[SECURITY] Fedora 35 Update: lighttpd-1.4.67-1.fc35

lighttpd pronounced /lighty/ is a secure, fast, compliant, and very flexible web server that has been optimized for high-performance environments. lighttpd uses memory and CPU efficiently and has lower resource use than other popular web servers. Its advanced feature-set FastCGI, CGI, Auth,...

Unbreakable Enterprise kernel security update

4.1.12-124.67.3 - media: imon: Fix null-ptr-deref in imonprobe Arvind Yadav Orabug: 31225377 CVE-2017-16537 - fbcon: remove soft scrollback code Linus Torvalds Orabug: 31914703 CVE-2020-14390 - inet: use bigger hash table for IP ID generation Eric Dumazet Orabug: 33778986 CVE-2021-45486 - ipv4:...

PT-2022-12988 · Htmldoc +4 · Htmldoc +4

Name of the Vulnerable Software and Affected Versions: HTMLDOC versions prior to 1.9.15 Description: A heap buffer overflow issue exists in the image set mask function, allowing an attacker to write outside the buffer boundaries. Recommendations: For versions prior to 1.9.15, update to version...

CVE-2022-39958

A flaw was found in the OWASP ModSecurity Core Rule Set. Repeated payloads with a HTTP range header field with a small byte range allows a response body bypass, resulting in access to restricted resources...

CVE-2022-39957

A flaw was found in the OWASP ModSecurity Core Rule Set. A payload with a HTTP accept header field containing a charset that can't be decoded by the Web Application Firewall allows a response body bypass, resulting in access to restricted resources...

CVE-2022-39956

A flaw was found in the OWASP ModSecurity Core Rule Set. A payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields allows HTTP multipart requests to bypass detection...

OESA-2022-1970 mod_security_crs security update

The base rules are provided for modsecurity by this package. Security Fixes: The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range...

ZTE ZXvSTB License Issue Vulnerability

ZTE ZXvSTB is a cloud-enabled set-top box from China's ZTE. The ZTE ZXvSTB suffers from an authorization issue vulnerability that stems from improper privilege control, which can be exploited by an attacker to remove the default application type and affect the normal use of the system...

Tenda AC18 fast_setting_wifi_set stack overflow vulnerability

The Tenda AC18 is a router from the Chinese company Tenda. Tenda AC18 V15.03.05.19 suffers from a stack overflow vulnerability, which stems from the fastsettingwifiset function not performing a size check on incoming data, and can be exploited by an attacker to cause remote code execution or deni...

Tenda AC15 fast_setting_wifi_set stack overflow vulnerability

The Tenda AC15 is a wireless router from the Chinese company Tenda. A stack overflow vulnerability exists in Tenda AC15 router version V15.03.05.19, which originates from the list parameter of the fastsettingwifiset function that does not perform a size check on the input data, and can be exploit...

OESA-2022-1964 mod_security_crs security update

The base rules are provided for modsecurity by this package. Security Fixes: The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end...

PT-2022-6973 · D Link · D-Link Dap-1325

Name of the Vulnerable Software and Affected Versions: D-Link DAP-1325 affected versions not specified Description: The issue is related to the SetHostIPv6Settings function of the D-Link DAP-1325 wireless signal amplifier's firmware, which does not properly neutralize special elements. This allow...

GLSA-202209-12 : GRUB: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202209-12 GRUB: Multiple Vulnerabilities - A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code...

CVE-2022-40106

Tenda i9 v1.0.0.83828 was discovered to contain a buffer overflow via the setlocaltime function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted string...

CVE-2022-40861

Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand-FUN0007db78 function with the request /goform/SetNetControlList/...

CVE-2022-23144

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the default application type, which affects normal use of system...

CVE-2022-40864

Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSet...

CVE-2022-40865

Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/...

CVE-2022-40860

Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand-FUN0007dd20 with request /goform/SetNetControlList...

OESA-2022-1948 redis6 security update

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...