curl: 49: Cookie-jar save transfers group access to a different GID

Summary Curlfopen copies the old cookie jar's permission bits onto a newly created temp file, but the temp file may receive a different GID the process's primary group instead of the old file's group. After rename, group-permission bits that were intended for one group now authorize a different...

GHSA-F63G-88CJ-HJF9 IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

Summary IzPack's UnpackerBase.unpack resolves pack-file target paths without any canonical-path or directory-containment check. An attacker who distributes a trojanized installer JAR the format is unsigned can include pack entries whose targetPath contains ../ sequences. When a victim runs the...

MiracleLinux 9 : java-25-openjdk-25.0.4.0.7-1.1.el9.ML.1 (AXSA:2026-1651:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1651:08 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in Batik of Apache XML Graphics, allowing an attacker to load a URL through the jar protocol. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Firefox

Bypass of the same-origin policy in the Networking: JAR component. This vulnerability has been fixed in Firefox 151 and Thunderbird 151...

Astra Linux – Vulnerability in Firefox, Thunderbird

Bypass of the same-origin policy in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

Incorrect boundary conditions in networking: JAR components. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Batik

A Server-Side Request Forgery SSRF vulnerability exists in the Batik of Apache XML Graphics, allowing attackers to access files using a Jar URL. This issue affects Apache XML Graphics Batik 1.14...

Astra Linux – Vulnerability in Firefox and Thunderbird

Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Astra Linux – Vulnerability in Firefox and Thunderbird

When the number of cookies per domain was exceeded in document.cookie, the actual cookie jar sent to the host was no longer consistent with the expected state of the cookie jar. This could result in requests being sent with some cookies missing. This vulnerability affects Firefox 116, Firefox ESR...

Astra Linux – Vulnerability in Firefox

Under specific circumstances, a WebExtension may receive a jar:file:/// URI instead of a moz-extension:/// URI during a load request. This allows directory paths to be accessed on the user’s machine. This vulnerability affects Firefox for Android 112, Firefox 112, and Focus for Android 112...

The vulnerability of the JAR component in the Firefox web browser allows a hacker to trigger a service failure.

The vulnerability of the JAR component in the Firefox web browser is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of the JAR component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, allows a hacker to induce a service failure.

The vulnerability of the JAR component in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, is related to a deficiency in the source verification mechanism. Exploiting this vulnerability can allow an attacker to cause service interruptions...

MiracleLinux 9 : java-17-openjdk-17.0.20.0.8-1.2.el9.ML.1 (AXSA:2026-1630:13)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1630:13 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

java-1.8.0-openjdk: Fix of 6 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07. That fixes following CVEs: - CVE-2026-46968: JSSE, remote high-complexity integrity flaw in TLS certificate handling - CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity flaw in JPEG handling - CVE-2026-47021: 2D,...

java-1.7.0-openjdk: Fix of 6 CVEs

CVE-2026-47063: Enhance Jar handling JDK-8381049...

Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

Exploit for CVE-2026-16723

CVE-2026-16723 Fastjson RCE ★ CVE-2026-16723 Fastjson @JSONT...

MiracleLinux 9 : java-21-openjdk-21.0.12.0.8-1.2.el9.ML.1 (AXSA:2026-1580:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1580:09 advisory. JDK: Enhance TLS certificate handling CVE-2026-46968 JDK: Improve DTLS handshaking CVE-2026-46917 JDK: Enhance JPEG handling CVE-2026-47010 JDK:...

Debian dsa-6431 : openjdk-25-dbg - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6431 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6431-1 [email protected] https://www.debian.org/securit...