Updated x11-server packages fix security vulnerabilities

The updated packages fix security vulnerabilities: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty. CVE-2023-5367 Use-after-free bug in DestroyWindow. CVE-2023-5380 Use-after-free bug in DamageDestroy. CVE-2023-5574...

CVE-2023-21367

CVE-2023-21367 concerns the Android Scudo memory allocator. The connected documents confirm a heap OOB read/write due to an insecure implementation/design, enabling local information disclosure without extra execution privileges and with no user interaction required. The Android 14 security relea...

[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-9slack15.0.txz: Rebuilt. This update fixes security issues: OOB write in...

xorg-server -- Multiple vulnerabilities

The X.Org project reports: ZDI-CAN-22153/CVE-2023-5367: X.Org server: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty When prepending values to an existing property an invalid offset calculation causes the existing values to be appended at the wrong offset. The resulting memcpy would...

ASB-A-273874525

In buildreadmultirsp of gattsr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

GHSA-J7HP-H8JX-5PPR libwebp: OOB write in BuildHuffmanTable

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page...

ASB-A-271335899

In eattl2capreconfigcompleted of eattimpl.h, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Input validation

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values rect-left and rect-top are exactly equal to surface-width and...

CVE-2023-39352

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values rect-left and rect-top are exactly equal to surface-width and...

ASB-A-272783039

In SDPAddAttribute of sdpdb.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3804-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3804-1 advisory. - Fixed multiple vulnerabilities in ezXML: CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202, CVE-2019-20199, CVE-2019-20200,...

SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3805-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3805-1 advisory. - Fixed multiple vulnerabilities in ezXML: CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202, CVE-2019-20199, CVE-2019-20200,...

SUSE CVE-2021-29603

TensorFlow is an end-to-end open source platform for machine learning. A specially crafted TFLite model could trigger an OOB write on heap in the TFLite implementation of...

Update now! Two critical flaws in Git's code found, patched

In a sponsored security source code audit, security experts from X41 D-SEC GmbH Eric Sesterhenn and Markus Vervier and GitLab Joern Schneeweisz found two notable critical flaws in Git's code. A vulnerability on Git could generally compromise source code repositories and developer systems, but...

GSD-2023-1001641 hfs: Fix OOB Write in hfs_asc2mac

hfs: Fix OOB Write in hfsasc2mac This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.337 by commit 8399318b13dc9e0569dee07ba2994098926d4fb2, it...

GSD-2023-1001490 hfs: Fix OOB Write in hfs_asc2mac

hfs: Fix OOB Write in hfsasc2mac This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit cff9fefdfbf5744afbb6d70bff2b49ec2065d23d, i...

GSD-2023-1001189 hfs: Fix OOB Write in hfs_asc2mac

hfs: Fix OOB Write in hfsasc2mac This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit 7af9cb8cbb81308ce4b06cc7164267faccbf75dd, it...

CVE-2022-32647

CVE-2022-32647 affects the ccu component and is described as an out-of-bounds write caused by improper input validation. The impact is local escalation of privilege with system execution privileges required, and exploitation is possible without user interaction. Remediation: patch identified as A...

USN-5683-1 linux-ibm vulnerabilities

It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of- bounds write. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-33655 Selim En...

SUSE: Security Advisory (SUSE-SU-2022:3495-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...