Advisory ROSA-SA-2021-1887

Software: libreswan 3.25 OS: Cobalt 7.9 CVE-ID: CVE-2019-10155 CVE-Crit: LOW CVE-DESC: The Libreswan project has discovered a vulnerability in the handling of IKEv1 information exchange packets that are encrypted and integrity protected using the established IKE SA encryption and integrity keys,...

Advisory ROSA-SA-2021-1886

Software: librepo 1.8.1 OS: Cobalt 7.9 CVE-ID: CVE-2020-14352 CVE-Crit: HIGH CVE-DESC: A bug was discovered in librepo in versions prior to 1.12.1. A directory traversal vulnerability was discovered where paths in remote repository metadata could not be cleared. An attacker controlling a remote...

Advisory ROSA-SA-2021-1885

Software: libproxy 0.4.11 OS: Cobalt 7.9 CVE-ID: CVE-2020-25219 CVE-Crit: HIGH CVE-DESC: url :: recvline in url.cpp in libproxy 0.4.x to 0.4.15 allows a remote HTTP server to run uncontrolled recursion through a response consisting of an infinite stream with no newline character. This results in...

Advisory ROSA-SA-2021-1884

Software: libpng 1.5.13 OS: Cobalt 7.9 CVE-ID: CVE-2013-7353 CVE-Crit: HIGH CVE-DESC: Integer overflow in pngsetunknownchunks function in libpng / pngset.c in libpng before 1.5.14beta08 allows context-sensitive attackers to cause a denial of service segmentation error and crash via a crafted imag...

Advisory ROSA-SA-2021-1883

Software: libplist 1.12 OS: Cobalt 7.9 CVE-ID: CVE-2017-6435 CVE-Crit: MEDIUM CVE-DESC: The parsestringnode function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service memory corruption via a created plist file. CVE-STATUS: default CVE-REV: default CVE-I...

Advisory ROSA-SA-2021-1882

Software: libpcap 1.5.3 OS: Cobalt 7.9 CVE-ID: CVE-2019-15165 CVE-Crit: MEDIUM CVE-DESC: sf-pcapng.c in libpcap before 1.9.1 incorrectly checks the length of the PHB header before allocating memory. CVE-STATUS: default CVE-REV: default CVE-ID: CVE-2019-15161 CVE-Crit: MEDIUM CVE-DESC: rpcapd /...

Advisory ROSA-SA-2021-1880

Software: libnotify 0.7.7 OS: Cobalt 7.9 CVE-ID: CVE-2013-7381 CVE-Crit: CRITICAL CVE-DESC: libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands using undefined characters when libnotify.notify is called. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1879

Software: libmwaw 0.3.5 OS: Cobalt 7.9 CVE-ID: CVE-2017-9433 CVE-Crit: CRITICAL CVE-DESC: The libmwaw document release project prior to 08.04.2017 had an out-of-range entry caused by a heap-based buffer overflow associated with the MsWrd1Parser :: readFootnoteCorrespondance function in lib /...

Advisory ROSA-SA-2021-1877

Software: libmad 0.15.1b OS: Cobalt 7.9 CVE-ID: CVE-2018-7263 CVE-Crit: CRITICAL CVE-DESC: The maddecoderrun function in decoder.c in Underbit libmad before 0.15.1b allows remote attackers to cause a denial of service SIGABRT due to double release or corruption or possibly have unspecified other...

Advisory ROSA-SA-2021-1876

Software: liblouis 2.5.2 OS: Cobalt 7.9 CVE-ID: CVE-2018-17294 CVE-Crit: MEDIUM CVE-DESC: The matchCurrentInput function inside loutranslateString.c in Liblouis before version 3.7 does not check the length of the input string, allowing attackers to cause a denial of service application failure du...

Advisory ROSA-SA-2021-1875

Software: libjpeg-turbo 1.2.90 OS: Cobalt 7.9 CVE-ID: CVE-2014-9092 CVE-Crit: MEDIUM CVE-DESC: libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service crash via a crafted JPEG file associated with an Exif token. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1874

Software: libimobiledevice 1.2.0 OS: Cobalt 7.9 CVE-ID: CVE-2017-5209 CVE-Crit: CRITICAL CVE-DESC: The base64decode function in base64.c in libimobiledevice libplist before 1.12 allows attackers to retrieve sensitive information from process memory or cause a denial of service buffer overflow usi...

Advisory ROSA-SA-2021-1873

Software: libidn 1.28 OS: Cobalt 7.9 CVE-ID: CVE-2015-2059 CVE-Crit: MEDIUM CVE-DESC: The stringpreputf8toucs4 function in libin prior to 1.31, used in jabberd2, allows context-sensitive attackers to read system memory and possibly exert other undefined influence via invalid UTF-8 characters in a...

Advisory ROSA-SA-2021-1872

Software: libgxps 0.3.0 OS: Cobalt 7.9 CVE-ID: CVE-2018-10733 CVE-Crit: MEDIUM CVE-DESC: There is a heap-based buffer overflow in the ftfontfacehash function of the gxps-fonts.c file in libgxps before version 0.3.0. The input created will result in a remote denial of service attack. CVE-STATUS:...

Advisory ROSA-SA-2021-1871

Software: libgsf 1.14.26 OS: Cobalt 7.9 CVE-ID: CVE-2016-9888 CVE-Crit: MEDIUM CVE-DESC: A bug in the tardirectoryforfile function gsf-infile-tar.c in the GNOME structured file library before 1.14.41 can be used to trigger null pointer dereferencing and then crash through a created TAR file...

Advisory ROSA-SA-2021-1869

Software: libevent 2.0.21 OS: Cobalt 7.9 CVE-ID: CVE-2014-6272 CVE-Crit: MEDIUM CVE-DESC: Multiple integer overflows in the evbuffer API in Libevent 1.4.x through 1.4.15, 2.0.x through 2.0.22, and 2.1.x through 2.1.The 5-beta allow context-aware attackers to cause a denial of service or possibly...

Advisory ROSA-SA-2021-1867

Software: libebml 1.3.9 OS: Cobalt 7.9 CVE-ID: CVE-2021-3405 CVE-Crit: MEDIUM CVE-DESC: A bug was found in libebml before version 1.4.2. A heap overflow bug exists in the EbmlString :: ReadData and EbmlUnicodeString :: ReadData implementations of libebml. CVE-STATUS: default CVE-REV: default...

Advisory ROSA-SA-2021-1865

Software: libcroco 0.6.12 OS: Cobalt 7.9 CVE-ID: CVE-2017-7960 CVE-Crit: MEDIUM CVE-DESC: The crinputnewfromuri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service heap-based buffer re-read via a crafted CSS file. CVE-STATUS: default CVE-REV:...

Advisory ROSA-SA-2021-1864

Software: libcaca 0.99 OS: Cobalt 7.9 CVE-ID: CVE-2018-20544 CVE-Crit: MEDIUM CVE-DESC: floating-point exception in caca / dither.c function cacaditherbitmap in libcaca 0.99.beta19. CVE-STATUS: default CVE-REV: default CVE-ID: CVE-2018-20545 CVE-Crit: HIGH CVE-DESC: There is an invalid WRITE memo...

Advisory ROSA-SA-2021-1863

Software: libass 0.13.4 OS: Cobalt 7.9 CVE-ID: CVE-2020-24994 CVE-Crit: HIGH CVE-DESC: Stack overflow in the parsetag function in libass / assparse.c in libass before version 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file. CVE-STATUS: defau...