CVE-2023-35936 Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

CVE-2023-35936

Pandoc (the Haskell library/CLI) is affected from 1.13 up to but not including 3.1.4. An arbitrary file write could be triggered by a crafted image element when using --extract-media or when generating PDF, enabling creation/overwrite of files based on process privileges. Root cause involves flaw...

CVE-2023-35936

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

CVE-2023-35936 Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafte...

[SECURITY] Fedora 37 Update: ghc-cmark-gfm-0.2.5-1.fc37

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.6 and does not require prior installation of the C library...

Fedora: Security Advisory for ghc-cmark-gfm (FEDORA-2022-6bcee2cc93)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: ghc-cmark-gfm-0.2.5-1.fc35

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.6 and does not require prior installation of the C library...

[SECURITY] Fedora 36 Update: ghc-cmark-gfm-0.2.5-1.fc36

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.6 and does not require prior installation of the C library...

[SECURITY] Fedora 35 Update: exercism-3.0.13-8.fc35

Exercism provides a way to do the problems on https://exercism.io. This CLI ships as a binary with no additional run-time requirements. This mea ns that if you're doing the Haskell problems on exercism you don't need a working Python or Ruby environment simply to fetch and submit exercises...

GHSA-75RW-34Q6-72CR Signature forgery in Biscuit

Impact The paper Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1. It would allow an attacker to create a token with any access level. As Biscu...

CVE-2022-31053

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid Γ-signatures. Such an attack would allow an attacker to create a token with any access level. The...

Authentication flaw

Biscuit is an authentication and authorization token for microservices architectures. The Biscuit specification version 1 contains a vulnerable algorithm that allows malicious actors to forge valid G-signatures. Such an attack would allow an attacker to create a token with any access level. The...

Fedora: Security Advisory for pandoc (FEDORA-2022-1f981071eb)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: ghc-hakyll-4.13.4.0-5.1.fc34

Hakyll is a static website compiler library. It provides you with the tools to create a simple or advanced static website using a Haskell DSL and formats su ch as markdown or RST. You can find more information, including a tutorial, on t he website:...

[SECURITY] Fedora 34 Update: pandoc-2.9.2.1-10.fc34

Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. It can read several dialects of Markdown and subsets of HTML, reStructuredText, LaTeX, DocBook, JATS, MediaWiki markup, DokuWiki markup, TWiki markup, TikiWiki markup, Jir...

[SECURITY] Fedora 34 Update: ghc-cmark-gfm-0.2.3-1.fc34

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.3 and does not require prior installation of the C library...

Fedora: Security Advisory for ghc-cmark-gfm (FEDORA-2022-79b9a59e3b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: cabal-rpm-2.0.11-1.fc36

This package provides a RPM packaging tool for Haskell Cabal-based packages. cabal-rpm has commands to generate a RPM spec file and srpm for a package. It can rpmbuild packages, yum/dnf install their dependencies, prep packages, and install them. There are commands to list package dependencies an...

[SECURITY] Fedora 36 Update: ghc-cmark-gfm-0.2.3-1.fc36

This package provides Haskell bindings for , the reference parser for , a fully specified variant of Markdown. It includes sources for libcmark-gfm 0.29.0.gfm.3 and does not require prior installation of the C library...

[SECURITY] Fedora 34 Update: cabal-rpm-2.0.11-1.fc34

This package provides a RPM packaging tool for Haskell Cabal-based packages. cabal-rpm has commands to generate a RPM spec file and srpm for a package. It can rpmbuild packages, yum/dnf install their dependencies, prep packages, and install them. There are commands to list package dependencies an...