Medium: binutils

Issue Overview: Potential heap based buffer overflow found in bfdelfslurpversiontables in bfd/elf.c. CVE-2023-1972 Affected Packages: binutils Issue Correction: Run dnf update binutils --releasever 2023.1.20230628 or dnf update --advisory ALAS2023-2023-229 --releasever 2023.1.20230628 to update...

Medium: opensmtpd

Issue Overview: asciiloadsockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable through 7.0.0-portable, can abort upon a connection from a local, scoped IPv6 address. CVE-2023-29323 Affected Packages: opensmtpd Issue Correction: Run dnf update opensmt...

Medium: nodejs

Issue Overview: In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service...

Medium: dbus

Issue Overview: D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the...

Important: libeconf

Issue Overview: A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in openSUSE libeconf leads to DoS via malformed config files. This issue affects libeconf: before 0.5.2. CVE-2023-22652 A Buffer Copy without Checking Size of Input 'Classic Buffer Overflow'...

@alexktzk/cz-customizable (>=1.0.0, <=1.1.0), @algolia/coquille (>=0.0.2, <=0.0.13) +376 more potentially affected by CVE-2023-26115 via word-wrap (>=1.0.3, <=1.2.3)

word-wrap NPM version =1.0.3, =1.0.0, =0.0.2, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.4.2, =0.0.0, =1.0.0, =0.1.0-preview, =0.1.0-preview, =6.0.0-alpha.16.20220105.1, =0.1.3, =0.1.17 and more Source cves: CVE-2023-26115 Source advisory: OSV:GHSA-J8XG-FQG3-53R7...

Important: kernel

Issue Overview: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2022-48425 Affected Packages: kernel Issue Correction: Run dnf update kernel --releasever 2023.0.20230614 or dnf update --advisory...

Medium: nodejs

Issue Overview: An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. CVE-2023-23920 Affected Packages: nodejs Issue Correction: Run dnf update...

Important: sysstat

Issue Overview: sysstat through 12.7.2 allows a multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204 Affected Packages: sysstat Issue Correction: Run dnf update sysstat --releasever 2023.0.20230607 or...

Important: byacc

Issue Overview: When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory use after free. CVE-2021-33641 When a file is processed, an infinite loop occurs in nextinline of the morecurly function. CVE-2021-33642...

Important: python-flask

Issue Overview: Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one...

Medium: wireshark

Issue Overview: RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1992 LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or...

Medium: libldb

Issue Overview: Access controlled AD LDAP attributes can be discovered CVE-2023-0614 Affected Packages: libldb Issue Correction: Run dnf update libldb --releasever 2023.0.20230607 or dnf update --advisory ALAS2023-2023-187 --releasever 2023.0.20230607 to update your system. More information on ho...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +210 more potentially affected by CVE-2023-34092 via vite (>=2.0.0-beta.4, <=2.9.15)

vite NPM version =2.0.0-beta.4, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.16 and more Source cves: CVE-2023-34092 Source advisory...

@berrywallet/core (>=0.1.0, <=0.2.1), @counterplay/simpleflake (>=2.0.0, <=2.0.1) +55 more potentially affected by unknown CVE via bignum (>=0.12.5, <=0.13.0)

bignum NPM version =0.12.5, =0.1.0, =2.0.0, =1.0.0, =1.0.0, =0.14.6, =0.1.0, =1.1.0, =0.0.2, =0.0.17, =0.5.0, =1.0.0, =1.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7CGC-FJV4-52X6...

Important: perl

Issue Overview: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. CVE-2023-31484 Affected Packages: perl Issue Correction: Run dnf update perl --releasever 2023.0.20230517 o...

Important: ghostscript

Issue Overview: In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than ful...

Medium: redis6

Issue Overview: Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10...

Medium: future

Issue Overview: An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. CVE-2022-40899 Affected Packages: future Issue Correction: Run dnf update future --releasever...

java security update

CentOS Errata and Security Advisory CESA-2023:1875 An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...