206 matches found
MGASA-2021-0193 Updated python3 packages fix security vulnerability
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...
MGASA-2021-0025 Updated php packages fix security vulnerability
FILTERVALIDATEURL accepts URLs with invalid userinfo CVE-2020-7071. streamgetcontents fails with maxlength=-1 or default. See upstream releasenotes for other changes...
MGASA-2020-0405 Updated fontforge packages fix a security vulnerability
SFDGetFontMetaData insufficient CVE-2020-5395 backport. CVE-2020-25690...
CVE-2020-14845 vulnerabilities
Vulnerabilities for packages: mysql...
MGASA-2020-0335 Updated x11-server packages fix security vulnerability
Allocation for pixmap data in AllocatePixmap does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws known/unknown could lead to lead t...
MGASA-2020-0299 Updated matio packages fix security vulnerability
MatVarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdupvprintf when uninitialized memory is accessed. CVE-2019-17533...
MGASA-2020-0285 Updated ruby packages fix security vulnerability
Updated ruby packages fix security vulnerability: An issue was discovered in Ruby through 2.5.7. If a victim calls BasicSocketreadnonblockrequestedsize, buffer, exception: false, the method resizes the buffer to fit the requested size, but no data is copied. Thus, the buffer string provides the...
MGASA-2020-0279 Updated docker packages fix security vulnerability
Updated docker packages fix security vulnerability: A flaw was found in Docker when it creates network bridges that accept IPv6 router advertisements by default. This flaw allows an attacker who can execute code in a container to possibly spoof rogue IPv6 router advertisements to perform a...
GHSA-6WQP-V4V6-C87C vulnerabilities
Vulnerabilities for packages: hive...
MGASA-2020-0066 Updated php packages fix security vulnerabilities
Updated php packages fix security vulnerabilities: Two buffer overflows in string and mbstring handling have been found CVE-2020-7059, CVE-2020-7060. Other security fixes have been applied: - Session: Fixed bug 79091 heap use-after-free in sessioncreateid. - Date: Fixed bug 79015 undefined-behavi...
CVE-2020-2572 vulnerabilities
Vulnerabilities for packages: mysql...
MGASA-2020-0018 Updated jss packages fix security vulnerability
Updated jss packages fix security vulnerability: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be...
MGASA-2019-0381 Updated jasper packages fix security vulnerabilities
Heap based overflow in jasicctxtdescinput CVE-2018-19540. Heap based overread in jasimagedepalettize CVE-2018-19541...
MGASA-2019-0281 Updated webkit2 packages fix security vulnerabilities
Updated webkit2 packages fix security vulnerabilities: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling CVE-2019-8644. Processing maliciously crafted web content may lead to universal...
MGASA-2019-0274 Updated expat packages fix security vulnerability
Updated expat packages fix security vulnerability: It was discovered that Expat did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service CVE-2018-20843...
MGASA-2019-0241 Updated java-1.8.0-openjdk packages fix security vulnerabilities
The updated packages fix several bugs and some security issues: Side-channel attack risks in Elliptic Curve EC cryptography. CVE-2019-2745 Insufficient checks of suppressed exceptions in deserialization. CVE-2019-2762 Unbounded memory allocation during deserialization in Collections. CVE-2019-276...
CVE-2019-2739 vulnerabilities
Vulnerabilities for packages: mysql...
MGASA-2019-0135 Updated python3 packages fix security vulnerability
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming...