glibc security and bug fix update

2.17-322.0.2 - merge RH el7 u9 errata patches with Oracle patches Review-exception: Simple merge - merge RH el7 u9 patches with Oracle patches Review-exception: Simple merge - Four patches to match 3rd patch bundle from Marvell - modify MIPS values in elf/elf.h - add sysdeps/aarch64/sys/ifunc.h -...

Flawfinder - A Static Analysis Tool For Finding Vulnerabilities In C/C++ Source Code

This is "flawfinder" by David A. Wheeler. Flawfinder is a simple program that scans C/C++ source code and reports potential security flaws. It can be a useful tool for examining software for vulnerabilities, and it can also serve as a simple introduction to static source code analysis tools more...

Spoofing

An issue was discovered in the abistable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness...

CVE-2020-36213

An issue was discovered in the abistable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness...

Eclipse OpenJ9 Buffer Overflow Vulnerability (CNVD-2021-08893)

Eclipse OpenJ9 is a Java application engine from the Eclipse Foundation. The product is primarily used to run Java applications. A buffer overflow vulnerability exists in Eclipse OpenJ9 versions prior to 0.23, which stems from a stack-based buffer overflow that can occur when the virtual machine ...

CVE-2020-27221

In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding...

CVE-2020-27221

In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding...

CVE-2020-27221

In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding...

Stack overflow

In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding...

CVE-2020-27221

In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding...

CVE-2020-27221

CVE-2020-27221 affects Eclipse OpenJ9 (up to and including 0.23). The root cause is a stack-based buffer overflow when the VM or JNI natives convert UTF‑8 characters to the platform encoding. This can be triggered by sending an overly long string, potentially allowing arbitrary code execution or ...

RUSTSEC-2020-0105 Update unsound DrainFilter and RString::retain

Affected versions of this crate contained code from the Rust standard library that contained soundness bugs rust-lang/rust60977 double drop & rust-lang/rust78498 create invalid utf-8 string. The flaw was corrected in v0.9.1 by making a similar fix to the one made in the Rust standard library...

[SECURITY] Fedora 32 Update: python-canonicaljson-1.4.0-1.fc32

Features: Encodes objects and arrays as RFC 7159 JSON. Sorts object keys so that you get the same result each time. Has no inignificant whitespace to make the output as small as possible. Escapes only the characters that must be escaped, U+0000 to U+0019 / U+0022 / U+0056, to keep the output as...

[SECURITY] Fedora 33 Update: python-canonicaljson-1.4.0-1.fc33

Features: Encodes objects and arrays as RFC 7159 JSON. Sorts object keys so that you get the same result each time. Has no inignificant whitespace to make the output as small as possible. Escapes only the characters that must be escaped, U+0000 to U+0019 / U+0022 / U+0056, to keep the output as...

Fedora: Security Advisory for python-canonicaljson (FEDORA-2020-b90dac7fc4)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:3155-1)

This update for salt fixes the following issues : Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846 Fix disk.blkid to avoid unexpected keyword argument 'pubuser'. bsc1177867 Ensure...

SUSE SLED15 / SLES15 Security Update : salt (SUSE-SU-2020:3243-1)

This update for salt fixes the following issues : Avoid regression on 'salt-master': set passphrase for salt-ssh keys to empty string bsc1178485 Properly validate eauth credentials and tokens on SSH calls made by Salt API bsc1178319, bsc1178362, bsc1178361, CVE-2020-25592, CVE-2020-17490,...

SUSE SLES12 Security Update : less (SUSE-SU-2020:2687-1)

This update for less fixes the following issues : Security issue fixed : CVE-2014-9488: Malformed UTF-8 data could have caused an out of bounds read in the UTF-8 decoding routines, causing an invalid read access bsc921719. Note that Tenable Network Security has extracted the preceding description...

Directory Traversal

cabextract is vulnerable to directory traversal. Lack of proper checking for leading slashes when extracting files allows remote attackers to perform directory traversal attacks via a malformed UTF-8 characters that are changed to a UTF-8 encoded slash...

libreoffice security, bug fix, and enhancement update

libcmis 0.5.2-1 - Related: rhbz1796893 update to 0.5.2 liborcus 0.14.1-1 - Related: rhbz1796893 update to 0.14.1 libreoffice 6.3.6.2-3.0.1 - Replace colors with Oracle colors Orabug: 32120093 - Build with --with-vendor='Oracle America, Inc.' - Added the --with-hamcrest option to configure...