3.6 bug fix and enhancement update

An update is available for apache-commons-io, atinject, jsr-305, maven-shared-utils, plexus-cipher, aopalliance, plexus-classworlds, guava, apache-commons-cli, plexus-containers, plexus-sec-dispatcher, httpcomponents-client, maven-resolver, apache-commons-lang3, plexus-interpolation, sisu,...

perl-IO-String bug fix and enhancement update

An update is available for perl-IO-String. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

ALEA-2021:1816 perl-IO-String bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

perl-IO-String bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

PT-2021-4246

Name of the Vulnerable Software and Affected Versions Linux affected versions not specified Description The issue is caused by improper handling of VM IO|VM PFNMAP vmas in KVM, which can bypass RO checks and lead to pages being freed while still accessible by the VMM and guest. This allows users...

openSUSE Security Update : apache-commons-io (openSUSE-2021-605)

This update for apache-commons-io fixes the following issues : - CVE-2021-29425: Limited path traversal when invoking the method FileNameUtils.normalize with an improper input string bsc1184755 This update was imported from the SUSE:SLE-15-SP2:Update update project. %NASLMINLEVEL 70300 C Tenable...

OESA-2021-1182 apache-commons-io security update

Apache commons IO library is used for developing IO functionality. It contains a collecton of utilities with utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. Security Fixes: In Apache Commons IO before 2.7, When invoking the...

CVE-2021-23872

Privilege Escalation vulnerability in the File Lock component of McAfee Total Protection MTP prior to 16.0.32 allows a local user to gain elevated privileges by manipulating a symbolic link in the IOCTL interface...

Security update for redis (important)

openSUSE Security Update: Security update for redis Announcement ID: openSUSE-SU-2021:0682-1 Rating: important References: 1178205 1182657 1185729 1185730 ECO-2417 ECO-2867 PM-1547 PM-1615 PM-1622 PM-1681 SLE-11578 SLE-12821 Cross-References: CVE-2021-21309 CVE-2021-29477 CVE-2021-29478 CVSS...

PT-2021-28243

Name of the Vulnerable Software and Affected Versions: libfsext affected versions not specified Description: The issue is related to a crash caused by an unknown read. Technical details about the crash include the involvement of specific functions such as libfsext directory entry read data,...

PT-2021-6690 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: A code execution issue exists in the Nef polygon-parsing functionality due to an out-of-bounds read in the store sm boundary item function of Nef S2/SNC io parser.h. This can be triggered by a specially...

PT-2021-6721 · Unknown +1 · Cgal Libcgal +1

Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality. An out-of-bounds read vulnerability is present in the SNC io parser::read sface function, specifically in the store sm...

EulerOS 2.0 SP3 : blktrace (EulerOS-SA-2021-1768)

According to the version of the blktrace package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - blktrace aka Block IO Tracing 1.2.0, as used with the Linux kernel and Android, has a buffer overflow in the devmapread function in btt/devmap.c...

Apache Commons IO File Normalization

The vulnerability of the FileNameUtils.normalize method in the Apache Commons IO library is related to errors in processing sequence walks through directories, such as “//../foo” or “..foo”. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to...

com.closure-sys:freezedry (>=0.2.9, <=0.3.1) potentially affected by CVE-2021-29425 via org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io (1.4_3)

org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io MAVEN version 1.43 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-io and may be impacted: -...

com.alibaba:simpleimage (>=1.2.0, <=1.2.3), com.apigee.edge.config:apigee-config-maven-plugin (>=1.0, <=2.9.3) +729 more potentially affected by CVE-2021-29425 via commons-io:commons-io (1.2)

commons-io:commons-io MAVEN version 1.2 is affected by a known vulnerability. The following packages have a transitive dependency on commons-io:commons-io and may be impacted: - com.alibaba:simpleimage =1.2.0, =1.0, =1.0.0-beta, =1.0.0, =1.0, =1393, =4.6.0, =1.0.2, =1.0.2, =1.0.0, =1.0.0,...

cn.linham:beecloud-service-core (3.0), cn.linham:beecloud-service-springboot (3.1) +23 more potentially affected by CVE-2021-29425 via commons-io:commons-io (1.3)

commons-io:commons-io MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on commons-io:commons-io and may be impacted: - cn.linham:beecloud-service-core 3.0 - cn.linham:beecloud-service-springboot 3.1 -...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.rev.speechtotext:revai-java-sdk-speechtotext (>=1.0.0, <=1.4.0) +5119 more potentially affected by CVE-2021-29425 via commons-io:commons-io (1.4)

commons-io:commons-io MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on commons-io:commons-io and may be impacted: - aendter.jenkins.plugins:filesystem-list-parameter-plugin =0.0.1, =1.0.0, =2.1.0, =1.0, =1.0, =2.0-beta-3, =0.0.1, =0.2....

GHSA-GWRP-PVRQ-JMWV Path Traversal and Improper Input Validation in Apache Commons IO

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...

Path Traversal and Improper Input Validation in Apache Commons IO

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above thus "limited" path traversal,...