java-17-openjdk security and bug fix update

1:17.0.3.0.6-2 - Add JDK-8284920 fix for XPath regression - Related: rhbz2073575 1:17.0.3.0.6-2 - JDK-8275082 should be listed as also resolving JDK-8278008 & CVE-2022-21476 - Related: rhbz2073575 1:17.0.3.0.6-1 - JDK-8283911 patch no longer needed now we're GA... - Resolves: rhbz2073575...

java-11-openjdk security update

1:11.0.15.0.9-2 - Add JDK-8284920 fix for XPath regression - Related: rhbz2073422 1:11.0.15.0.9-2 - Remove security items from release notes that were only in 17u and N/A for 11u - Related: rhbz2073422 1:11.0.15.0.9-1 - Update to jdk-11.0.15.0+9 - Update release notes to 11.0.15.0+9 - Switch to G...

java-11-openjdk security, bug fix, and enhancement update

1:11.0.15.0.9-2.0.1 - link atomic for ix86 build 1:11.0.15.0.9-2 - Add JDK-8284920 fix for XPath regression - Related: rhbz2073422 1:11.0.15.0.9-2 - Remove security items from release notes that were only in 17u and N/A for 11u - Related: rhbz2073422 1:11.0.15.0.9-1 - Update to jdk-11.0.15.0+9 -...

SUSE-SU-2022:0844-2 Security update for expat

This update for expat fixes the following issues: - Fixed a regression caused by the patch for CVE-2022-25236 bsc1196784...

mysql-server:fuzz_initfile: Heap-use-after-free in Segment::write

Detailed Report: https://oss-fuzz.com/testcase?key=4707038145413120 Project: mysql-server Fuzzing Engine: libFuzzer Fuzz Target: fuzzinitfile Job Type: libfuzzerasanmysql-server Platform Id: linux Crash Type: Heap-use-after-free READ 1 Crash Address: 0x60e000025e08 Crash State: Segment::write...

MGASA-2022-0140 Updated subversion packages fix security vulnerability

SVN authz protected copyfrom paths regression. CVE-2021-28544 Subversion's moddavsvn is vulnerable to memory corruption. CVE-2022-24070...

Debian DSA-5119-1 : subversion - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5119 advisory. - Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured...

CVE-2021-28544

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization authz rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom...

Path traversal

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization authz rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom...

CVE-2021-28544

CVE-2021-28544 affects Apache Subversion (subversion) by leaking the copyfrom path in path-based authz protected copy operations. Affected components include httpd and svnserve services; root cause is disclosure of the original node’s copyfrom path, not its contents. Exploitation details are not ...

CVE-2021-28544 Apache Subversion SVN authz protected copyfrom paths regression

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization authz rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom...

CVE-2021-28544

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization authz rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom...

CVE-2021-39795

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: Pulled from Android ASB2022-04 publication https://source.android.com/security/bulletin/2022-04-01 due to a functional regression. We will re-release this CVE at a future date, in a future...

CVE-2021-39795

CVE-2021-39795 is documented in connection with Android’s MediaProvider vulnerability. The connected materials describe a privilege-escalation scenario arising from a missing permission check in MediaProvider.java that could let an attacker access or modify other applications’ external storage di...

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756 which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756 refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.

...

libvips:jpegsave_file_fuzzer: Crash in start_output_pass

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=6028626635653120 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: jpegsavefilefuzzer Job Type: libfuzzerubsanlibvips Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

libvips:pngsave_buffer_fuzzer: Heap-use-after-free in decode_mcu

Project: https://github.com/libvips/libvips.git Detailed Report: https://oss-fuzz.com/testcase?key=5575581556670464 Project: libvips Fuzzing Engine: libFuzzer Fuzz Target: pngsavebufferfuzzer Job Type: libfuzzerasanlibvips Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address:...

CVE-2021-20295

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in...

CVE-2021-20295

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in...

CVE-2021-20295

It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 https://access.redhat.com/errata/RHSA-2020:4676 erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in...