GSD-2022-1004694 sfc: fix kernel panic when creating VF

sfc: fix kernel panic when creating VF This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.207 by commit...

GSD-2022-1004493 usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

usb: gadget: lpc32xxudc: Fix refcount leak in lpc32xxudcprobe This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.49 by commit...

GSD-2022-1004475 bpf: Fix request_sock leak in sk lookup helpers

bpf: Fix requestsock leak in sk lookup helpers This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.51 by commit...

CVE-2022-34295

totd before 1.5.3 does not properly randomize mesg IDs...

MGASA-2022-0189 Updated python-oslo-utils packages fix security vulnerability

oslo.utils could be made to expose sensitive information if it received a specially crafted input CVE-2022-0718...

GSD-2022-1001710 netfilter: conntrack: revisit gc autotuning

netfilter: conntrack: revisit gc autotuning This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.34 by commit...

MGASA-2022-0080 Updated polkit packages fix security vulnerability

There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. CVE-2021-4115...

CVE-2021-33828

The filesantivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files that have been uploaded to a public share are supposed to be deleted upon detection...

MGASA-2022-0008 Updated suricata packages fix security vulnerability

Critical evasion in suricata CVE-2021-35063...

MGASA-2021-0572 Updated log4j packages fix security vulnerability

Updated log4j packages fix security vulnerability: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is...

GHSA-2MQV-4J3R-VJVP Open redirect in @auth0/nextjs-auth0

Overview Versions =1.6.2 Will this update impact my users? The fix provided in the patch will not affect your users...

MGASA-2021-0540 Updated nginx/vsftpd packages fix security vulnerability

ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication...

UVI-2021-1001827 net: encx24j600: check error in devm_regmap_init_encx24j600

net: encx24j600: check error in devmregmapinitencx24j600 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.155 by commit...

MGASA-2021-0492 Updated opencryptoki packages fix security vulnerability

It was discovered that openCryptoki incorrectly handled certain EC keys. An attacker could possibly use this issue to cause a invalid curve attack...

GHSA-JG8V-48H5-WGXG jszip Vulnerable to Prototype Pollution

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values e.g proto, toString, etc results in a returned object with a modified prototype instance...

MGASA-2021-0363 Updated perl-Convert-ASN1 package fixes security vulnerability

perl-Convert-ASN1 aka the Convert::ASN1 module for Perl through 0.27 allows remote attackers to cause an infinite loop via unexpected input CVE-2013-7488...

MGASA-2021-0324 Updated fluidsynth packages fix a security vulnerability

fluidsynth is a software synthesizer based on the SoundFont 2 specifications. A use after free violation was discovered in fluidsynth, that can be triggered when loading an invalid SoundFont file CVE-2021-21417...

GSD-2021-1000054 tools/power turbostat: Fix offset overflow issue in index converting

tools/power turbostat: Fix offset overflow issue in index converting This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.12.3 by commit...

CVE-2021-30219

samurai 1.2 has a NULL pointer dereference in printstatus function in build.c via a crafted build file...

MGASA-2021-0182 Updated spamassassin packages fix security vulnerability

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...