[SECURITY] [DSA 5846-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5846-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 19, 2025 https://www.debian.org/security/faq -...

CVE-2025-21650: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclgefetchpfreg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclgefetchpfreg does not...

Debian dsa-5846 : fonts-opensymbol - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5846 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5846-1 [email protected] https://www.debian.org/securit...

ROS-20250117-07

A vulnerability in the dmaengine component of the Linux operating system kernel is related to the transfer of private resources. Exploitation of the vulnerability could allow an attacker to cause a denial of service A vulnerability in the powerpc/fixmap component of the Linux kernel is related to...

BIT-PHP-MIN-2021-21706 ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS...

PT-2025-4331

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an out-of-bounds access in the Linux kernel HNS3. The TQP BAR space is divided into two segments, but the hclge fetch pf reg function does not distinguish between...

CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

CVE-2024-55566

CVE-2024-55566 affects ColPack 1.0.10 through 9a7293a. A predictable temporary file in /tmp (name derived from an unseeded RNG) can lead to overwriting files or making ColPack graphing unavailable to other users. The provided documents do not specify the exact patched version; Fedora advisories n...

CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

ColPack security vulnerability

ColPack is a library of graphical coloring algorithms for CSCsw individual developers. A security vulnerability exists in ColPack versions 1.0.10 through 9a7293a and earlier, which stems from a predictable temporary file that could result in overwriting files or preventing other users from drawin...

CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

CVE-2024-55566

ColPack 1.0.10 through 9a7293a has a predictable temporary file located under /tmp with a name derived from an unseeded RNG. The impact can be overwriting files or making ColPack graphing unavailable to other users...

Insecure File Upload

agnai is vulnerable to an Insecure File Upload. The vulnerability is due to insufficient validation of user-uploaded files, allows attackers to choose the location where the files are stored on the server. potentially leading to overwriting existing files or uploading files to unintended...

Lack of unique constraint validation allows overwriting evaluators

Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...

CVE-2024-52291

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

CVE-2024-52291

CraftCMS has a local file system validation bypass flaw (CVE-2024-52291) that can be triggered by a double file:// scheme to point the base filesystem at sensitive folders. The root cause stems from FileHelper::normalizePath only removing a leading file://, enabling bypass when a second file:// i...

CVE-2024-52291

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

CVE-2024-52291: Improper Limitation of a Pathname to a Restricted Directory

Craft is a content management system CMS. A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme e.g., file://file:////. This enables the attacker to specify sensitive folders as the file system, leading to potential file...

Trend Micro VPN security vulnerability

Trend Micro VPN is a best-of-breed virtual private network service from Trend Micro. A security vulnerability exists in Trend Micro VPN version 5.8.1012 and prior versions, which stems from a vulnerability to arbitrary file overwriting under certain conditions, resulting in elevated privileges...

Agnai vulnerable to Relative Path Traversal in Image Upload

Summary A vulnerability has been discovered in Agnai that permits attackers to upload image files at attacker-chosen location on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for...