SUSE-SU-2021:4015-2 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-3737: Fixed http client infinite line reading DoS after a http 100. bsc1189241 - CVE-2021-3733: Fixed ReDoS in urllib.request. bsc1189287 - CVE-2021-3426: Fixed an information disclosure via pydoc. bsc1183374 - Rebuild to get new...

SUSE-SU-2021:4015-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-3737: Fixed http client infinite line reading DoS after a http 100. bsc1189241 - CVE-2021-3733: Fixed ReDoS in urllib.request. bsc1189287 - CVE-2021-3426: Fixed an information disclosure via pydoc. bsc1183374 - Rebuild to get new...

Updated sharpziplib/mono-tools packages fix security vulnerability

Update to sharpziplib 1.3.3 which contains a security fix, and rebuild of mono-tools to use the fixed version...

Updated gpsd packages fix security vulnerability and other bugs

It was discovered that GPSd incorrectly handled certain leap second events which would result in the time jumping back 1024 weeks on 2021-10-31. This update provides upstream version 3.23 that has this and several other upstream issues fixed. It also fixes issues that prevents it to start properl...

Denial of service in go-ethereum due to CVE-2020-28362

Impact Versions of Geth built with Go 1.15.5 or 1.14.12 are most likely affected by a critical DoS-related security vulnerability. The golang team has registered the underlying flaw as ‘CVE-2020-28362’. We recommend all users to rebuild ideally v1.9.24 with Go 1.15.5 or 1.14.12, to avoid node...

Updated rust packages fix security vulnerabilities

This Rust update to version 1.52.1 includes security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162. These are memory safety bugs in the Rust standard library. Because it is statically linked, affected applications will need to be rebuilt to benefit...

MGASA-2021-0251 Updated rust packages fix security vulnerabilities

This Rust update to version 1.52.1 includes security fixes for CVE-2020-36323, CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162. These are memory safety bugs in the Rust standard library. Because it is statically linked, affected applications will need to be rebuilt to benefit...

sane-backends security update

1.0.27-22 - related 1852663 - needed to rebuild due infrastructure error 1.0.27-21 - 1852663, 1848097 - NULL pointer dereference in saneiepsonnetread function 1.0.27-20 - 1852468, 1852467, 1852466, 1852465 - prevent buffer overflow in esci2img - 1852668, 1852667, 1852666, 1852665 - disable...

Vaadin flow 安全漏洞

Vaadin flow is a software application. the Java framework for the Vaadin platform for building modern websites that look great, perform well and keep you and your users happy. A security vulnerability exists in vaadin that allows a local user to inject malicious code into front-end resources duri...

CVE-2021-21423

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

PYSEC-2021-111

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

Design/Logic Flaw

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2021-21423 Exposure of Version-Control Repository to an Unauthorized Control Sphere in projen

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

CVE-2021-21423

CVE-2021-21423 concerns the projen build tool. The issue centers on the rebuild-bot GitHub workflow (triggered by issue_comment with @projen rebuild) which runs with the repository’s GITHUB_TOKEN and could allow untrusted code to affect the main branch, potentially exposing secrets or altering co...

The vulnerability of the rebuildAggregateFrames function in the library for reading and modifying metadata in audio files from TagLib allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the rebuildAggregateFrames function in the library for reading and modifying metadata in audio files from TagLib is related to the unlimited loading of dangerous files. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its...

libcroco security update

0.6.12-6 - Rebuild with 7.9-z target Related: 1835951 0.6.12-5 - Fix CVE-2020-12825 Resolves: 1835951...

CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...

vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50941)

vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited to conduct cross-site scripting attacks via admincp/attachment.php&do=rebuild&type= URI...

CVE-2020-25124

The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI...

SUSE SLED15 / SLES15 Security Update : fwupd (SUSE-SU-2020:2258-1)

This update of fwupd fixes the following issue : rebuild with new UEFI signing key bsc1174543 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible...