Mozilla: Symlinks may resolve to smaller than expected buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

Mozilla: Symlinks may resolve to smaller than expected buffers

The Mozilla Foundation Security Advisory describes this flaw as: When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected...

SUSE CVE-2023-6857

When resolving a symlink, a race may occur where the buffer passed to readlink may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems Android, Linux, MacOS. Windows is unaffected. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: k8sgpt, melange, buildkitd, grype, newrelic-infrastructure-agent, helm-push, up, kubescape, flux-source-controller, kubevela, helm, k3d, zot, skaffold, kaniko, trivy, cilium-cli, eksctl, flux-helm-controller, ctop, fuse-overlayfs-snapshotter, kots, gitness...

CVE-2023-6927 vulnerabilities

Vulnerabilities for packages: keycloak...

Amazon Linux 2023 : guava, guava-javadoc, guava-testlib (ALAS2023-2023-458)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-458 advisory. Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on t...

CVE-2023-46727

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory...

CVE-2023-50252

php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when handling tag that references an tag, it merges the attributes from the tag to the tag. The problem pops up especially when the href attribute from the tag has not been sanitized. This can lead to an unsafe file...

GHSA-H56G-GQ9V-VC8R vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2023-49080 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

The vulnerability of the `evaluate` function in the UNIX utility commands of the BusyBox, which allows a hacker to cause a service failure

The vulnerability of the evaluate function in the BusyBox command-line utility for UNIX systems is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the next_token function in the awk.c file of the UNIX utility command-line tool BusyBox, which allows a hacker to cause a service failure

The vulnerability of the nexttoken function in the BusyBox command-line utility library of UNIX systems is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to cause a system failure...

GHSA-C38W-74PG-36HR vulnerabilities

Vulnerabilities for packages: deno, sccache, atuin, vector, zed...

GHSA-4GRX-2X9W-596C vulnerabilities

Vulnerabilities for packages: deno, sccache, atuin, vector, zed...

CVE-2023-49092 vulnerabilities

Vulnerabilities for packages: deno, sccache, atuin, vector, zed...

SUSE CVE-2023-36049

unknown...

CVE-2023-5189

Removed by vendor...

Info Disclosure com.google.guava:guava in Jira Software Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 8.20.0, 9.4.0, 9.6.0, 9.7.0, 9.8.0, 9.9.0, 9.10.0, and 9.11.0 of Jira Software Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.1 and a CVSS Vector of...

perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS

A flaw was found in Perl's CPAN, which doesn't check TLS certificates when downloading content. This happens due to verifySSL missing when suing the HTTP::Tiny library during the connection. This may allow an attacker to inject into the network path and perform a Man-In-The-Middle attack, causing...

Fedora: Security Advisory (FEDORA-2023-f1c8e4c1cc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...