openssl lib32-openssl: multiple issues

CVE-2015-3193 insecure private key in connection with DHE There is a carry propagating bug in the x8664 Montgomery squaring procedure. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not...

jre7-openjdk-headless: multiple issues

CVE-2015-4734 information disclosure It was discovered that the JGSS component of OpenJDK did not properly hide Kerberos realm information from all error exceptions when running under Security Manager. An untrusted Java application or applet could use this flaw to obtain certain information about...

chrony: denial of service

CVE-2015-1853 denial of service: This issue is similiar to the "ntp CVE-2015-1799"-issue. An attacker knowing that NTP hosts A and B are peering with each other symmetric association can send a packet to host A with source address of B which will set the NTP state variables on A to the values sen...

jasper: arbitrary code execution

CVE-2014-8157 arbitrary code execution Off-by-one error in the jpcdecprocesssot function allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. - CVE-2014-8158 arbitrary code...

jdk7-openjdk: multiple issues

CVE-2014-3566 man-in-the-middle Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6585 out-of-bounds read Allows remote attackers to affect confidentiality via font parsing...

thunderbird: multiple issues

CVE-2014-8634 arbitrary remote code execution Christian Holler and Patrick McManus reported memory safety problems and crashes that affect Firefox ESR 31.3 and Firefox 34. - CVE-2014-8635 arbitrary remote code execution Christoph Diehl, Christian Holler, Gary Kwong, Jesse Ruderman, Byron Campen,...

[ASA-201910-9] sudo: privilege escalation

Arch Linux Security Advisory ASA-201910-9 ========================================= Severity: High Date : 2019-10-16 CVE-ID : CVE-2019-14287 Package : sudo Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1047 Summary ======= The package sudo before version 1.8.28...

[ASA-201906-7] openssl: information disclosure

Arch Linux Security Advisory ASA-201906-7 ========================================= Severity: Low Date : 2019-06-11 CVE-ID : CVE-2019-1543 Package : openssl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-919 Summary ======= The package openssl before version...

[ASA-201702-1] tcpdump: arbitrary code execution

Arch Linux Security Advisory ASA-201702-1 ========================================= Severity: Critical Date : 2017-02-02 CVE-ID : CVE-2016-7922 CVE-2016-7923 CVE-2016-7924 CVE-2016-7925 CVE-2016-7926 CVE-2016-7927 CVE-2016-7928 CVE-2016-7929 CVE-2016-7930 CVE-2016-7931 CVE-2016-7932 CVE-2016-7933...

[ASA-201701-39] firefox: multiple issues

Arch Linux Security Advisory ASA-201701-39 ========================================== Severity: Critical Date : 2017-01-29 CVE-ID : CVE-2017-5373 CVE-2017-5374 CVE-2017-5375 CVE-2017-5376 CVE-2017-5377 CVE-2017-5378 CVE-2017-5379 CVE-2017-5380 CVE-2017-5381 CVE-2017-5382 CVE-2017-5383 CVE-2017-53...

mariadb: multiple issues

CVE-2016-6662 arbitrary code execution Researcher Dawid Golunski discovered several security issues in the mariadb DBMS, including a vulnerability flaw that can be exploited by a remote attacker to inject malicious settings into my.cnf configuration files. The flaw can be triggered to fully...

libpng: buffer overflow

It was discovered that the pnggetPLTE and pngsetPLTE functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer...

[ASA-201908-19] pigeonhole: arbitrary code execution

Arch Linux Security Advisory ASA-201908-19 ========================================== Severity: Critical Date : 2019-08-28 CVE-ID : CVE-2019-11500 Package : pigeonhole Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1027 Summary ======= The package pigeonhol...

[ASA-201811-22] samba: multiple issues

Arch Linux Security Advisory ASA-201811-22 ========================================== Severity: High Date : 2018-11-28 CVE-ID : CVE-2018-14629 CVE-2018-16841 CVE-2018-16851 CVE-2018-16852 CVE-2018-16853 CVE-2018-16857 Package : samba Type : multiple issues Remote : Yes Link :...

[ASA-201803-11] ntp: multiple issues

Arch Linux Security Advisory ASA-201803-11 ========================================== Severity: High Date : 2018-03-16 CVE-ID : CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Package : ntp Type : multiple issues Remote : Yes Link :...

[ASA-201704-9] webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-201704-9 ========================================= Severity: Critical Date : 2017-04-28 CVE-ID : CVE-2016-9642 CVE-2016-9643 CVE-2017-2367 CVE-2017-2376 CVE-2017-2377 CVE-2017-2386 CVE-2017-2392 CVE-2017-2394 CVE-2017-2395 CVE-2017-2396 CVE-2017-2405 CVE-2017-2415...

