Medium: nerdctl

Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...

Medium: avahi

Issue Overview: A reachable assertion was found in avahidnspacketappendrecord. CVE-2023-38469 A reachable assertion was found in avahiescapelabel. CVE-2023-38470 A reachable assertion was found in dbussethostname. CVE-2023-38471 Affected Packages: avahi Issue Correction: Run dnf update avahi...

Medium: yajl

Issue Overview: There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Affected Packages: yajl Issue Correction: Run dnf update yajl --releasever 2023.1.20230809 or dnf update --advisory ALAS2023-2023-279...

Medium: binutils

Issue Overview: Potential heap based buffer overflow found in bfdelfslurpversiontables in bfd/elf.c. CVE-2023-1972 Affected Packages: binutils Issue Correction: Run dnf update binutils --releasever 2023.1.20230628 or dnf update --advisory ALAS2023-2023-229 --releasever 2023.1.20230628 to update...

Important: golang

Issue Overview: html/template: improper sanitization of CSS values Angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for...

Important: sysstat

Issue Overview: sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Affected Packages: sysstat Issue Correction: Run dnf update sysstat --releasever 2023.0.20230607 or...

PT-2023-2771 · Google +1 · Google Chrome +1

Name of the Vulnerable Software and Affected Versions: Google Chrome on ChromeOS versions prior to 113.0.5672.114 Description: The issue is caused by an out of bounds write in the ChromeOS Audio Server, allowing a remote attacker to potentially exploit heap corruption via a crafted audio file. Th...

Important: tomcat9

Issue Overview: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat did not reject a request containing an invalid Content-Length...

Important: less

Issue Overview: In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. CVE-2022-46663 closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE. CVE-2022-48624 Affected Packages: less Issue Correction: Run dn...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution in the way it reads debugging symbols, where reading a malicious symbols file may result in the exploitation of this vulnerability. Remediation Upgrade Microsoft.NETCore.App.Runtime.win-x86 to version 6.0.13,...

PT-2023-18202 · Contacts · Contacts

Name of the Vulnerable Software and Affected Versions: Contacts versions prior to SMR Feb-2023 Release 1 Description: The issue is related to the improper usage of implicit intent in Contacts, which allows an attacker to obtain an account ID. Recommendations: For versions prior to SMR Feb-2023...

PT-2023-33274 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.161 Description: The issue is related to discarding preallocation before extending a file with a hole. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2023-18527 · Unknown · Canarytokens

Name of the Vulnerable Software and Affected Versions: Canarytokens versions prior to sha-fb61290 Description: A Cross-Site Scripting issue was identified in the history page of triggered Canarytokens. An attacker who discovers an HTTP-based Canarytoken can execute Javascript in the Canarytoken's...

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Java is used by IBM Robotic Process Automation for Cloud Pak as part of the the container images for services. Vulnerability Details CVEID:CVE-2022-21541 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to cause no...

PT-2022-34188 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.212 Description: A memory leak was discovered in the pvr probe function of the pvrusb2 media driver. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-16869

Name of the Vulnerable Software and Affected Versions node-forge versions prior to 1.3.0 Description The issue concerns the RSA PKCS1 v1.5 signature verification code in node-forge, which does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification wit...

PT-2021-17902 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.71.1 Description: A remotely exploitable integer overflow issue exists due to a very large grpc-timeout value, leading to unexpected timeout calculations. Recommendations: For versions prior to 1.71.1, update to a...

Important: kernel-livepatch-4.14.177-139.254

Issue Overview: A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending...

[SECURITY] [DSA-391-1] New freesweep packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 391-1 [email protected] http://www.debian.org/security/ Matt Zimmerman September 28th, 2003 http://www.debian.org/security/faq -...