[SECURITY] [DSA 4934-1] intel-microcode security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4934-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 26, 2021 https://www.debian.org/security/faq -...

MGASA-2021-0274 Updated gnome-autoar packages fix a security vulnerability

gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations CVE-2021-28650. Also the previous update Bug 28454 introduced a regression, fixed here...

Updated gnome-autoar packages fix a security vulnerability

gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations CVE-2021-28650. Also the previous update Bug 28454 introduced a regression, fixed here...

CVE-2021-32697

neos/forms is an open source framework to build web forms. By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form...

CVE-2021-32697 Form validation can be skipped

neos/forms is an open source framework to build web forms. By crafting a special GET request containing a valid form state, a form can be submitted without invoking any validators. Form state is secured with an HMAC that is still verified. That means that this issue can only be exploited if Form...

SUSE-SU-2021:2106-1 Security update for salt

This update for salt fixes the following issues: Update to Salt release version 3002.2 jscECO-3212, jscSLE-18033, jscSLE-18028 - Check if dpkgnotify is executable bsc1186674 - Drop support for Python2. Obsoletes python2-salt package jscSLE-18028 - virt module updates network: handle missing ipv4...

SUSE SLES15: caribou / caribou-common / caribou-devel / etc (SUSE-SU-2021:2007-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:2007-1 advisory. Security issue fixed: - CVE-2021-3567: Fixed a segfault when attempting to use shifted characters bsc1186617. Tenable has extracted the...

SUSE: Security Advisory (SUSE-SU-2021:2026-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:2042-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2687-2] prosody regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2687-2 [email protected] https://www.debian.org/lts/security/ Anton Gladky June 19, 2021 https://wiki.debian.org/LTS -...

DLA-2687-2 prosody - regression update

Bulletin has no description...

SUSE-SU-2021:2042-1 Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94138 fixes several issues. The following issues were fixed: - CVE-2021-33034: Fixed a use-after-free when destroying an hcichan. This could lead to writing an arbitrary values bsc1186111. - CVE-2021-32399: Fixed a race condition when removing the HCI...

SUSE-SU-2021:2026-1 Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94144 fixes several issues. The following issues were fixed: - CVE-2021-33034: Fixed a use-after-free when destroying an hcichan. This could lead to writing an arbitrary values bsc1186111. - CVE-2021-28688: Fixed an issue introduced by XSA-365, leaving...

Security update for htmldoc (important)

openSUSE Security Update: Security update for htmldoc Announcement ID: openSUSE-SU-2021:0895-1 Rating: important References: 1184424 Cross-References: CVE-2021-20308 CVSS scores: CVE-2021-20308 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-20308 SUSE: 3.3...

SUSE: Security Advisory (SUSE-SU-2021:14748-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2021:14749-1 Security update for apache2

This update for apache2 fixes the following issues: - fixed CVE-2021-30641 bsc1187174: MergeSlashes regression - fixed CVE-2020-35452 bsc1186922: Single zero byte stack overflow in modauthdigest...

openSUSE: Security Advisory for htmldoc (openSUSE-SU-2021:0882-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Important: httpd

Issue Overview: A flaw was found in Apache httpd. The modproxywstunnel module tunnels non-upgraded connections. CVE-2019-17567 Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows CVE-2020-13938 A flaw was found In Apache httpd. The modproxy has a NULL...

GHSA-QJWC-V72V-FQ6R HTTP request smuggling in Undertow

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...

HTTP request smuggling in Undertow

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS...