4.254.21-1.22.16.0.1.module_el9.6.0+170+f035de78
The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentiall
- affected < 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756fixed 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756
An integer overflow can be triggered in SQLite’s `concat_ws()` function. The resulting, truncated integer is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the original, untruncated size and thus a wild Heap Buffer overflow of
- affected < 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756fixed 3:12.4.254.21-1.22.15.0.1.module_el8.10.0+3986+a908e756
c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queri
- affected < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57fixed 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57
A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to inc
- affected < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57fixed 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57
With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for
- affected < 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57fixed 3:12.4.254.21-1.22.13.1.1.module_el8.10.0+3961+6a788e57
Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generat
Page 3 of 3