CLSA-2023-1692294010 amanda: Fix of 2 CVEs

CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...

CLSA-2023-1692293738 amanda: Fix of 2 CVEs

CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...

CLSA-2023-1692293040 amanda: Fix of 2 CVEs

CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...

amanda: Fix of 2 CVEs

CVE-2022-37705: fix tar option filtering - CVE-2023-30577: introduce tar option allow list...

CVE-2023-35947

A flaw was found in Gradle. When unpacking Tar archives, Gradle did not check that files could be written outside the unpack location. This issue could lead to important files being overwritten anywhere the Gradle process has write permissions. This flaw allows an attacker with control of an...

GNOME Files 43.4 Privilege Escalation

Affected: GNOME Files 43.4 nautilus on fedora 37 Description: If an user A opens in GNOME files zip archive containing setuid file F, then F will be silently extracted to a subdirectory of CWD. If F is accessible by hostile local user B and B executes F, then F will be executed as from user A. ta...

Fedora: Security Advisory for amanda (FEDORA-2023-4db1d56125)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: amanda-3.5.4-3.fc38

AMANDA, the Advanced Maryland Automatic Network Disk Archiver, is a backup system that allows the administrator of a LAN to set up a single master backup server to back up multiple hosts to one or more tape drives or disk files. AMANDA uses native dump and/or GNU tar facilities and can back up a...

CVE-2023-3385

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

UBUNTU-CVE-2023-3385

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

CVE-2023-3385 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

CVE-2023-3385

Removed by vendor...

CVE-2023-3385 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

An issue has been discovered in GitLab affecting all versions starting from 8.10 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated file...

@pnpm/exe (>=7.0.0-alpha.0, <=7.33.3) potentially affected by CVE-2023-37478 via @pnpm/macos-x64 (>=7.0.0, <=7.33.3)

@pnpm/macos-x64 NPM version =7.0.0, =7.0.0-alpha.0, =7.33.3 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification

Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...

pnpm incorrectly parses tar archives relative to specification

Summary It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. Details The TAR format is an append-only archive format, and as such, the specification for how to update a...

Advisory ROSA-SA-2023-2203

Software: python 2.7.5 OS: rosa-server79 packageevrstring: python-2.7.5-93.res7 CVE-ID: CVE-2023-24329 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A problem in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blacklisting methods by providing a URL that starts with empty...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory.

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability...