SUSE SLES12: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2022:3942-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3942-1 advisory. - CVE-2015-8985: Fixed assertion failure in popfailstack when executing a malformed regexp bsc1193625 - x86: fix stack alignment in...

SUSE-SU-2022:3942-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2015-8985: Fixed assertion failure in popfailstack when executing a malformed regexp bsc1193625 - x86: fix stack alignment in pthreadcondtimedwait bsc1196852 - Recognize ppc64p7 arch to build for power7...

CentOS 8 : libtiff (CESA-2022:7585)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:7585 advisory. - libtiff: Denial of Service via crafted TIFF file CVE-2022-0561 - libtiff: Null source pointer lead to Denial of Service via crafted TIFF file...

Updated libtiff packages fix security vulnerability

There is a double free or corruption in rotateImage at tiffcrop.c:8839 found in libtiff 4.4.0rc1. CVE-2022-2519 A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage at tiffcrop.c:8621 that can cause program crash when reading a crafted input. CVE-2022-2520 It w...

libtiff: reachable assertion

A reachable assertion failure was found in libtiff's JBIG functionality. This flaw allows an attacker who can submit a crafted file to an application linked with libtiff and using the JBIG functionality, causes a crash via an assertion failure, leading to a denial of service. The exact mechanism...

Medium: glibc

Issue Overview: In the GNU C Library aka glibc or libc6 before 2.28, parseregexp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service assertion failure and application exit or trigger an incorrect result by attempting a regular-expression match...

CVE-2022-35842

An exposure of sensitive information to an unauthorized actor vulnerabiltiy CWE-200 in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS...

libjxl: Denial of Service

Background libjxl is the JPEG XL image format reference implementation. Description libjxl contains an unecessary assertion in jxl::LowMemoryRenderPipeline::Init. Impact An attacker can cause a denial of service of the libjxl process via a crafted input file. Workaround There is no known workarou...

GLSA-202210-36 : libjxl: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202210-36 libjxl: Denial of Service - libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init in renderpipeline/lowmemoryrenderpipeline.cc. CVE-2022-34000 Note that Nessus has not tested for this issue but has inste...

GLSA-202210-10 : LibTIFF: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-10 LibTIFF: Multiple Vulnerabilities - Null source pointer passed as an argument to memcpy function within TIFFFetchStripThing in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via...

SUSE-SU-2022:3782-1 Security update for libmad

This update for libmad fixes the following issues: - CVE-2017-8373: Fixed heap-based buffer overflow in madlayerIII bsc1036968. - CVE-2017-8372: Fixed assertion failure in layer3.c bsc1036969...

Debian dla-3152 : glibc-doc - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3152 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3152-1 [email protected]...

Wire authorization issue vulnerabilities

Wire is a chat program from the German company Wire. The software supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original greeting method, PING. An authorization issue vulnerability exists in versions prior to Wire 4.19.0, whi...

GLSA-202210-08 : Tcpreplay: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-08 Tcpreplay: Multiple Vulnerabilities - tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv6 at tree.c CVE-2021-45386 - tcpreplay 4.3.4 has a Reachable Assertion in addtreeipv4 at tree.c. CVE-2021-45387 - Tcpreplay...

Denial Of Service (DoS)

ImageMagick is vulnerable to Denial Of Service DoS. A crafted file could trigger an assertion failure when a call to WriteImages is made in MagickWand/operation.c, due to a NULL image list causing an application crash...

Passport-SAML passport data forgery vulnerability

Passport-SAML is the SAML 2.0 authentication provider for Passport, the Node.js authentication library. Passport-SAML suffers from a data forgery issue vulnerability that stems from the fact that a remote attacker can use passport-saml to bypass SAML authentication on a website...

MGASA-2022-0365 Updated dbus packages fix security vulnerability

A syntactically invalid type signature with incorrectly nested parentheses and curly brackets would cause an assertion failure in debug builds. Similar messages could potentially result in a crash or incorrect message processing in a production build, although we are not aware of a practical...

Updated dbus packages fix security vulnerability

A syntactically invalid type signature with incorrectly nested parentheses and curly brackets would cause an assertion failure in debug builds. Similar messages could potentially result in a crash or incorrect message processing in a production build, although we are not aware of a practical...

PT-2025-40732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue where the alx driver does not hold the rtnl lock during its internal close and re-open functions during suspend/resume operations. This can lead to an...

Elastic Cloud Enterprise log information leakage vulnerability

Elastic Cloud Enterprise is a cloud platform from Elastic. It makes it easy to deploy, operate, and scale Elastic Stack in the cloud. A security vulnerability exists in Elastic Cloud Enterprise versions prior to 3.1.1, which stems from the disclosure of the SAML signature private key used for RBA...