java-17-openjdk security update

1:17.0.16.0.8-2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.16.0.8-2 - Update to jdk-17.0.16+8 - Add to .gitignore openjdk-17.0.16+8.tar.xz - Set updatever to 16 - Set buildver to 8 - Update sources to openjdk-17.0.16+8.tar.xz - Resolves: RHEL-101793 - Resolves: RHEL-102273 - Require...

tar-fs has issue where extract can write outside the specified dir with a specific tarball

...

CVE-2024-1082

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker to gain unauthorized read permission to files by deploying arbitrary symbolic links to a GitHub Pages site with a specially crafted artifact tarball. To exploit this vulnerability, an attacker would...

CVE-2023-37478

pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when installed via pnpm is malicious, due to how pnpm parses tar archives. This can result in a package that appears safe on the npm registry or when installed via...

CVE-2021-30139

In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash...

CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2025-3852)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-3852 advisory. 1:17.0.15.0.6-2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.15.0.6-2 - Update to jdk-17.0.15+6 GA - Add to .gitignore...

Gluon CV Toolkit 输入验证错误漏洞

Gluon CV Toolkit is an open source tool from Distributed Machine Learning Community. An input validation error vulnerability exists in Gluon CV Toolkit version 0.10.0, which stems from an uncleaned tar.gz file download and extraction, and could lead to arbitrary file writes...

java-17-openjdk security update for RHEL 8.6, 8.8, 8.10, 9.4 and 9.5

1:17.0.14.0.7-3.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.14.0.7-3 - Set rpmrelease to 3 - Revert 'Require tzdata-java 2024b at runtime and for build' 1:17.0.14.0.7-2 - Do not pass nil to jvmdir macro in cjc logic - Related: RHEL-73867 1:17.0.14.0.7-2 - Adapt to newest cjc to fix...

Fedora 40 : llvm-test-suite (2024-300397332b)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-300397332b advisory. Remove ClamAV subdirectory because of viruses in input files: These were the findings: MultiSource/Applications/ClamAV/inputs/rtf-test/rtf1.rtf:...

Malicious code in iconscout-unicons-tarball (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e3d526d1eb0088d08fcb4bb9dccef826f3809ca3701b5b5c601706c61c4b966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10671 Malicious code in iconscout-unicons-tarball (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e3d526d1eb0088d08fcb4bb9dccef826f3809ca3701b5b5c601706c61c4b966 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

java-21-openjdk security update

1:21.0.5.0.10-3.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.5.0.10-3 - Sync the copy of the portable specfile with the latest update - This tarball is embargoed until 2024-10-15 @ 1pm PT. - Related: RHEL-61346 1:21.0.5.0.10-2 - Update to jdk-21.0.5+10 GA - Update release notes to...

Fedora 39 : xrdp (2024-41c1bf8de6)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-41c1bf8de6 advisory. Release notes for xrdp v0.10.1 2024/07/31 General announcements A clipboard bugfix included in this release is sponsored by Krmer Pferdesport GmbH & Co KG. W...

Oracle Linux 8 / 9 : java-17-openjdk (ELSA-2024-4568)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-4568 advisory. 1:17.0.12.0.7-2.0.1 - Add Oracle vendor bug URL 1:17.0.12.0.7-2 - Update to jdk-17.0.12+7 GA - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz...

java-1.8.0-openjdk security update

1.8.0.422.b05-2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.422.b05-1.1 - Update to shenandoah-jdk8u422-b05 GA - Update release notes for shenandoah-8u422-b05. - Rebase PR2462 patch following patched hunk being removed by JDK-8322106 - Switch to GA mode. - Sync the copy of the portab...

java-17-openjdk security update

1:17.0.12.0.7-2.0.1 - Add Oracle vendor bug URL 1:17.0.12.0.7-2 - Update to jdk-17.0.12+7 GA - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz - Sync java-17-openjdk-portable.specfile - Set buildver to 7 - Set portablerelease 1 - Set isga to 1 - Update sources to openjdk-17.0.12+7.tar.xz -...

SUSE CVE-2024-37150

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...

CVE-2024-37150

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...

CVE-2024-37150 Private npm registry support used scope auth token for downloading tarballs

An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private...