Ubuntu 24.04 LTS : FreeRDP vulnerabilities (USN-7371-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7371-1 advisory. Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a...

[SECURITY] [DLA 4090-1] ruby-rack security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4090-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk March 24, 2025 https://wiki.debian.org/LTS -...

USN-7369-1: elfutils vulnerabilities

It was discovered that readelf from elfutils could be made to read out of bounds. If a user or automated system were tricked into running readelf on a specially crafted file, an attacker could cause readelf to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Umbraco Umbraco_Cms

Proof of concept for CVE-2025-24011 based on https://github.com/...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Alpine vulnerabilities (USN-7360-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7360-1 advisory. It was discovered that Alpine did not use a secure connection under certain circumstances. A remote attacker could possibly use...

[SECURITY] [DLA 4086-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4086-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb March 19, 2025 https://wiki.debian.org/LTS -...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : PlantUML vulnerability (USN-7353-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7353-1 advisory. Tobias S. Fink discovered that PlantUML was susceptible to cross-site scripting attacks XSS in instances...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : djoser vulnerability (USN-7354-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7354-1 advisory. Diego Cebrin discovered that djoser did not properly handle user authentication. An attacker with valid credentials could possibly...

USN-7352-1: FreeType vulnerability

It was discovered that FreeType incorrectly handled certain memory operations when parsing font subglyph structures. A remote attacker could use this issue to cause FreeType to crash, resulting in a denial of service, or possibly execute arbitrary code...

USN-7343-2: Jinja2 regression

USN-7343-1 fixed vulnerabilities in Jinja2. The update introduced a regression when attempting to import Jinja2 on Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Rafal Krupinski discovered that Jinja2 did not...

USN-7349-1: RAR vulnerabilities

It was discovered that RAR incorrectly handled certain paths. If a user or automated system were tricked into extracting a specially crafted RAR archive, a remote attacker could possibly use this issue to write arbitrary files outside of the targeted directory. CVE-2022-30333 It was discovered th...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Jinja2 vulnerabilities (USN-7343-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7343-1 advisory. Rafal Krupinski discovered that Jinja2 did not properly restrict the execution of cod...

USN-7343-1: Jinja2 vulnerabilities

Rafal Krupinski discovered that Jinja2 did not properly restrict the execution of code in situations where templates are used maliciously. An attacker with control over a template's filename and content could potentially use this issue to enable the execution of arbitrary code. This issue only...

USN-7341-1: FreeRDP vulnerabilities

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious server, a remote attacker could use this issue to cause FreeRDP to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2024-3203...

[SECURITY] [DLA 4083-1] squid security update

Debian LTS Advisory DLA-4083-1 [email protected] https://www.debian.org/lts/security/ Jochen Sprickerhof March 11, 2025 https://wiki.debian.org/LTS Package : squid Version : 4.13-10+deb11u4 CVE ID : CVE-2024-25111 CVE-2024-37894 CVE-2024-45802 Debian Bug : Several security vulnerabiliti...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenVPN vulnerabilities (USN-7340-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7340-1 advisory. It was discovered that OpenVPN did not perform proper input validation when generating a TLS key under certain configuration, whi...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-7342-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7342-1 advisory. Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use...

Ubuntu 24.04 LTS : Linux kernel (OEM) vulnerabilities (USN-7221-1)

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7221-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Cross-site Scripting (XSS)

openmage/magento-lts LTS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation due to the ability to execute scripts in the admin panel, potentially leading to XSS attacks against authenticated admin users...

USN-7336-1: GNU Chess vulnerability

Michael Vaughan discovered an overflow vulnerability in GNU Chess that occurs when reading a specially crafted Portable Game Notation PGN file. An attacker could possibly use this issue to cause GNU Chess to crash, resulting in a denial of service, or the execution of arbitrary code...