[SECURITY] Fedora 36 Update: htmltest-0.15.0-4.fc36

htmltest runs your HTML output through a series of checks to ensure all your links, images, scripts references work, your alt tags are filled in, et cetera...

Security fix for the ALT Linux 10 package golang version 1.17.12-alt1.p10

1.17.12-alt1.p10 built July 29, 2022 Alexey Shabalin in task 304432 --- July 28, 2022 Alexey Shabalin - New version 1.17.12. - Fixes: + CVE-2022-1705 + CVE-2022-32148 + CVE-2022-30631 + CVE-2022-30633 + CVE-2022-28131 + CVE-2022-30635 + CVE-2022-30632 + CVE-2022-30630 + CVE-2022-1962...

Security fix for the ALT Linux 10 package golang version 1.18.4-alt1

July 28, 2022 Alexey Shabalin 1.18.4-alt1 - New version 1.18.4. - Fixes: + CVE-2022-1705 + CVE-2022-32148 + CVE-2022-30631 + CVE-2022-30633 + CVE-2022-28131 + CVE-2022-30635 + CVE-2022-30632 + CVE-2022-30630 + CVE-2022-1962...

Security fix for the ALT Linux 10 package firefox-esr version 102.1.0-alt1

July 22, 2022 Pavel Vasenkov 102.1.0-alt1 - New ESR version. - Security fixes: + CVE-2022-36319 Mouse Position spoofing with CSS transforms + CVE-2022-36318 Directory indexes for bundled resources reflected URL parameters + CVE-2022-36314 Opening local &LTcode.lnk&LT/code files could cause...

Security fix for the ALT Linux 10 package xorg-server version 2:1.20.14-alt4

2:1.20.14-alt4 built July 15, 2022 Valery Inozemtsev in task 303601 July 13, 2022 Valery Inozemtsev - cherry pick upstream fixes for CVE-2022-2319, CVE-2022-2320...

Security fix for the ALT Linux 9 package nginx version 1.22.0-alt1

1.22.0-alt1 built July 15, 2022 Anton Farygin in task 303522 July 12, 2022 Anton Farygin - 1.22.0 Fixes: CVE-2021-3618...

Security fix for the ALT Linux 10 package java-11-openjdk version 0:11.0.15.0.10-alt1_1jpp11

0:11.0.15.0.10-alt11jpp11 built July 14, 2022 Andrey Cherepanov in task 303498 June 29, 2022 Andrey Cherepanov - New version. - Security fixes + JDK-8270504, CVE-2022-21426: Better XPath expression handling + JDK-8275082, JDK-8278008, CVE-2022-21476: Update XML Security for Java to 2.3.0 +...

Security fix for the ALT Linux 10 package nginx version 1.22.0-alt1

1.22.0-alt1 built July 14, 2022 Anton Farygin in task 303520 --- July 12, 2022 Anton Farygin - 1.22.0 Fixes: CVE-2021-3618...

Security fix for the ALT Linux 9 package glpi version 9.5.8-alt1

9.5.8-alt1 built July 11, 2022 Pavel Zilke in task 303295 July 4, 2022 Pavel Zilke - New version 9.5.8 - This is a security release, upgrading is recommended - Security fixes: + CVE-2022-31061 : SQL injection on login page + CVE-2022-24868 : XSS / open redirect via SVG file upload + CVE-2022-2486...

Security fix for the ALT Linux 10 package openssl1.1 version 1.1.1q-alt1

1.1.1q-alt1 built July 8, 2022 Gleb Fotengauer-Malinovskiy in task 303207 July 5, 2022 Gleb Fotengauer-Malinovskiy - Updated to 1.1.1q fixes CVE-2022-2068...

ALPINE-CVE-2022-32207

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

AZL-10103 CVE-2022-32207 affecting package curl for versions less than 7.84.0-1

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

Security fix for the ALT Linux 10 package glpi version 9.5.8-alt1

9.5.8-alt1 built July 7, 2022 Pavel Zilke in task 303183 July 4, 2022 Pavel Zilke - New version 9.5.8 - This is a security release, upgrading is recommended - Security fixes: + CVE-2022-31061 : SQL injection on login page + CVE-2022-24868 : XSS / open redirect via SVG file upload + CVE-2022-24869...

CVE-2022-32207

CVE-2022-32207 affects curl: when saving cookies, alt-svc and HSTS data, the final rename can widen target file permissions, exposing updates to more users. Affected versions are curl before 7.84.0; remediation is to upgrade to 7.84.0 or newer (as indicated by multiple advisories).

Security fix for the ALT Linux 10 package mysql-connector-odbc version 8.0.29-alt1

8.0.29-alt1 built July 6, 2022 Nikolai Kostrigin in task 303150 --- May 12, 2022 Nikolai Kostrigin - New version fixes: CVE-2022-0778...

Security fix for the ALT Linux 9 package openssl1.1 version 1.1.1q-alt1

July 5, 2022 Gleb Fotengauer-Malinovskiy 1.1.1q-alt1 - Updated to 1.1.1q fixes CVE-2022-2068...

Security fix for the ALT Linux 10 package MySQL version 8.0.29-alt1

8.0.29-alt1 built July 5, 2022 Nikolai Kostrigin in task 302902 --- June 30, 2022 Nikolai Kostrigin - new version + fixes: CVE-2021-22570, CVE-2022-0778, CVE-2022-21454, CVE-2022-21457 + fixes: CVE-2022-21425, CVE-2022-21440, CVE-2022-21459, CVE-2022-21478 + fixes: CVE-2022-21479, CVE-2022-21418,...

Security fix for the ALT Linux 10 package firefox-esr version 91.11.0-alt1

June 29, 2022 Pavel Vasenkov 91.11.0-alt1 - New ESR version. - Security fixes: + CVE-2022-34479 A popup window could be resized in a way to overlay the address bar with web content + CVE-2022-34470 Use-after-free in nsSHistory + CVE-2022-34468 CSP sandbox header without allow-scripts can be...

Security fix for the ALT Linux 10 package thunderbird version 102.0-alt1

June 29, 2022 Pavel Vasenkov 102.0-alt1 - New version. - Security fixes: + CVE-2022-34479 A popup window could be resized in a way to overlay the address bar with web content + CVE-2022-34470 Use-after-free in nsSHistory + CVE-2022-34468 CSP sandbox header without allow-scripts can be bypassed vi...

Non-preserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target filename. In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated...