Security update for rxvt-unicode (important)

openSUSE Security Update: Security update for rxvt-unicode Announcement ID: openSUSE-SU-2022:10222-1 Rating: important References: 1186174 Cross-References: CVE-2008-1142 CVE-2021-33477 CVSS scores: CVE-2021-33477 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE...

CVE-2022-2601 & CVE-2022-3775: Multiple GRUB2 vulnerabilities

Security Advisory ID : BSA-2022-2139 Component : GRUB2 Revision : 1.0 Brocade PSIRT has become aware of two grub vulnerabilities. CVE-2022-2601 grub2: A buffer overflow in grubfontconstructglyph can lead to out-of-bound write and possible secure boot by-pass A buffer overflow was found in...

Debian: Security Advisory (DSA-5287-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: grub2 / grub2-i386-pc / grub2-snapper-plugin / etc (SUSE-SU-2022:4144-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4144-1 advisory. Security Fixes: - CVE-2022-2601: Fixed buffer overflow in grubfontconstructglyph bsc1205178. - CVE-2022-3775: Fixed integer underflow in blitco...

SUSE SLES12: grub2 / grub2-i386-pc / grub2-snapper-plugin / etc (SUSE-SU-2022:4143-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4143-1 advisory. Security Fixes: - CVE-2022-2601: Fixed buffer overflow in grubfontconstructglyph bsc1205178. - CVE-2022-3775: Fixed integer underflow in blitco...

SUSE SLES15: grub2 / grub2-arm64-efi / grub2-i386-pc / grub2-s390x-emu / etc (SUSE-SU-2022:4140-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4140-1 advisory. - CVE-2022-2601: Fixed buffer overflow in grubfontconstructglyph bsc1205178. - CVE-2022-3775: Fixed integer underflow in blitcomb...

SUSE SLES15: grub2 / grub2-arm64-efi / grub2-i386-pc / grub2-powerpc-ieee1275 / etc (SUSE-SU-2022:4142-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4142-1 advisory. Security Fixes: - CVE-2022-2601: Fixed buffer overflow in grubfontconstructglyph bsc1205178. - CVE-2022-3775: Fixed integer underfl...

CVE-2022-41916

...

The vulnerability of Grub2 operating system loaders, related to the execution of operations outside the buffer boundaries, allows attackers to execute arbitrary code.

The vulnerability of Grub2 operating system loaders is related to the issue where operations occur outside of the buffer in memory when rendering certain Unicode sequences using a specially crafted font. Exploiting this vulnerability allows an attacker to execute arbitrary code...

grub2: Heap based out-of-bounds write when redering certain unicode sequences

A flaw was found in the grub2 font code. When rendering certain unicode sequences, it fails to properly validate the font width and height. These values are further used to access the font buffer, causing possible out-of-bounds writes. A malicious actor may craft a font capable of triggering this...

Debian DSA-5280-1 : grub2 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5280 advisory. - grub2: Buffer overflow in grubfontconstructglyph can lead to out-of-bound write and possible secure boot bypass CVE-2022-2601 - grub2: Heap based out-of-bounds...

golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension...

anthy-unicode bug fix and enhancement update

An update is available for anthy-unicode. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linu...

PT-2022-5491 · Grub2 +11 · Grub2 +11

Name of the Vulnerable Software and Affected Versions: grub2 affected versions not specified Description: The issue arises when rendering certain unicode sequences, as grub2's font code does not properly validate if the informed glyph's width and height is constrained within bitmap size. This...

Huawei EulerOS: Security Advisory for unzip (EulerOS-SA-2022-2782)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for unzip (EulerOS-SA-2022-2747)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : unzip (EulerOS-SA-2022-2782)

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. Thi...

EulerOS 2.0 SP9 : unzip (EulerOS-SA-2022-2747)

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. Thi...

MGASA-2022-0417 Updated pcre packages fix security vulnerability

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in...

Amazon Linux 2 : pcre2 (ALAS-2022-1871)

The version of pcre2 installed on the remote host is prior to 10.23-11. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1871 advisory. An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the...