MGASA-2019-0364 Updated sdl2_image packages fix security vulnerabilities

Updated sdl2image packages fix security vulnerabilities: An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2image, version 2.0.4. A missing error handler can lead to a buffer overflow and potential code execution. An attacker can provide a specially...

The vulnerability of the Web page rendering module in WebKitGTK+ lies in the lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the WebPage rendering module in WebKitGTK+ relates to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially created web page...

The vulnerability of Google Chrome’s Blink rendering module allows a hacker to bypass the configured content filters and compromise the integrity of the protected information.

The vulnerability of Google Chrome’s Blink rendering module exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass the configured content filters and compromise the integrity of the protected information through a specially created HT...

The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows a hacker to gain unauthorized access to local files.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files through a specially created HTML page...

Denial Of Service (DoS) Via Infinite Loop

graphql-hooks is vulnerable to denial of service DoS attacks. Since skipCache is set to true by default in the function useQuery during server side rendering, an attacker can send the query requests to trigger infinite loop as it runs indefinitely without raising any error or returning any result...

CVE-2019-19329

In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur, aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no...

SUSE-SU-2019:3083-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Security issues fixed October 2019 CPU bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Better Processes -...

openSUSE Security Update : java-11-openjdk (openSUSE-2019-2557)

This update for java-11-openjdk to version jdk-11.0.5-10 fixes the following issues : Security issues fixed October 2019 CPU bsc1154212: - CVE-2019-2933: Windows file handling redux - CVE-2019-2945: Better socket support - CVE-2019-2949: Better Kerberos ccache handling - CVE-2019-2958: Build Bett...

Grafana Labs Arbitrary File Read (CVE-2018-19039)

An information disclosure vulnerability exists in Grafana. This vulnerability is due to insufficient handling of direct link image rendering of HTML text panels. A remote, authenticated attacker can exploit the vulnerability by creating a crafted HTML text panel and requesting a direct link image...

[SECURITY] Fedora 30 Update: webkit2gtk3-2.26.2-1.fc30

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

[SECURITY] Fedora 31 Update: webkit2gtk3-2.26.2-1.fc31

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

Fedora 30 : webkit2gtk3 (2019-4213e37211)

Improve performance of querying system fallback fonts. - Dont use prgname in dbus-proxy socket path. - Fix thread-safety issues in image decoders. - Fix the build with WebDriver disabled. - Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland. - Fill the...

Fedora 31 : webkit2gtk3 (2019-fa0c4b0674)

Improve performance of querying system fallback fonts. - Dont use prgname in dbus-proxy socket path. - Fix thread-safety issues in image decoders. - Fix the build with WebDriver disabled. - Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland. - Fill the...

[SECURITY] Fedora 30 Update: mupdf-1.16.1-1.fc30

MuPDF is a lightweight PDF viewer and toolkit written in portable C. The renderer in MuPDF is tailored for high quality anti-aliased graphics. MuPDF renders text with metrics and spacing accurate to within fractions of a pixel for the highest fidelity in reproducing the look of a printed page on...

Mozilla Firefox ESR < 31.2 Multiple Vulnerabilities

Binary data 701248.prm...

[SECURITY] Fedora 30 Update: webkit2gtk3-2.26.1-3.fc30

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...

iSeeQ Hybrid DVR WH-H4 2.0.0.P - (get_jpeg) Stream Disclosure

iSeeQ Hybrid DVR WH-H4 2.0.0.P - getjpeg Stream Disclosure Title: iSeeQ Hybrid DVR WH-H4 2.0.0.P - getjpeg Stream Disclosure Date: 2019-10-29 Author: LiquidWorm Vendor:iSeeQ Link: http://www.iseeq.co.kr CVE: N/A !/bin/bash iSeeQ Hybrid DVR WH-H4 1.03R / 2.0.0.P getjpeg Stream Disclosure Vendor:...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...

CVE-2019-17115

Multiple cross-site scripting XSS vulnerabilities in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML that is triggered when Logs.jsp is visited. The renderedmessage column is retrieved and displayed, unsanitized, on Logs.jsp. A remote...

The vulnerability of Blink’s web page display mechanism in the Google Chrome web browser allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service interruptions.

The vulnerability of Blink’s web page rendering mechanism in the Google Chrome browser is related to a processing error in the Cross-Origin Resource Sharing CORS policy. Exploiting this vulnerability could allow an attacker to compromise data integrity, gain unauthorized access to protected...