Fedora: Security Advisory for deepin-gir-generator (FEDORA-2022-ba365d3703)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: deepin-gir-generator-2.1.0-3.fc36

Generate static golang bindings for GObject...

HTTP Request Smuggling

Overview llhttp is a set of Ruby bindings for llhttp. Affected versions of this package are vulnerable to HTTP Request Smuggling. when the llhttp parser in the http module does not adequately delimit HTTP requests with CRLF sequences. Remediation There is no fixed version for llhttp. References -...

HTTP Request Smuggling

Overview llhttp is a set of Ruby bindings for llhttp. Affected versions of this package are vulnerable to HTTP Request Smuggling when the llhttp parser in the http module does not correctly parse and validate Transfer-Encoding headers. Remediation A fix was pushed into the master branch but not y...

HTTP Request Smuggling

Overview llhttp is a set of Ruby bindings for llhttp. Affected versions of this package are vulnerable to HTTP Request Smuggling. The llhttp parser in the http module does not correctly handle multi-line Transfer-Encoding headers. Remediation There is no fixed version for llhttp. References -...

[SECURITY] Fedora 36 Update: act-1.6.0-6.fc36

The Automatic Component Toolkit ACT is a code generator that takes an instance of an Interface Description Language file and generates a thin C89-API, implementation stubs and language bindings of your desired software component...

Malicious code in chat-component-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0eb3edc15c7ab9abb2054403e15205fca87012a8c1c8e6b39408d1072a98ef5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1888 Malicious code in chat-component-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0eb3edc15c7ab9abb2054403e15205fca87012a8c1c8e6b39408d1072a98ef5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calling-component-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d34742e24d97901f4bbbaee9d2c3f3166f3b4f29cd95880e1a0594078f45301a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 36 Update: python-ujson-5.3.0-1.fc36

UltraJSON is an ultra fast JSON encoder and decoder written in pure C with bindings for Python...

GHSA-RJ7P-RFGP-852X Loop with Unreachable Exit Condition in Apache Thrift

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings...

Kubernetes kube-apiserver unauthorized access

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with...

GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

AMD System Management Unit Denial of Service Vulnerability

A denial of service vulnerability exists in AMD System Management Unit SMU, a system management unit of AMD, Inc. The vulnerability stems from an inadequate inspection of PCIE-related bindings in the System Management Unit SMU, which could be exploited by an attacker to exploit this vulnerability...

AMD System Management Unit 缓冲区错误漏洞

A denial of service vulnerability exists in AMD System Management Unit SMU, a system management unit of AMD, Inc. The vulnerability stems from an inadequate inspection of PCIE-related bindings in the System Management Unit SMU, which could be exploited by an attacker to exploit this vulnerability...

[SECURITY] Fedora 36 Update: python-ujson-5.2.0-1.fc36

UltraJSON is an ultra fast JSON encoder and decoder written in pure C with bindings for Python...

GHSA-773H-W45W-F2F9 Denial of service vulnerability exists in libxmljs

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a...

Maat - Open-source Symbolic Execution Framework

Maat is an open-source Dynamic Symbolic Execution and Binary Analysis framework. It provides various functionalities such as symbolic execution, taint analysis, constraint solving, binary loading, environment simulation, and leverages Ghidra's sleigh library for assembly lifting: https://maat.re...

[SECURITY] [DLA 2964-1] libdatetime-timezone-perl new upstream version

------------------------------------------------------------------------- Debian LTS Advisory DLA-2964-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 29, 2022 https://wiki.debian.org/LTS -...

Fedora: Security Advisory for ghc-cmark-gfm (FEDORA-2022-79b9a59e3b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...