PT-2021-18005 · Unknown · Matlab Extension For Visual Studio Code

Name of the Vulnerable Software and Affected Versions: MATLAB extension for Visual Studio Code versions prior to 2.0.1 Description: The issue allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings. This is due to a problem in the unofficial MATLA...

GHSA-X7HC-X7FM-F7QH Cross-Site Scripting in Content Preview (CType menu)

Problem It has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability. Solution Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25,...

PT-2021-15692 · WordPress · Modern Events Calendar Lite

Name of the Vulnerable Software and Affected Versions: Modern Events Calendar Lite WordPress plugin versions prior to 5.16.5 Description: The issue is related to a lack of authorization checks in the plugin, which did not properly restrict access to export files. This allowed unauthenticated user...

OPENSUSE-SU-2021:0413-1 Security update for opera

This update for opera fixes the following issues: - Update to version 74.0.3911.203 - CHR-8324 Update chromium on desktop-stable-88-3911 to 88.0.4324.182boo1182358 - DNA-90762 Replace “Don’t show again” with “Discard” - DNA-90974 Crash at...

MGASA-2021-0123 Updated glib2.0 packages fix security vulnerabilities

Fix various instances within GLib where gmemdup was vulnerable to a silent integer truncation and heap overflow problem discovered by Kevin Backhouse, work by Philip Withnall 2319 Fix some issues with handling over-long invalid input when parsing for GDate !1824 Don't load GIO modules or parse...

PT-2021-4113 · Libyang +2 · Libyang +2

Name of the Vulnerable Software and Affected Versions: libyang versions prior to 1.0.226 Description: The issue is related to the function read yin leaf in the libyang library, which fails to check if the value of retval-extr is NULL. This can lead to a crash when attempting to access...

PT-2021-4224 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11.14 Description: The issue is related to a use-after-free error in the cipso v4 genopt function, located in net/ipv4/cipso ipv4.c, due to mishandled CIPSO and CALIPSO refcounting for the DOI definitions. Thi...

PT-2021-15249 · Nextcloud +1 · Nextcloud +1

Name of the Vulnerable Software and Affected Versions: Nextcloud versions prior to 20.0.6 Description: A missing user check in Nextcloud inadvertently populates a user's own credentials for other users' external storage configuration when not already configured yet. Recommendations: For Nextcloud...

PT-2021-17971 · Rust +6 · Rust +6

Name of the Vulnerable Software and Affected Versions: Rust versions prior to 1.50.0 Description: The issue arises from the read to end function in the standard library not validating the return value from Read in an unsafe context, potentially leading to a buffer overflow. Recommendations: For...

OPENSUSE-SU-2021:0310-1 Security update for buildah, libcontainers-common, podman

This update for buildah, libcontainers-common, podman fixes the following issues: Changes in libcontainers-common: - Update common to 0.33.0 - Update image to 5.9.0 - Update podman to 2.2.1 - Update storage to 1.24.5 - Switch to seccomp profile provided by common instead of podman - Update...

PT-2021-20075

Name of the Vulnerable Software and Affected Versions golang.org/x/net versions prior to v0.0.0-20210520170846-37e1c6afe023 Go versions prior to 1.15.13 and versions 1.16.x through 1.16.4 Description The issue allows attackers to cause a denial of service via crafted ParseFragment input, resultin...

SUSE-RU-2021:0497-1 Recommended update for ardana-db, ardana-horizon, ardana-logging, ardana-monasca, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, crowbar-openstack, kibana, openstack-dashboard, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, release-notes-suse-openstack-cloud, sleshammer

This update for ardana-db, ardana-horizon, ardana-logging, ardana-monasca, ardana-opsconsole-ui, ardana-osconfig, crowbar-core, crowbar-openstack, kibana, openstack-dashboard, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1,...

Apple Patches 10-Year-Old macOS SUDO Root Privilege Escalation Bug

Apple has rolled out a fix for a critical sudo vulnerability in macOS Big Sur, Catalina, and Mojave that could allow unauthenticated local users to gain root-level privileges on the system. "A local attacker may be able to elevate their privileges," Apple said in a security advisory. "This issue...

OPENSUSE-SU-2021:0267-1 Security update for chromium

This update for chromium fixes the following issues: Update to 88.0.4324.150 boo1181827 - CVE-2021-21148: Heap buffer overflow in V8...

PT-2021-6101

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.19.0 Description A malicious server which responds with long series of xa0 characters in the www-authenticate header may cause Denial of Service CPU burn while parsing header of the httplib2 client accessing said...

PT-2021-18682 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions prior to 1.5.7 HashiCorp Vault and Vault Enterprise versions prior to 1.6.2 Description: The issue allows the disclosure of the internal IP address of the Vault node when responding to some invali...

OPENSUSE-SU-2021:0190-1 Security update for go1.14

This update for go1.14 fixes the following issues: Go was updated to version 1.14.14 bsc1164903. Security issues fixed: - CVE-2021-3114: Fixed incorrect operations on the P-224 curve in crypto/elliptic bsc1181145. - CVE-2021-3115: Fixed a potential arbitrary code execution in the build process...

PT-2021-14378 · Unknown · Tendermint Core

Name of the Vulnerable Software and Affected Versions: Tendermint Core versions 0.34.0 through 0.34.2 Description: The issue arises from the mishandling of timestamps during the consensus process in Tendermint Core, which can cause a denial of service. When double signs are observed, the consensu...

openSUSE Security Update : virtualbox (openSUSE-2021-165)

This update for virtualbox fixes the following issues : Version update to 6.1.18 released January 19 2021 This is a maintenance release. The following items were fixed and/or added : - Nested VM: Fixed hangs when executing SMP nested-guests under certain conditions on Intel hosts bug 19315, 19561...

SUSE-SU-2021:0197-1 Security update for permissions

This update for permissions fixes the following issues: - Update to version 20181224: pcp: remove no longer needed / conflicting entries bsc1171883, CVE-2020-8025...