SUSE-SU-2024:2276-1 Security update for ghostscript

This update for ghostscript fixes the following issues: - CVE-2024-29510: Fixed an arbitrary path traversal when running in a permitted path bsc1226945. - CVE-2024-33870: Fixed a format string injection that could lead to command execution bsc1226944. - CVE-2024-33869: Fixed a path validation...

PT-2024-14222 · Allegra · Allegra

Name of the Vulnerable Software and Affected Versions: Allegra affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this issue, the existing authentication...

CVE-2021-43795

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassing Armeria's path validation...

PT-2021-23941

Name of the Vulnerable Software and Affected Versions: Armeria versions prior to 1.13.4 Description: An attacker can access an Armeria server's local file system beyond its restricted directory by sending an HTTP request whose path contains %2F encoded /, such as /files/..%2Fsecrets.txt, bypassin...

CVE-2019-11044: Improper Null Termination

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access...