java-11-openjdk security, bug fix, and enhancement update

1:11.0.15.0.9-2.0.1 - link atomic for ix86 build 1:11.0.15.0.9-2 - Add JDK-8284920 fix for XPath regression - Related: rhbz2073422 1:11.0.15.0.9-2 - Remove security items from release notes that were only in 17u and N/A for 11u - Related: rhbz2073422 1:11.0.15.0.9-1 - Update to jdk-11.0.15.0+9 -...

CVE-2022-1035

Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV...

CVE-2022-24259

An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request...

CVE-2021-27855

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 allows a remote, authenticated attacker with read-only privileges to grant themselves administrative privileges. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identifier for this...

java-11-openjdk security and bug fix update

1:11.0.13.0.8-1.0.1 - link atomic for ix86 build 1:11.0.13.0.8-1 - Revert addition of libharfbuzz.so after its removal by JDK-8255790 - Resolves: rhbz2012332 1:11.0.13.0.8-1 - Update to jdk-11.0.12.0+8 - Update release notes to 11.0.12.0+8 - Switch to GA mode for final release. - This tarball is...

GHSA-6P52-JR3Q-C94G Nameko Arbitrary code execution due to YAML deserialization

Impact Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example: yaml malicious.yaml !!python/object/new:type args: 'z', !!python/tuple , 'extend': !!python/name:exec listitems: "import'os'.system'cat /etc/passwd'" shell $ nameko run --config...

CVE-2021-36364

Nagios XI before 5.8.5 incorrectly allows backupxi.sh wildcards...

Siemens Solid Edge 资源管理错误漏洞

Solid Edge is a 3D CAD, parametric feature and synchronous technology solid modeling software. versions prior to Siemens Solid Edge SE2021MP8 contain a post-release reuse vulnerability when parsing OBJ files. An attacker could exploit this vulnerability to execute code in the context of the curre...

Siemens Solid Edge 资源管理错误漏洞

Solid Edge is a 3D CAD, parametric feature and synchronous technology solid modeling software. A post-release reuse vulnerability exists in Siemens Solid Edge versions prior to SE2021MP8 when parsing OBJ files. An attacker can exploit the vulnerability to execute code in the context of the curren...

CVE-2021-24623

The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability i...

CVE-2021-30567

Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially exploit heap corruption via specific user gesture...

@agrc/helpers (>=1.0.0 <=1.0.1), @dojo/interop (>=4.0.0 <=7.0.0) +9 more potentially affected by CVE-2021-23450 via dojo (>=1.10.0 <=1.17.0-pre)

dojo NPM version =1.10.0, =1.0.0, =4.0.0, =0.0.29, =0.0.1, =1.10.0, =0.1.0, =1.10.3, =0.3.0-alpha.1, =0.0.1, =0.5.24 Source cves: CVE-2021-23450 Source advisory: SNYK:JS-DOJO-1535223...

JVN#53278122: Minecraft Java Edition vulnerable to directory traversal

Minecraft Java Edition provided by Mojang Studios contains a directory traversal vulnerability CWE-22. Impact Arbitrary JSON files on the system using the product may be deleted by an attacker. Solution Update Minecraft Update Minecraft to the latest version according to the information provided ...

UBUNTU-CVE-2021-3612

An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from th...

java-11-openjdk security and bug fix update

1:11.0.11.0.9-1.0.1 - link atomic for ix86 build 1:11.0.11.0.9-1 - Add backport of JDK-8187450 from 11.0.12 to fix RH1937736 - Resolves: rhbz1937736 1:11.0.11.0.9-0 - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 - Switch to GA mode for final release. - This tarball is embargoed...

UBUNTU-CVE-2021-28877

In the standard library in Rust before 1.51.0, the Zip implementation calls iteratorgetunchecked for the same index more than once when nested. This bug can lead to a memory safety violation due to an unmet safety requirement for the TrustedRandomAccess trait...

A flaw was found in Nettle in versions before 3.7.2 where several Nettle signature verification functions (GOST DSA EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality integrity as well as system availability.

...

CVE-2020-13418

OpenIAM before 4.2.0.3 allows XSS in the Add New User feature...

CVE-2021-3393

An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permission to a particular column could craft queries which, under some circumstances, might disclose values from that column in error messages. A...

UBUNTU-CVE-2021-3477

There's a flaw in OpenEXR's deep tile sample size calculations in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, subsequently leading to an out-of-bounds read. The greatest risk of this flaw is to...