SUSE-SU-2022:2396-1 Security update for logrotate

This update for logrotate fixes the following issues: Security issues fixed: - CVE-2022-1348: Fixed insecure permissions for state file creation bsc1199652. - Improved coredump handing for SUID binaries bsc1192449. Non-security issues fixed: - Fixed 'logrotate emits unintended warning: keyword si...

USN-5512-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the UI, bypass CSP restrictions, or execute...

Slackware: Security Advisory (SSA:2022-194-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2341-1 Security update for containerd, docker and runc

This update for containerd, docker and runc fixes the following issues: containerd: - CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API bsc1200145 docker: - Update to Docker 20.10.17-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/201017...

CVE-2022-2047 vulnerabilities

Vulnerabilities for packages: druid, spark...

CVE-2022-32533 Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

CVE-2022-32533 Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no...

USN-5504-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions, obtain sensitive...

SUSE-SU-2022:2251-2 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2022-1292: Fixed command injection in crehash bsc1199166. - CVE-2022-2068: Fixed more shell code injection issues in crehash. bsc1200550...

Debian: Security Advisory (DLA-3064-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : thunderbird (RHSA-2022:5480)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:5480 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fixes: Mozilla: C...

SUSE-SU-2022:2216-1 Security update for the Linux Kernel (Live Patch 18 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005968 fixes several issues. The following security issues were fixed: - CVE-2022-32250: Fixed an use-after-free bug in the netfilter subsystem. This flaw allowed a local attacker with user access to cause a privilege escalation issue. bnc1200015 -...

[slackware-security] curl

New curl packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/curl-7.84.0-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Set-Cookie denial of service. HTTP...

Researchers Uncover Ways to Break the Encryption of 'MEGA' Cloud Storage Service

A new piece of research from academics at ETH Zurich has identified a number of critical security issues in the MEGA cloud storage service that could be leveraged to break the confidentiality and integrity of user data. In a paper titled "MEGA: Malleable Encryption Goes Awry," the researchers poi...

SUSE-FU-2022:2135-1 Feature update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Make sure SaltCacheLoader use correct fileclient bsc1199149 - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9...

June 14, 2022—KB5014710 (OS Build 10240.19325) - EXPIRED

None None...

MGASA-2022-0230 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID CVE-2022-1789. KVM: x86: avoid calling x86 emulator without a decoded instruction CVE-2022-1852. A use-after-free vulnerability was...

USN-5475-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the browser UI, conduct cross-site scripting XSS attacks, bypass...

SUSE-FU-2022:2042-1 Feature update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Make sure SaltCacheLoader use correct fileclient bsc1199149 - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9...

SUSE-SU-2022:2010-1 Security update for the Linux Kernel (Live Patch 44 for SLE 12 SP3)

This update for the Linux Kernel 4.4.180-94161 fixes several issues. The following security issue was fixed: - CVE-2022-30594: Fixed restriction bypass on setting the PTSUSPENDSECCOMP flag bnc1199602. - Add missing modulemutex lock to module notifier for previous live patches bsc1199834...