java security update

CentOS Errata and Security Advisory CESA-2022:0204 An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Updated kernel-linus packages fix security vulnerability

This kernel-linus update is based on upstream 5.15.16 and fixes at least the following security issue: William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A loc...

Invalid URL generation in bitlyshortener

Impact Due to a sudden upstream breaking change by Bitly, versions of bitlyshortener 0.6.0 generate invalid short URLs. All users are affected and must update immediately. Patches Upgrading bitlyshortener to 0.6.0 or newer will prevent the generation such invalid short URLs. Workarounds A...

CVE-2021-46322

Duktape v2.99.99 was discovered to contain a SEGV vulnerability via the component dukpushtval in duktape/dukapistack.c...

RLSA-2022:0188 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xfs: raw block device data leak in XFSIOCALLOCSP IOCTL CVE-2021-4155 kernel: fscontext: heap overflow in legacy parameter handling CVE-2022-0185 For more details about the security issues...

thunderbird security update

CentOS Errata and Security Advisory CESA-2022:0127 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

DEBIAN-CVE-2021-39633

In grehandleoffloads of ipgre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

Double free

In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204450605References: Upstream kernel...

Information disclosure

In grehandleoffloads of ipgre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

CVE-2021-39633

In grehandleoffloads of ipgre.c, there is a possible page fault due to an invalid memory access. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

firefox security update

91.5.0-1.0.1 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 91.5.0-1 - Update to 91.5.0 build1...

firefox security update

91.5.0-1.0.2 - Enabled aarch64 builds 91.5.0-1.0.1 - Remove upstream references Orabug: 30143292 - Update distribution for Oracle Linux Orabug: 30143292 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 91.5.0-1 - Update to 91.5.0 build1...

uriparser -- Multiple vulnerabilities

Upstream project reports: Fix a bug affecting both uriNormalizeSyntax and uriMakeOwner functions where the text range in .hostText would not be duped using malloc but remain unchanged and hence "not owned" for URIs with an IPv4 or IPv6 address hostname; depending on how an application uses...

MGASA-2021-0589 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.11 and fixes at least the following security issues: netdevsim: Zero-initialize memory for new map's value in function nsimbpfmapalloc CVE-2021-4135. Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.11 and fixes at least the following security issues: netdevsim: Zero-initialize memory for new map's value in function nsimbpfmapalloc CVE-2021-4135. Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the...

OPENSUSE-SU-2021:1626-1 Security update for go1.16

This update for go1.16 fixes the following issues: Updated to upstream version 1.16.12 to include security fixes to the compiler, syscall, runtime, the net/http, net/http/httptest, and time packages bsc1182345 - CVE-2021-44717: syscall: don't close fd 0 on ForkExec error bsc1193598. -...

Security update for go1.16 (moderate)

openSUSE Security Update: Security update for go1.16 Announcement ID: openSUSE-SU-2021:1626-1 Rating: moderate References: 1182345 1193597 1193598 Cross-References: CVE-2021-44716 CVE-2021-44717 Affected Products: openSUSE Leap 15.2 An update that solves two vulnerabilities and has one errata is...

CLSA-2021-1640271821 Fix CVE(s): CVE-2020-28024, CVE-2020-28025, CVE-2020-28026, CVE-2020-28020, CVE-2020-28021, CVE-2020-28022, CVE-2020-28011, CVE-2020-28013, CVE-2020-28012, CVE-2020-28015, CVE-2020-28007, CVE-2020-28017, CVE-2021-27216, CVE-2020-28008, CVE-2020-28009, CVE-2020-28014

SECURITY UPDATE: Multiple security issues - debian/patches/CVE-2020-28007.patch - debian/patches/CVE-2020-28008.patch - debian/patches/CVE-2020-28009.patch - debian/patches/CVE-2020-28011.patch - debian/patches/CVE-2020-28012.patch - debian/patches/CVE-2020-28013.patch -...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.10 and fixes at least the following security issues: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close and fget simultaneously and can potentially...

OPENSUSE-SU-2021:1601-1 Security update for log4j

This update for log4j fixes the following issue: - Previously published fixes for log4jshell turned out to be incomplete. Upstream has followed up on the original patch for CVE-2021-44228 with several additional changes LOG4J2-3198, LOG4J2-3201, LOG4J2-3208, and LOG4J2-3211 that are included in...