[slackware-security] libxslt

New libxslt packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/libxslt-1.1.35-i586-1slack15.0.txz: Upgraded. This update fixes bugs and the following security issues: Fix...

CVE-2022-23773 affecting package golang 1.16.12-1

CVE-2022-23773 affecting package golang 1.16.12-1. An upgraded version of the package is available that resolves this issue...

b2-sdk-python TOCTOU application key disclosure

Impact Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-of-check-time-of-use TOCTOU race condition. SDK users of the SqliteAccountInfo format are vulnerable while users...

thunderbird security update

CentOS Errata and Security Advisory CESA-2022:0538 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2022-21329 affecting package mysql 8.0.27-2

CVE-2022-21329 affecting package mysql 8.0.27-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-21265 affecting package mysql 8.0.27-2

CVE-2022-21265 affecting package mysql 8.0.27-2. An upgraded version of the package is available that resolves this issue...

Arbitrary file deletion

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible...

CVE-2022-23609 Path traveresal in iTunesRPC-Remastered

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible...

Attackers Target Intuit Users by Threatening to Cancel Tax Accounts

Just in time for tax season, Intuit is warning customers of a phishing campaign that threatens to close user accounts if they don’t click on a malicious link. The attacks on the accounting-software specialist that many people use for filing U.S. income tax forms comes as phishers overall are...

CVE-2022-23602 Nim's rst parser sandboxed mode allows include which can embed any local file

Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include referencing a file local to the host operating system. Nimforum will render the file if able. This can also be done silently by using NimForum'...

CVE-2022-23603 Code injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue...

Design/Logic Flaw

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to versions 3.1.43 and 4.0.3, template authors could run restricted static php methods. Users should upgrade to version 3.1.43 or 4.0.3 to receive a patch...

make-ca 安全漏洞

Make-Ca is a utility program that provides and manages complete Pki configurations. A security vulnerability exists in make-ca that stems from the fact that, starting with versions prior to 0.9 and 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certificates as...

CVE-2022-21643 SQL Injection in USOC

USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to...

CVE-2021-41236 XSS vulnerability in oro/platform

OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview ...

Debian DLA-2867-1 : spip - LTS security update

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2867 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network Security...

ALSA-2021:5235 Moderate: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. The following packages have been upgraded to a later upstream version: postgresql 12.9. Security Fixes: postgresql: memory disclosure in certain queries CVE-2021-3677 postgresql: server processes unencrypted bytes from...

CVE-2021-41772 affecting package golang 1.16.9-1

CVE-2021-41772 affecting package golang 1.16.9-1. An upgraded version of the package is available that resolves this issue...

AZL-7025 CVE-2021-43818 affecting package python-lxml for versions less than 4.8.0-1

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

PYSEC-2021-852

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...