127 matches found
AZL-35879 CVE-2024-28180 affecting package dcos-cli for versions less than 1.2.0-16
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...
CLSA-2024-1709563071 Fix CVE(s): CVE-2023-51766
SECURITY UPDATE: SMTP smuggling because of . support - debian/patches/CVE-2023-51766.patch: reject "dot, LF" as ending data phase. Testcase for "smtp smuggling". - CVE-2023-51766...
CLSA-2024-1708427752 Fix CVE(s): CVE-2023-48795
Fix: possible segfault in the CVE-2023-48795 fix - debian/patches/CVE-2023-48795-post-fix.patch...
CLSA-2024-1707419801 Fix CVE(s): CVE-2023-5981
SECURITY UPDATE: timing side-channel in the RSA-PSK ClientKeyExchange - debian/patches/nettle-pk-randomness-level.patch: nettle/pk use the appropriate level of randomness for each operation. - debian/patches/pk-gnutlsswitchlibstate.patch: pk always use gnutlsswitchlibstate. -...
CLSA-2023-1703612912 openssh: Fix of CVE-2023-51385
CVE-2023-51385: ban user/hostnames with most shell metacharacters in command line...
CLSA-2023-1701971295 Fix CVE(s): CVE-2023-40217
SECURITY UPDATE: TLS handshake bypass - debian/patches/CVE-2023-40217.patch: Check for & avoid the ssl pre-close flaw. Update SSL tests - CVE-2023-40217...
CLSA-2023-1699468875 Fix CVE(s): CVE-2022-48560
SECURITY UPDATE: posible crash in heapq with custom comparison operators - debian/patches/CVE-2022-48560.patch: disallow releasing heap items during a comparison callback - CVE-2022-48560...
CLSA-2023-1698312539 Fix CVE(s): CVE-2023-5441, CVE-2023-5344
SECURITY UPDATE: a fix of buffer-overflow in truncstring - debian/patches/CVE-2023-5344.patch - CVE-2023-5344 SECURITY UPDATE: segfault in exmode - debian/patches/CVE-2023-5441.patch - CVE-2023-5441...
CLSA-2023-1697576053 Fix CVE(s): CVE-2023-4504
SECURITY UPDATE: heap-based buffer overflow - debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character - CVE-2023-4504...
CLSA-2023-1697575950 Fix CVE(s): CVE-2023-4504
SECURITY UPDATE: heap-based buffer overflow - debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character - CVE-2023-4504...
CLSA-2023-1693904973 Fix CVE(s): CVE-2022-48174
SECURITY UPDATE: unlikely stack overflow vulnerability - debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters - CVE-2022-48174...
DEBIAN-CVE-2023-39950
efibootguard is a simple UEFI boot loader with support for safely switching between current and updated partition sets. Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files can cause crashes and probably also code injections into bgsetenv or...
CLSA-2023-1689009273 Fix CVE(s): CVE-2023-32324
SECURITY UPDATE: a heap buffer overflow vulnerability - debian/patches/CVE-2023-32324.patch: fix cupsstrlcpy to exit immideately if a length of the source string is zero - CVE-2023-32324...
CLSA-2023-1687469258 Fix CVE(s): CVE-2022-34903
SECURITY UPDATE: buffer overflow allows for signature spoofing - debian/patches/CVE-2022-34903.patch: always use a break to terminate the escape detection loop. - CVE-2022-34903...
CLSA-2023-1685972217 Fix CVE(s): CVE-2023-2609
SECURITY UPDATE: NULL pointer dereference in getregister - debian/patches/CVE-2023-2609.patch: Check "yarray" is not NULL - CVE-2023-2609...
CLSA-2023-1685380362 Fix CVE(s): CVE-2023-33204, CVE-2022-39377
SECURITY UPDATE: a possible overflow because of an incomplete fix of CVE-2022-39377 - debian/patches/CVE-2023-33204.patch: check an overflow and exit if it be - CVE-2023-33204...
CLSA-2023-1679924984 vim: Fix of CVE-2023-1170
CVE-2023-1170: adjust the cursor column if needed...
CLSA-2023-1678820960 vim: Fix of CVE-2023-1175
CVE-2023-1175: make sure "startspaces" is not negative...
CLSA-2023-1675985375 Fix CVE(s): CVE-2023-22809
SECURITY UPDATE: edit a file not permitted by the security policy - debian/patches/CVE-2023-22809.patch: do not permit editor arguments to include "--" - CVE-2023-22809...