7558 matches found
Input validation
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a...
CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a...
CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a...
SUSE-SU-2023:2624-1 Security update for openssl-1_0_0
This update for openssl-100 fixes the following issues: - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case bsc1207534...
SUSE-SU-2023:2623-1 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case bsc1207534. - Update further expiring...
SUSE-SU-2023:2622-1 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case bsc1207534. - Update further expiring...
USN-6161-2 dotnet6, dotnet7 regression
USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that .NET did not properly enforce certain...
USN-6161-2: .NET regression
USN-6161-1 fixed vulnerabilities in .NET. The update introduced a regression with regards to how the runtime imported X.509 certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that .NET did not properly enforce certain...
SUSE CVE-2023-34981
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...
Tauri 授权问题漏洞
Tauri is a Tauri open source for building smaller, faster, and more secure desktop applications using a web front end. Tauri version 1.4.0 has an authorization issue vulnerability that stems from a regression that includes a file system range check on Unix uppoint files...
frr:zebra: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4865709591625728 Project: frr Fuzzing Engine: libFuzzer Fuzz Target: zebra Job Type: libfuzzerubsanfrr Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000001010001 Crash State: NULL Sanitizer: undefined UBSAN Recommended Security...
.NET 6.0 Update - June 22, 2023 (KB5028613)
None None...
Apache Tomcat Information Disclosure Vulnerability (Jun 2023) - Linux
Apache Tomcat is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"...
.NET 7.0 Update - June 22, 2023 (KB5028614)
None None...
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Impact The 1.4.0 release includes a regression on the filesystem scope check for dotfiles on Linux and macOS. Previously dotfiles eg. $HOME/.ssh/ were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a configuration option for this behavior was...
GHSA-WMFF-GRCW-JCFM Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Impact The 1.4.0 release includes a regression on the filesystem scope check for dotfiles on Linux and macOS. Previously dotfiles eg. $HOME/.ssh/ were not implicitly allowed by the glob wildcard scopes eg. $HOME/, but a regression was introduced when a configuration option for this behavior was...
ffmpeg:ffmpeg_AV_CODEC_ID_HEVC_fuzzer: Memcpy-param-overlap in put_hevc_pel_uni_pixels_8
Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4915653244223488 Project: ffmpeg Fuzzing Engine: honggfuzz Fuzz Target: ffmpegAVCODECIDHEVCfuzzer Job Type: honggfuzzasanffmpeg Platform Id: linux Crash Type: Memcpy-param-overlap Crash Address:...
Apache Tomcat vulnerable to information leak
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS message would be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...
DEBIAN-CVE-2023-34981
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...
Design/Logic Flaw
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SENDHEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy modproxyajp would use the response heade...