SUSE-SU-2021:2954-1 Security update for apache2

This update for apache2 fixes the following issues: - CVE-2021-33193: Fixed request splitting via HTTP/2 method injection and modproxy bsc1189387...

OESA-2021-1333 haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones. Security Fixes: An issue was...

Security update for apache2 (important)

openSUSE Security Update: Security update for apache2 Announcement ID: openSUSE-SU-2021:2954-1 Rating: important References: 1189387 Cross-References: CVE-2021-33193 CVSS scores: CVE-2021-33193 SUSE: 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 An update...

SUSE: Security Advisory (SUSE-SU-2021:2918-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Command injection in @diez/generation

The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead...

libssh buffer overflow vulnerability (CNVD-2021-71262)

Libssh is a C development package from the Libssh organization for accessing SSH services, which can execute remote commands, file transfers, and provide a secure transport channel for remote programs. libssh is vulnerable to a buffer overflow vulnerability, which stems from the fact that libssh...

CVE-2021-29853

IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions. IBM X-Force ID: 205529...

Path traversal

OpenOLAT is a web-based learning management system LMS. A path traversal vulnerability exists in versions prior to 15.3.18, 15.5.3, and 16.0.0. Using a specially prepared ZIP file, it is possible to overwrite any file that is writable by the application server user e.g. the tomcat user. Depending...

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

OpenMage Magento Lts Input Validation Error Vulnerability

OpenMage Magento Lts Magento, an e-commerce system from the OpenMage organization, is vulnerable to an input validation error in versions prior to OpenMage Magento LTS 19.4.15 and 20.0.13, which can be exploited by attackers to execute arbitrary commands via the block method...

CVE-2021-37749

MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 aka 16.6.2.66 allows blind SQL Injection via the Id within sourceItems parameter to the GetMap method...

OpenMage Magento Lts 输入验证错误漏洞

OpenMage Magento Lts Magento, an e-commerce system from the OpenMage organization, is vulnerable to an input validation error in versions prior to OpenMage Magento LTS 19.4.15 and 20.0.13, which can be exploited by attackers to execute arbitrary commands via the block method...

Double free in insert_many

An issue was discovered in the insertmany crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next method panics...

Out of bounds write in reorder

swapindex takes an iterator and swaps the items with their corresponding indexes. It reserves capacity and sets the length of the vector based on the .len method of the iterator. If the len returned by the iterator is larger than the actual number of elements yielded, then swapindex creates a...

GHSA-8FGG-5V78-6G76 Deserializing an array can free uninitialized memory in byte_struct

Bytestruct stack and unpack structure as raw bytes with packed or bit field layout. An issue was discovered in the bytestruct crate before 0.6.1 for Rust. There can be a drop of uninitialized memory if a certain deserialization method panics...

Double free in linea

Affected versions of this crate did not properly implements the Matrix::zipelements method, which causes an double free when the given trait implementation might panic. This allows an attacker to corrupt or take control of the memory...

Uncontrolled memory consumption in protobuf

Affected versions of this crate called Vec::reserve on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data...

Request splitting via HTTP/2 method injection and mod_proxy

...

GHSA-27WQ-QX3Q-FXM9 Improper Handling of Unexpected Data Type in ced

Impact In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. Patches The problem has been patched in ced v1.0.0. You can upgrade from v0.1.0 without any breaking changes. Workarounds Before passing an argument to ced, verify it’s a Buffer using Buffer.isBufferob...

Privilege Escalation

HAProxy is vulnerable to privilege escalation. The vulnerability exists due to a flaw in HTTP method name that when it contains a space followed by the name of a protected resource, it is possible that a server would interpret this as a request for that protected resource, such as in the "GET...