Updated python-ujson packages fix security vulnerability

Add support for arbitrary size integers. Replace 'wchart' string decoding implementation with a 'uint32t'-based one; fix handling of surrogates on decoding CVE-2022-31116 Potential double free of buffer during string decoding - Fix memory leak on encoding errors when the buffer was resized -...

SUSE-SU-2022:2583-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues: - CVE-2022-2385: Fixed AccessKeyID validation bypass bsc1201395...

MGASA-2022-0248 Updated ruby-git packages fix security vulnerability

Command Injection via git argument injection CVE-2022-25648...

GSD-2022-1003554 dlm: fix plock invalid read

dlm: fix plock invalid read This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.121 by commit 899bc4429174861122f0c236588700a4710c1fec, it was...

MGASA-2022-0191 Updated htmldoc packages fix security vulnerability

There is a vulnerability in htmldoc 1.9.16. In imageloadjpeg function image.cxx when it calls malloc,'img-width' and 'img-height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer...

GSD-2022-1001652 net: usb: aqc111: Fix out-of-bounds accesses in RX fixup

net: usb: aqc111: Fix out-of-bounds accesses in RX fixup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.35 by commit...

GSD-2022-1001492 xen: fix is_xen_pmu()

xen: fix isxenpmu This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.19 by commit 980bc42812c0a4788aee4b519bc911bfb911c23c, it was introduced...

MGASA-2022-0139 Updated webkit2 packages fix security vulnerability

The webkit2 package has been updated to version 2.36.0, fixing several security issues and other bugs...

Updated gdal packages fix security vulnerability

GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment. CVE-2021-45943...

Updated polkit packages fix security vulnerability

There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. CVE-2021-4115...

MGASA-2022-0075 Updated webkit2 packages fix security vulnerability

Fix accessibility not working when the Bubblewrap sandbox is enabled. Fix rendering of scrollbars when overlay scrollbars are disabled. Fix the build when the X11 support is disabled. Fix the build in a number of situations where the main OpenGL library is not called libGL or libgl, as is the cas...

MGASA-2021-0590 Updated libtpms/swtpm packages fix security vulnerability

CryptSym: fix AES output IV CVE-2021-3505. Fixed a context save and suspend/resume problem when public keys are loaded. Reset too large size indicators in TPM2B to avoid access beyond buffer CVE-2021-3623 Restore original value in buffer if unmarshalled one was illegal Fixed out-of-bounds access...

GSD-2021-1002712 scsi: scsi_debug: Don't call kcalloc() if size arg is zero

scsi: scsidebug: Don't call kcalloc if size arg is zero This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

GSD-2021-1002699 dm btree remove: fix use after free in rebalance_children()

dm btree remove: fix use after free in rebalancechildren This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

Updated firefox packages fix security vulnerability

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL CVE-2021-43536. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash due to a heap...

GSD-2021-1001966 net: batman-adv: fix error handling

net: batman-adv: fix error handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.254 by commit e50f957652190b5a88a8ebce7e5ab14ebd0d3f00...

CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4...

Updated ruby-addressable packages fix security vulnerability

A security flaw was found on rubygem-addressable that a crafted template may cause a Denial of Service CVE-2021-32740...

Updated zziplib packages fix security vulnerability

Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzipfileread" in the function "unzzipcatfile" CVE-2020-18442...