Linux · Red Hat · Security advisory · April 28, 2020

RHSA-2020:1766: Security update for 68 packages

RHSA-2020:1766, released April 28, 2020, fixes 5 CVEs across 68 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0206
81st percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
LibRawRHEL 80:0.19.5-1.el8
LibRaw-develRHEL 80:0.19.5-1.el8
accountsserviceRHEL 80:0.6.50-8.el8
accountsservice-develRHEL 80:0.6.50-8.el8
accountsservice-libsRHEL 80:0.6.50-8.el8
appstream-dataRHEL 80:8-20191129.el8
baobabRHEL 80:3.28.0-4.el8
clutterRHEL 80:1.26.2-8.el8
clutter-develRHEL 80:1.26.2-8.el8
clutter-docRHEL 80:1.26.2-8.el8
evinceRHEL 80:3.28.4-4.el8
evince-browser-pluginRHEL 80:3.28.4-4.el8
evince-libsRHEL 80:3.28.4-4.el8
evince-nautilusRHEL 80:3.28.4-4.el8
gdmRHEL 81:3.28.3-29.el8
gjsRHEL 80:1.56.2-4.el8
gjs-develRHEL 80:1.56.2-4.el8
gnome-boxesRHEL 80:3.28.5-8.el8
gnome-control-centerRHEL 80:3.28.2-19.el8
gnome-control-center-filesystemRHEL 80:3.28.2-19.el8
gnome-menusRHEL 80:3.13.3-11.el8
gnome-menus-develRHEL 80:3.13.3-11.el8
gnome-online-accountsRHEL 80:3.28.2-1.el8
gnome-online-accounts-develRHEL 80:3.28.2-1.el8
gnome-remote-desktopRHEL 80:0.1.6-8.el8
gnome-sessionRHEL 80:3.28.1-8.el8
gnome-session-wayland-sessionRHEL 80:3.28.1-8.el8
gnome-session-xsessionRHEL 80:3.28.1-8.el8
gnome-settings-daemonRHEL 80:3.32.0-9.el8
gnome-shellRHEL 80:3.32.2-14.el8
gnome-softwareRHEL 80:3.30.6-3.el8
gnome-software-editorRHEL 80:3.30.6-3.el8
gnome-terminalRHEL 80:3.28.3-1.el8
gnome-terminal-nautilusRHEL 80:3.28.3-1.el8
gnome-tweaksRHEL 80:3.28.1-7.el8
gsettings-desktop-schemasRHEL 80:3.32.0-4.el8
gsettings-desktop-schemas-develRHEL 80:3.32.0-4.el8
gtk-update-icon-cacheRHEL 80:3.22.30-5.el8
gtk3RHEL 80:3.22.30-5.el8
gtk3-develRHEL 80:3.22.30-5.el8
gtk3-immodule-ximRHEL 80:3.22.30-5.el8
gvfsRHEL 80:1.36.2-8.el8
gvfs-afcRHEL 80:1.36.2-8.el8
gvfs-afpRHEL 80:1.36.2-8.el8
gvfs-archiveRHEL 80:1.36.2-8.el8
gvfs-clientRHEL 80:1.36.2-8.el8
gvfs-develRHEL 80:1.36.2-8.el8
gvfs-fuseRHEL 80:1.36.2-8.el8
gvfs-goaRHEL 80:1.36.2-8.el8
gvfs-gphoto2RHEL 80:1.36.2-8.el8
gvfs-mtpRHEL 80:1.36.2-8.el8
gvfs-smbRHEL 80:1.36.2-8.el8
libvncserverRHEL 80:0.9.11-14.el8
libvncserver-develRHEL 80:0.9.11-14.el8
libxsltRHEL 80:1.1.32-4.el8
libxslt-develRHEL 80:1.1.32-4.el8
mozjs52RHEL 80:52.9.0-2.el8
mozjs52-develRHEL 80:52.9.0-2.el8
mozjs60RHEL 80:60.9.0-4.el8
mozjs60-develRHEL 80:60.9.0-4.el8
mutterRHEL 80:3.32.2-34.el8
mutter-develRHEL 80:3.32.2-34.el8
nautilusRHEL 80:3.28.1-12.el8
nautilus-develRHEL 80:3.28.1-12.el8
nautilus-extensionsRHEL 80:3.28.1-12.el8
valaRHEL 80:0.40.19-1.el8
vala-develRHEL 80:0.40.19-1.el8
vinagreRHEL 80:3.22.0-21.el8

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2018-20337 gtk3: GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fix(es): * LibRaw: stack-based buffe...8.8 0.0206 None reported
High CVE-2019-12447 clutter-devel: GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fix(es): * LibRaw: stack-based buffe...7.3 0.0174 None reported
High CVE-2019-12448 accountsservice: GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fix(es): * LibRaw: stack-based buffe...8.1 0.0169 None reported
Routine CVE-2019-12449 accountsservice: GNOME is the default desktop environment of Red Hat Enterprise Linux. Security Fix(es): * LibRaw: stack-based buffe...5.7 0.0174 None reported
Routine CVE-2019-3825 gdm3: A vulnerability was discovered in gdm before 3.31.46.4 0.0051 None reported
Showing 1 to 5 of 5 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.