Medium: ImageMagick

Issue Overview: A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg and other coders. CVE-2023-34151 Affected Packages: ImageMagick Issue Correction: Run dnf update ImageMagick --releasever 2023.1.20230825 or dnf update...

Important: librsvg2

Issue Overview: A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files on the local filesystem outside of the expected area, as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include elemen...

Important: containerd

Issue Overview: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed...

Medium: yajl

Issue Overview: There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Affected Packages: yajl Issue Correction: Run dnf update yajl --releasever 2023.1.20230809 or dnf update --advisory ALAS2023-2023-279...

Low: pcre2

Issue Overview: Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. CVE-2022-41409 Affected Packages: pcre2 Issue Correction: Run dnf update pcre2 --releasever 2023.1.20230809 or dnf update...

Medium: wireshark

Issue Overview: Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file CVE-2023-3648 iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file...

Medium: python-mako

Issue Overview: Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin. CVE-2022-40023 Affected Packages: python-mako Issue Correction: Run dnf update python-mako --releasever...

Medium: linux-firmware

Issue Overview: An issue in "Zen 2" CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 Affected Packages: linux-firmware Issue Correction: Run dnf update linux-firmware --releasever 2023.1.20230809 or dnf update...

@ansdomain/react-ans-address (>=0.0.31, <=0.0.32), @ansdomain/ui (>=3.8.0, <=3.8.771) +92 more potentially affected by CVE-2023-38698 via @ensdomains/ens-contracts (>=0.0.2, <=0.0.21)

@ensdomains/ens-contracts NPM version =0.0.2, =0.0.31, =3.8.0, =0.3.0-alpha, =1.2.0, =0.0.1, =0.0.1, =2.1.7, =3.4.2, =0.0.1, =3.4.5, =3.0.0-alpha.3, =2.2.2, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2023-38698 Source advisory: OSV:GHSA-RRXV-Q8M4-WCH3...

emacs security update

CentOS Errata and Security Advisory CESA-2023:3481 An update for emacs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Medium: scipy

Issue Overview: A use-after-free issue was discovered in PyFindObjects function in SciPy versions prior to 1.8.0. CVE-2023-29824 Affected Packages: scipy Issue Correction: Run dnf update scipy --releasever 2023.1.20230725 or dnf update --advisory ALAS2023-2023-268 --releasever 2023.1.20230725 to...

Medium: libtiff

Issue Overview: Memory leak in memory leak in tiffcrop.c. CVE-2023-3576 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.1.20230725 or dnf update --advisory ALAS2023-2023-265 --releasever 2023.1.20230725 to update your system. More information on how to update...

Medium: zstd

Issue Overview: In zstd, supplying an empty string as an argument to either --output-dir-flat or --output-dir-mirror may cause a buffer overrun. CVE-2022-4899 Affected Packages: zstd Issue Correction: Run dnf update zstd --releasever 2023.1.20230719 or dnf update --advisory ALAS2023-2023-244...

Medium: python-tornado

Issue Overview: Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370 Affected Packages: python-tornado Issu...

Medium: python-wheel

Issue Overview: An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Affected Packages: python-wheel Issue Correction: Run dnf update python-wheel --releaseve...

Important: docker

Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Affected Packages: docker Issue Correction: Run dnf update docker --releasever 2023.1.20230719 or dnf update --advisory ALAS2023-2023-260 --releasever 2023.1.20230719 to update your system. More information o...

Important: jackson-core

Issue Overview: An issue was discovered jackson-databind thru 2.15.2 allows attackers to cause a denial of service or other unspecified impacts via crafted object that uses cyclic dependencies. CVE-2023-35116 Affected Packages: jackson-core Issue Correction: Run dnf update jackson-core --releasev...

Medium: libX11

Issue Overview: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array...

Important: ncurses

Issue Overview: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. CVE-2023-2949...

Low: yajl

Issue Overview: No CVE associated with this advisory Affected Packages: yajl Issue Correction: Run dnf update yajl --releasever 2023.1.20230628 or dnf update --advisory ALAS2023-2023-214 --releasever 2023.1.20230628 to update your system. More information on how to update your system can be found...