SUSE-SU-2021:3385-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2021-35942: wordexp: handle overflow in positional parameter number bsc1187911 - CVE-2021-33574: Use pthreadattrcopy in mqnotify bsc1186489...

OPENSUSE-SU-2021:3353-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.32.4 - CVE-2021-30858: Fixed a security bug that could allow maliciously crafted web content to achieve arbitrary code execution. bsc1190701 - CVE-2021-21806: Fixed an exploitable use-after-free vulnerability via...

CVE-2020-27372

A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the runinterpreter function...

MGASA-2021-0470 Updated apache packages fix security vulnerability

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default...

Spotweb Cross-Site Scripting Vulnerability

Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team.A cross-site scripting vulnerability exists in Spotweb 1.5.1 and below, which can be exploited by remote attackers to inject arbitrary Web scripts or HTML via the newpassword2 parameter...

TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2021-015...

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

Cobbler before 3.3.0 allows arbitrary file write operations via uploadlogdata...

PYSEC-2021-375

Cobbler before 3.3.0 allows authorization bypass for modification of settings...

OSV-2021-1400 Heap-buffer-overflow in unpack_16bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39472 Crash type: Heap-buffer-overflow WRITE Crash state: unpack16bit exrdecodingrun Imf31::checkCoreFile...

ASB-A-190404449

Bulletin has no description...

PUB-A-184564101

Bulletin has no description...

ASB-A-190404406

Bulletin has no description...

CVE-2020-20663

libieciccpmod v1.5 contains a heap-buffer-overflow in the component mmsclientconnection.c...

SUSE-SU-2021:3269-1 Security update for libqt5-qtbase

This update for libqt5-qtbase fixes the following issues: - CVE-2020-24741: Fixed a bug that allowed QLibrary to load libraries relative to CWD which could result in arbitrary code execution. bsc1189408...

CVE-2021-3822

jsoneditor is vulnerable to Inefficient Regular Expression Complexity...

OSV-2021-1380 Negative-size-param in ntfs_attr_walk_special

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39317 Crash type: Negative-size-param Crash state: ntfsattrwalkspecial tskfsattrwalk ntfsprocattrseq...

DLA-2766-1 openssl - security update

Bulletin has no description...

Denial Of Service (DoS)

ffmpeg is vulnerable to denial of service. The vulnerability exists due a division by zero in function filterframe in libavfilter/vflenscorrection.c in Ffmpeg...

OPENSUSE-SU-2021:3193-1 Security update for ffmpeg

This update for ffmpeg fixes the following issues: - CVE-2021-38171: Fixed adtsdecodeextradata in libavformat/adtsenc.c to check the initgetbits return value bsc1189724...

Design/Logic Flaw

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running...