SUSE-SU-2022:3531-1 Security update for squid

This update for squid fixes the following issues: Updated squid to version 5.7: - CVE-2022-41317: Fixed exposure of sensitive information in cache manager bsc1203677. - CVE-2022-41318: Fixed buffer overread in SSPI and SMB Authentication bsc1203680...

squid: buffer-over-read in SSPI and SMB authentication

A flaw was found in Squid. An incorrect integer overflow protection in the Squid SSPI and SMB authentication helpers is vulnerable to a buffer overflow attack, resulting in information disclosure...

USN-5205-1 tcpreplay vulnerabilities

It was discovered that Tcpreplay incorrectly handled certain specially crafted packet capture input when processed by tcpprep. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 ESM. CVE-2018-13112 It was discovered that Tcpreplay...

The vulnerability of the ImageIO component in operating systems such as iOS, iPadOS, tvOS, watchOS, iCloud for Windows, and the multimedia player iTunes for Windows allows a malicious individual to gain unauthorized access to protected information or cause service failures.

The vulnerability of the ImageIO component in iOS, iPadOS, tvOS, watchOS operating systems, iCloud for Windows service, and the multimedia player iTunes for Windows lies in its ability to read data from beyond the allowed buffer limits. Exploiting this vulnerability can allow an attacker to gain...

The vulnerability of the pre-processing processor Simcenter Femap, related to reading beyond the buffer in memory, allows a hacker to execute arbitrary code within the context of the current process.

The vulnerability of the pre-processing processor Simcenter Femap lies in the reading of data beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the context of the current process, while analyzing specially created .NEU...

The vulnerability of the swtpm TPM emulator, related to reading beyond the buffer in memory, allows a malicious actor to trigger a service failure.

The vulnerability of the swtpm TPM emulator is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the `cv::PxMDecoder::readData` function in the `grfmt_pxm.cpp` component of the OpenCV library, which is used for computer vision, image processing, and numerical algorithms of general purpose, open-source computer vision. This vulnerability allows a attacker to cause a service denial.

The vulnerability of the cv::PxMDecoder::readData function in the grfmtpxm.cpp component of the Computer Vision, Image Processing, and Numerical Algorithms General Purpose Library OpenSource Computer Vision Library – OpenCV is related to the execution of operations outside of the buffer in memory...

OESA-2022-1974 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Exposure of Sensitive Information in Cache Manager...

OESA-2022-1973 deltarpm security update

Delta RPM packages contain the difference between an old and a new version of an RPM package. Applying a delta RPM on an old RPM results in the complete new RPM. It is not necessary to have a copy of the old RPM, because a delta RPM can also work with an installed RPM. Security Fixes: zlib throug...

The vulnerability of the header_value function in the embedded operating system OpenWrt allows a hacker to gain access to protected information.

The vulnerability of the headervalue function in the embedded operating system OpenWrt relates to the ability to read data beyond the buffer boundaries. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected information by sending a specially craft...

The vulnerability of the WLAN HOST microprogramming system component in Qualcomm’s embedded chips allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the WLAN HOST microprogramming system component in Qualcomm’s embedded chips relates to the lack of checks for buffer length and reading beyond the memory boundary during frame decompression. Exploiting this vulnerability can allow a remote attacker to cause service failures ...

The vulnerability of the Audio component in Qualcomm’s embedded software allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Audio component in embedded Qualcomm software lies in the lack of checks for buffer length and reading beyond the memory boundary. Exploiting this vulnerability can allow an attacker to cause a service failure or execute arbitrary code...

The vulnerability of the Bluetooth HOST microprogramming system component in Qualcomm’s embedded chips allows a perpetrator to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Bluetooth HOST microprogramming system component in Qualcomm embedded chips relates to the lack of checks on buffer length and reading beyond the memory boundary when processing the l2cap parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized...

The vulnerability of the get_ctl_id_hash() function in the audio subsystem of Linux operating systems allows a hacker to increase their privileges or cause service failures.

The vulnerability of the getctlidhash function in the audio subsystem of Linux operating systems is related to reading data beyond the buffer boundaries in memory when processing the parameter id-name. Exploiting this vulnerability can allow an attacker to enhance their privileges or cause system...

httpd: mod_lua: Information disclosure with websockets

A flaw was found in the modlua module of httpd. The data returned by the wsread function may point past the end of the storage allocated for the buffer, resulting in information disclosure...

UBUNTU-CVE-2022-32166

In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution...

The vulnerability of the `cv::RBaseStream::readBlock` function in the `modules/imgcodecs/src/bitstrm.cpp` file of the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, allows a hacker to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the cv::RBaseStream::readBlock function in the modules/imgcodecs/src/bitstrm.cpp file of the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, relates to reading data beyond the allowed buffer limits. Exploiting this...

The vulnerability of the internal/dcraw_common.cpp component in the LibRaw image processing library allows a hacker to trigger a service failure.

The vulnerability of the internal/dcrawcommon.cpp component in the LibRaw image processing library is related to reading data beyond the permissible buffer size. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

The vulnerability of the ng_pkt function in the transports/smart_pkt.c component of the Libgit2 C library methods allows a attacker to cause a service failure.

The vulnerability of the ngpkt function in the transports/smartpkt.c component of the Git methods implemented in the C language, Libgit2, relates to reading data from beyond the buffer’s acceptable limits. Exploiting this vulnerability allows a remote attacker to cause service failures...

The vulnerability of the internal/dcraw_common.cpp component in the LibRaw image processing library allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the internal/dcrawcommon.cpp component in the LibRaw image processing library relates to reading data beyond the permissible buffer size. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...