Virtuozzo Hybrid Server 7.5 Update 5 Hotfix 3 (7.5.5-293)

The Hotfix 3 for Virtuozzo Hybrid Server 7.5 Update 5 provides a security bug fix. Vulnerability id: PSBM-153331 A critical security issue in container suspend/resume in the Virtuozzo Hybrid Server 7.5. Update 5 version...

SUSE-SU-2024:0113-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-6610: Fixed an out of bounds read in the SMB client when printing debug information bsc1217946. - CVE-2022-2586: Fixed a use-after-free which can ...

SUSE-SU-2024:0110-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2020-26555: Fixed an issue during BR/EDR PIN code pairing in the Bluetooth subsystem that would allow replay attacks bsc1179610 bsc1215237. - CVE-2023-6121:...

Heap overflow

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service DoS. If an MX Series device receives PTP packets on an MPC3E that doesn't...

CVE-2023-4641

A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from...

CVE-2023-6865

CVE-2023-6865 describes a vulnerability in Firefox’s EncryptingOutputStream that could expose uninitialized data, potentially allowing data to be written to local disk with implications for private browsing mode. Affected products noted in the provided documents include Firefox ESR versions prior...

CVE-2023-50262 Dompdf possible DoS caused by infinite recursion when parsing SVG images

Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Dompdf performs an initial validation to ensure that paths within the SVG are allowed. One of the validations is that the SVG document does not reference itself. However, prior to version 2.0.4, a recursive chained using two or...

Upgrade Tomcat to fix CVE-2023-46589

h3. Issue Summary This is reproducible on Data Center: / Apache Tomcat should be upgraded to 8.5.96 and later or 9.0.83 or a later version to fix CVE-2023-46589|https://nvd.nist.gov/vuln/detail/CVE-2023-46589 h3. Environment 8.1.x to 9.4.x h3. Steps to Reproduce Check the Apache Tomcat version...

Cross site scripting

Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS = v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell...

container-tools:4.0 security and bug fix update

buildah 1:1.24.6-7 - rebuild for CVE-2023-29406 - Related: 2176055 cockpit-podman conmon containernetworking-plugins containers-common container-selinux criu crun fuse-overlayfs libslirp oci-seccomp-bpf-hook podman 2:4.0.2-24 - rebuild for CVE-2023-29406 - Related: 2176055 python-podman runc skop...

CVE-2023-6212

Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 120, Firefox ESR...

CVE-2023-48292

CVE-2023-48292 concerns the XWiki Admin Tools RunShellCommand feature. The issue is a cross-site request forgery (CSRF) in versions 4.4 up to 4.5.0/1 that lets an authenticated admin be tricked into executing shell commands on the server. An attacker can exploit this by injecting a command into a...

Moderate: container-tools:4.0 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: insufficient sanitization of Host header CVE-2023-29406 For more details about the security issues, including the impact, a CVSS score,...

xorg-x11-server-Xwayland security, bug fix, and enhancement update

22.1.9-2 - Rebuild 2158761 22.1.9-1 - xwayland 22.1.9 2158761 21.1.3-8 - Fix CVE-2023-1393 2180299...

OSV-2023-1129 UNKNOWN READ in HeifPixelImage::overlay

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63990 Crash type: UNKNOWN READ Crash state: HeifPixelImage::overlay HeifContext::decodeoverlayimage HeifContext::decodeimageplanar...

Moderate: containernetworking-plugins security and bug fix update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

CVE-2023-44398

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, BmffImage::brotliUncompress, is new in v0.28.0, so earlier versions of Exiv2 are not...

SUSE-SU-2023:4343-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-31085: Fixed a divide-by-zero error in dodivsz,mtd-erasesize that could cause a local DoS. bsc1210778 - CVE-2023-45862: Fixed an issue in the ENE...

CVE-2023-46724

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to...

Information disclosure

Rejected reason: The SRCU code was added in upstream kernel v6.4-rc1 and removed before v6.4. This bug only existed in development kernels. Please see https://lore.kernel.org/all/email protected and https://bugzilla.suse.com/showbug.cgi?id=1215932 for more information...