100 matches found
CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1
CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...
CVE-2023-24540 affecting package msft-golang for versions less than 1.20.11-1
CVE-2023-24540 affecting package msft-golang for versions less than 1.20.11-1. A patched version of the package is available...
CVE-2023-24536 affecting package msft-golang for versions less than 1.20.7-1
CVE-2023-24536 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...
AZL-28832 CVE-2023-39318 affecting package msft-golang for versions less than 1.20.10-1
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS atta...
AZL-28830 CVE-2023-39319 affecting package msft-golang for versions less than 1.20.10-1
The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...
CVE-2023-39533 affecting package msft-golang for versions less than 1.19.12-1
CVE-2023-39533 affecting package msft-golang for versions less than 1.19.12-1. A patched version of the package is available...
Security Updates for Microsoft Word Products (August 2023)
The Microsoft Word Products are missing a security update. It is, therefore, affected by a vulnerability and missing a defense-in-depth security update. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 8090...
AZL-27875 CVE-2023-39533 affecting package msft-golang for versions less than 1.19.12-1
go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in th...
AZL-27814 CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...
AZL-28831 CVE-2023-29406 affecting package msft-golang for versions less than 1.20.7-1
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...
CBL Mariner 2.0 Security Update: golang / msft-golang (CVE-2023-29402)
The version of golang / msft-golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-29402 advisory. - The go command May generate unexpected code at build time when using cgo. This May result in...
CBL Mariner 2.0 Security Update: golang / msft-golang (CVE-2023-29404)
The version of golang / msft-golang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-29404 advisory. - The go command May execute arbitrary code at build time when using cgo. This May occur when...
CVE-2023-29404 affecting package msft-golang for versions less than 1.19.10-1
CVE-2023-29404 affecting package msft-golang for versions less than 1.19.10-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-29402 affecting package msft-golang for versions less than 1.19.10-1
CVE-2023-29402 affecting package msft-golang for versions less than 1.19.10-1. An upgraded version of the package is available that resolves this issue...
AZL-27123 CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. Flags containing...
AZL-27150 CVE-2023-29404 affecting package msft-golang for versions less than 1.19.10-1
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "cgo LDFLAGS" directive. The arguments for a...
AZL-27122 CVE-2023-29402 affecting package msft-golang for versions less than 1.19.10-1
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved...
AZL-26626 CVE-2023-24540 affecting package msft-golang for versions less than 1.20.11-1
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution...
Important: Red Hat Security Advisory: kernel security and bug fix update
An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...