CentOS 9 : openssl-3.0.7-18.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the openssl-3.0.7-18.el9 build changelog. - Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may...

Updated w3m packages fix security vulnerabilities

An out-of-bounds read flaw was found in w3m, in the Strnewsize function in Str.c. This issue may allow an attacker to cause a denial of service through a crafted HTML file. CVE-2023-38252 An out-of-bounds read flaw was found in w3m, in the growbuftoStr function in indep.c. This issue may allow an...

Fedora 39 : w3m (2024-3fc66f8bf3)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3fc66f8bf3 advisory. - Added upstream patch to fix out-of-bounds access due to multiple backspaces to address incomplete fix for CVE-2022-38223 2222775, 2222780, 2255207...

Fedora 38 : w3m (2024-38c2261ca0)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-38c2261ca0 advisory. - Added upstream patch to fix out-of-bounds access due to multiple backspaces to address incomplete fix for CVE-2022-38223 2222775, 2222780, 2255207...

Huawei EulerOS: Security Advisory for glibc (EulerOS-SA-2024-1398)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-NODE-2021-23840 Integer overflow in CipherUpdate

Calls to EVPCipherUpdate, EVPEncryptUpdate and EVPDecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 indicating succes...

Unspecified Vulnerability in Oracle MySQL (CNVD-2024-11155)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in Oracle MySQL for MySQL Server version 8.2.0 and earlier versions. An attacker can exploit this vulnerability to...

CentOS 8 : glibc (CESA-2023:5455)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:5455 advisory. - A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode vi...

GLSA-202401-24 : Nettle: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202401-24 Nettle: Denial of Service - A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application...

OESA-2024-1025 metadata-extractor2 security update

Metadata Extractor is a straightforward Java library for reading metadata from image files. Security Fixes: metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a...

CVE-2023-4255

An out-of-bounds write issue has been discovered in the backspace handling of the checkType function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to application crashes,...

kernel: dm flakey: don't corrupt the zero page

A flaw was found in the Linux kernel's dm-flakey device mapper target. When the corrupt bio writes option is enabled, dm-flakey can corrupt the kernel's global zero page. Since the zero page is shared system-wide and used by glibc's calloc implementation via mmap, corrupting it causes userspace...

RockyLinux 8 : mariadb:10.3 (RLSA-2022:6443)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:6443 advisory. mariadb: MariaDB through 10.5.9 allows attackers to trigger a convertconsttoint use-after-free when the BIGINT data type is used CVE-2021-46669 mysql:...

openSUSE 15 Security Update : sox (openSUSE-SU-2023:0329-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0329-1 advisory. - An issue was discovered in libsox.a in SoX 14.4.2. In sox-fmt.h startread function, there is an integer overflow on the result of integer...

Debian dla-3620 : gir1.2-poppler-0.18 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3620 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3620-1 [email protected]...

Oracle Linux 9 : glibc (ELSA-2023-12873)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12873 advisory. - CVE-2023-4527: Stack read overflow in getaddrinfo in no-aaa mode 2234716. - CVE-2023-4813: potential use-after-free in gaihinet. Reviewed by: Jose E...

SUSE SLED15: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2023:3998-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3998-1 advisory. - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops bsc1215422. -...

AlmaLinux 9 : glibc (ALSA-2023:5453)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5453 advisory. - A flaw was found in glibc. When the getaddrinfo function is called with the AFUNSPEC address family and the system is configured with no-aaaa mode via...

SUSE SLES12 Security Update : poppler (SUSE-SU-2023:3981-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3981-1 advisory. - CVE-2020-23804: Fixed uncontrolled recursion in pdfinfo and pdftops bsc1215422. - CVE-2020-36024: Fixed NULL Pointer Deference in...

CVE-2023-43114

An issue was discovered in Qt on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFontFromData, then it can cause the application to crash because of missing length checks...