MGASA-2022-0008 Updated suricata packages fix security vulnerability

Critical evasion in suricata CVE-2021-35063...

OPENSUSE-SU-2022:0040-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-operator-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-operator-container fixes the following issues: - CVE-2021-43565: Fixes a vulnerability in the golang.org/x/crypto/ssh package which allowed unauthenticated clients to cau...

GHSA-P46C-W9M3-7QR2 Use of Uninitialized Resource in flumedb.

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation. There are two of such cases gooffsetlog::readentry & offsetlog::readentry. Arbitrary Read implementations can read from the uninitialized buffer memory exposure and also can return incorrect...

Missing Initialization of Resource in pnet

An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault upon attempted dereference of an uninitialized descriptor because of an erroneous IcmpTransportChannelIterator compiler optimization...

GHSA-FG7R-2G4J-5CGR Race Condition in tokio

If a tokio::sync::oneshot channel is closed via the oneshot::Receiver::close method, a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling tryrecv. When these methods are called concurrently on a closed channel, the two...

GHSA-CM8G-544F-P9X9 Use After Free in rusqlite

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. createcollation has a use-after-free...

Prototype Pollution

oro/platform is vulnerable to prototype pollution. An attacker is able to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructorprototype, and constructor.prototype...

DLA-2874-1 thunderbird - security update

Bulletin has no description...

CVE-2021-45940

libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow 4 bytes in bpfobjectopen called from bpfobjectopenmem and bpf-object-fuzzer.c...

CVE-2021-45937

wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClientDecodePacket called from MqttClientWaitType and MqttClientConnect...

PUB-A-199579676

Bulletin has no description...

ASB-A-193070555

Bulletin has no description...

ASB-A-192663648

In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-202025599

Bulletin has no description...

ASB-A-193070342

Bulletin has no description...

ASB-A-193071116

Bulletin has no description...

ASB-A-193070594

Bulletin has no description...

OSV-2021-1787 Global-buffer-overflow in stbi__jpeg_decode_block

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=43113 Crash type: Global-buffer-overflow READ 4 Crash state: stbijpegdecodeblock stbidecodejpegimage stbijpegload...

GSD-2021-1002813 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()

f2fs: fix to do sanity check on last xattr entry in f2fssetxattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.89 by commit...

GSD-2021-1002808 platform/x86: intel_pmc_core: fix memleak on registration failure

platform/x86: intelpmccore: fix memleak on registration failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.89 by commit...