jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c

jp2decode in jp2/jp2dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components...

new packages: gcc-toolset-11-dwz

GCC Toolset is a compiler toolset that provides recent versions of development tools. GCC Toolset is an Application Stream packaged as a Software Collection. This enhancement update adds the gcc-toolset-11-dwz packages to AlmaLinux For instructions on usage, see Using GCC Toolset linked from the...

OWASP Top 10 Deep Dive: Getting a Clear View on Vulnerable and Outdated Components

Most of us think of climbing the ladder as a good thing — but when the ladder in question is OWASP's Top 10 list of application security risks, a sudden upward trajectory is cause for alarm rather than encouragement. In the 2021 edition of the OWASP list, vulnerable and outdated components moved ...

Prototype Pollution in node-jsonpointer

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays...

Mozilla Firefox Security Advisory (MFSA2021-20) - Linux

The remote host is missing an update for Mozilla Firefox, announced via the advisory MFSA2021-20. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

CVE-2021-23820

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays...

Type confusion

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays...

Trend Micro Multiple Products Content Validation Escape Vulnerability

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security agents contain a content validation escape vulnerability that could allow an attacker to manipulate certain agent client components...

Android Patches Actively Exploited Zero-Day Kernel Bug

Among Google’s November Android security updates is a patch for a zero-day weakness that “may be under limited, targeted exploitation,” the company said. Out of this month’s batch of 39 patches, 18 of them plug flaws in the framework and system components and another 18 address vulnerabilities in...

多款Qualcomm产品安全漏洞

The Qualcomm QCA6574AU and others are products of Qualcomm Incorporated, U.S.A. The QCA6574AU is a central processing unit CPU product.The SDX24 is a modem.The SDX55 is a modem.The QCA6574AU is a central processing unit CPU product.The SDX24 is a modem.The SDX55 is a modem. A security vulnerabili...

多款Qualcomm产品缓冲区错误漏洞

Qualcomm MDM9206 and others are products of Qualcomm Incorporated Qualcomm.MDM9206 is a central processing unit CPU product.MDM9607 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product.MDM9640 is a central processing unit CPU product.MDM9640 is a central...

多款Qualcomm产品资源管理错误漏洞

Qualcomm MDM9206 and others are products of Qualcomm Incorporated Qualcomm, U.S.A. The MDM9206 is a central processing unit CPU product.The MDM9650 is a central processing unit CPU product.The MSM8996AU is a central processing unit CPU product. A resource management error vulnerability exists in...

Easy-XML 代码问题漏洞

Easy-Xml is used to provide a simplified view of Xml documents.Easy-XML is vulnerable to XML external entity injection, which stems from errors such as configuration during the operation of a network system or product, and can be exploited by an unauthorized attacker to obtain sensitive informati...

Modx Cms 代码问题漏洞

Modx Cms is the U.S. Modx Corporation, one of the world's fastest, safest, most flexible and scalable open source Cms. A security vulnerability exists in MODX CMS, which originates from errors such as configuration during operation of a networked system or product. An unauthorized attacker could...

OESA-2021-1406 icu security update

Tools and utilities for developing with icu. Security Fixes: International Components for Unicode ICU-20850 v66.1 was discovered to contain a use after free bug in the pkgcreateWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp.CVE-2020-21913...

CVE-2021-37254

In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated access to 3rd party component license key information on server...

M-Files Web 授权问题漏洞

M-Files Corporation M-Files Web is an intelligent information management platform from M-Files Corporation, USA. M-Files Web is an intelligent information management platform from M-Files Corporation, Inc. that is used to optimally support users in their daily work. A security vulnerability exist...

Oracle Java SE Security Update (oct2021) 02 - Linux

Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2021-0706

In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-1967

Possible stack buffer overflow due to lack of check on the maximum number of post NAN discovery attributes while processing a NAN Match event in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...