OPENSUSE-SU-2024:12314-1 alpine-2.26-27.1 on GA media

These are all security issues fixed in the alpine-2.26-27.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10613-1 alpine-2.25-24.1 on GA media

These are all security issues fixed in the alpine-2.25-24.1 package on the GA media of openSUSE Tumbleweed...

ALPINE-CVE-2024-26256

Libarchive Remote Code Execution Vulnerability...

Backdoored XZ Utils (CVE-2024-3094)

On Friday, March 29, after investigating anomalous behavior in his Debian sid environment, developer Andres Freund contacted an open-source security mailing list to share that he had discovered an upstream backdoor in widely used command line tool XZ Utils liblzma. The backdoor, added by an...

Exploit for Embedded Malicious Code in Tukaani Xz

Vulnerability Overview XZ is a data compression format that e...

ALPINE-CVE-2024-28085

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...

ALPINE-CVE-2024-28835

A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command...

ALPINE-CVE-2023-46840

Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen...

ALPINE-CVE-2023-52426

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

Pwn2Own Automotive: Tesla, Sony, Alpine Players Breached on Day One

By Deeba Ahmed Bug Bounty Bonanza: Hackers Rake in Big Bucks as Connected Cars Show Security Cracks. This is a post from HackRead.com Read the original post: Pwn2Own Automotive: Tesla, Sony, Alpine Players Breached on Day One...

alpineaction.co.uk Cross Site Scripting vulnerability OBB-3829768

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

alpine-property.fr Improper Access Control vulnerability OBB-3821075

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ALPINE-CVE-2023-50472

cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONSetValuestring at cJSON.c...

ALPINE-CVE-2023-50246

jq is a command-line JSON processor. Version 1.7 is vulnerable to heap-based buffer overflow. Version 1.7.1 contains a patch for this issue...

alpine-property.com Improper Access Control vulnerability OBB-3791699

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Node.js: Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes

Vulnerability description not provided...

ALPINE-CVE-2023-38470

A vulnerability was found in Avahi. A reachable assertion exists in the avahiescapelabel function...

ALPINE-CVE-2023-5535

Use After Free in GitHub repository vim/vim prior to v9.0.2010...

ALPINE-CVE-2023-44487

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

ALPINE-CVE-2023-34319

The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many piece...