Updated kernel packages fix security vulnerabilities

This update provides an upgrade to the new upstream 5.10 longterm branch, currently based on 5.10.6, adding new features and new and improved hardware support. This update also fixes at least the following security issues: In binderreleasework of binder.c, there is a possible use-after-free due t...

kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS

A flaw was found in the Linux kernel’s implementation of biovecs. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device,...

kernel: soft-lockups in iov_iter_copy_from_user_atomic() could result in DoS

A flaw was found in the Linux kernel’s implementation of biovecs. A zero-length biovec request issued by the block subsystem could cause the kernel to enter an infinite loop, causing a denial of service. This flaw allows a local attacker with basic privileges to issue requests to a block device,...

Fedora 32 : 1:dia (2020-cbc0754798)

Added upstream patch to avoid infinite loop on filenames with invalid encoding CVE-2019-19451, 1778767 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as...

CVE-2021-21235

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround i...

UBUNTU-CVE-2021-21235

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround i...

CVE-2021-21235

kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround i...

Kamadak Exif-rs Resource Management Error Vulnerability

Kamadak Exif-rs is a Rust-based parsing library for analyzing Exif data by Kamadak's individual developers. It supports reading Exif data from TIFF, RAW, JPEG, HEIF, HEIC, AVIF, PNG, WebP and other formats. A security vulnerability exists in kamadak-exif version 0.5.2, which stems from an infinit...

PT-2021-14347 · Unknown · Kamadak-Exif

Name of the Vulnerable Software and Affected Versions: kamadak-exif version 0.5.2 Description: The issue is related to an infinite loop in parsing crafted PNG files, specifically in the reader::read from container function. This can lead to a denial-of-service DoS condition when used with untrust...

CVE-2020-29385

GNOME gdk-pixbuf aka GdkPixbuf before 2.42.2 allows a denial of service infinite loop in lzw.c in the function writeindexes. if c-selfcode equals 10, self-codetable10.extends will assign the value 11 to c. The next execution in the loop will assign self-codetable11.extends to c, which will give t...

Code injection

GNOME gdk-pixbuf aka GdkPixbuf before 2.42.2 allows a denial of service infinite loop in lzw.c in the function writeindexes. if c-selfcode equals 10, self-codetable10.extends will assign the value 11 to c. The next execution in the loop will assign self-codetable11.extends to c, which will give t...

CVE-2020-29385

GNOME gdk-pixbuf aka GdkPixbuf before 2.42.2 allows a denial of service infinite loop in lzw.c in the function writeindexes. if c-selfcode equals 10, self-codetable10.extends will assign the value 11 to c. The next execution in the loop will assign self-codetable11.extends to c, which will give t...

CVE-2020-29385

GNOME gdk-pixbuf aka GdkPixbuf before 2.42.2 allows a denial of service infinite loop in lzw.c in the function writeindexes. if c-selfcode equals 10, self-codetable10.extends will assign the value 11 to c. The next execution in the loop will assign self-codetable11.extends to c, which will give t...

CVE-2020-29385

CVE-2020-29385 affects GNOME gdk-pixbuf (GdkPixbuf) up to version 2.42.1; the flaw is in lzw.c write_indexes where, under a crafted LZW GIF input, code_table[10] and code_table[11] can loop infinitely, causing a denial of service. Publicly available documents show impact as an infinite loop in GI...

CVE-2020-29385

GNOME gdk-pixbuf aka GdkPixbuf before 2.42.2 allows a denial of service infinite loop in lzw.c in the function writeindexes. if c-selfcode equals 10, self-codetable10.extends will assign the value 11 to c. The next execution in the loop will assign self-codetable11.extends to c, which will give t...

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

A denial of service vulnerability was found in the golang.org/x/text library. A library or application must use one of the vulnerable functions, such as unicode.Transform, transform.String, or transform.Byte, to be susceptible to this vulnerability. If an attacker is able to supply specific...

EulerOS 2.0 SP5 : cairo (EulerOS-SA-2020-2540)

According to the versions of the cairo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in cairo 1.16.0. There is an assertion problem in the function cairoarcindirection in the file cairo-arc.c.CVE-2019-6461 ...

Huawei EulerOS: Security Advisory for cairo (EulerOS-SA-2020-2540)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Contiki infinite loop vulnerability (CNVD-2021-29451)

Contiki is an open source, highly portable, networked multitasking operating system for memory-constrained systems. An infinite loop vulnerability exists in rplremoveheader in net/rpl/rpl-ext-header.c in the uIP TCP/IP stack component in Contiki 3.0 and earlier when processing RPL extended header...

Contiki infinite loop vulnerability (CNVD-2021-29450)

Contiki is an open source, highly portable, networked multitasking operating system for memory-constrained systems. An infinite loop vulnerability exists in the processing of IPv6 extended headers in exthdroptionsprocess in net/ipv6/uip6.c in the uIP TCP/IP stack component in Contiki 3.0 and...