[ASA-201610-11] linux-lts: privilege escalation

Arch Linux Security Advisory ASA-201610-11 ========================================== Severity: High Date : 2016-10-21 CVE-ID : CVE-2016-5195 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before...

openssh: information leakage

Mitigate timing differences in password authentication that could be used to discern valid from invalid account names when long passwords were sent and particular password hashing algorithms are in use on the server. Reported by EddieEzra.Harari at verint.com...

jdk7-openjdk: sandbox escape

It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two differe...

unzip: multiple issues

CVE-2015-7696 arbitrary code execution A heap buffer overflow triggered by unzipping a file with password that can lead to arbitrary code execution. - CVE-2015-7697 denial of service A denial of service with a file that never finishes unzipping...

subversion: authentication bypass

CVE-2015-3184: Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. The result is that anonymous access may be possible to files for which only authenticated access should be possible. - CVE-2015-3187:...

libssh: denial of service

It was discovered that a double free vulnerability in the sshpacketkexinit function in kex.c allows remote attackers to cause a denial of service via a crafted kexinit packet...

[ASA-202204-13] gvim: arbitrary code execution

Arch Linux Security Advisory ASA-202204-13 ========================================== Severity: High Date : 2022-04-15 CVE-ID : CVE-2022-1154 CVE-2022-1160 Package : gvim Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-2662 Summary ======= The package gvim...

[ASA-202112-9] thunderbird: multiple issues

Arch Linux Security Advisory ASA-202112-9 ========================================= Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-43528 CVE-2021-43536 CVE-2021-43537 CVE-2021-43538 CVE-2021-43539 CVE-2021-43541 CVE-2021-43542 CVE-2021-43543 CVE-2021-43545 CVE-2021-43546 Package : thunderbird...

[ASA-202011-8] sddm: privilege escalation

Arch Linux Security Advisory ASA-202011-8 ========================================= Severity: Medium Date : 2020-11-10 CVE-ID : CVE-2020-28049 Package : sddm Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1266 Summary ======= The package sddm before version...

[ASA-201908-13] nginx: denial of service

Arch Linux Security Advisory ASA-201908-13 ========================================== Severity: Medium Date : 2019-08-16 CVE-ID : CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 Package : nginx Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1023 Summary ======= The...

[ASA-201906-21] libarchive: multiple issues

Arch Linux Security Advisory ASA-201906-21 ========================================== Severity: High Date : 2019-06-25 CVE-ID : CVE-2018-1000877 CVE-2018-1000878 CVE-2018-1000879 CVE-2018-1000880 CVE-2019-1000019 CVE-2019-1000020 Package : libarchive Type : multiple issues Remote : No Link :...

[ASA-201904-4] thunderbird: arbitrary code execution

Arch Linux Security Advisory ASA-201904-4 ========================================= Severity: Critical Date : 2019-04-06 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-947 Summary ======= The packag...

[ASA-201812-3] wireshark-cli: multiple issues

Arch Linux Security Advisory ASA-201812-3 ========================================= Severity: Critical Date : 2018-12-08 CVE-ID : CVE-2018-19622 CVE-2018-19623 CVE-2018-19624 CVE-2018-19625 CVE-2018-19626 CVE-2018-19627 CVE-2018-19628 Package : wireshark-cli Type : multiple issues Remote : Yes Li...

[ASA-201805-23] wireshark-qt: multiple issues

Arch Linux Security Advisory ASA-201805-23 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-qt Type :...

[ASA-201805-24] wireshark-common: multiple issues

Arch Linux Security Advisory ASA-201805-24 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-common Typ...

[ASA-201803-10] samba: multiple issues

Arch Linux Security Advisory ASA-201803-10 ========================================== Severity: Critical Date : 2018-03-13 CVE-ID : CVE-2018-1050 CVE-2018-1057 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-651 Summary ======= The package samba befor...

[ASA-201801-3] linux-zen: multiple issues

Arch Linux Security Advisory ASA-201801-3 ========================================= Severity: High Date : 2018-01-05 CVE-ID : CVE-2017-16995 CVE-2017-16996 CVE-2017-17449 CVE-2017-17558 CVE-2017-17712 CVE-2017-17805 CVE-2017-17806 CVE-2017-17852 CVE-2017-17853 CVE-2017-17854 CVE-2017-17855...

[ASA-201705-16] openvpn: denial of service

Arch Linux Security Advisory ASA-201705-16 ========================================== Severity: High Date : 2017-05-13 CVE-ID : CVE-2017-7478 CVE-2017-7479 Package : openvpn Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-271 Summary ======= The package openvpn...

[ASA-201610-3] hostapd: multiple issues

Arch Linux Security Advisory ASA-201610-3 ========================================= Severity: High Date : 2016-10-04 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : hostapd Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package hostapd befor...

bind: denial of service

An error in the parsing of incoming responses allows some records with an incorrect class to be accepted by BIND instead of being rejected as malformed. This can trigger a REQUIRE assertion failure when those records are subsequently cached. Intentional exploitation of this condition is possible...

libxml2: multiple issues

CVE-2015-1819 denial of service A denial of service flaw was found in the way the libxml2 library parsed certain XML files. An attacker could provide a specially crafted XML file that, when parsed by an application using libxml2, could cause that application to use an excessive amount of memory...

clamav: multiple issues

CVE-2015-2170 denial of service A flaw has been found in the UPX decoder with crafted files. During unpacking there are two range checks which are implemented "manually". Those checks lack the detection of overflows which are considered by the CLIISCONTAINED macro. - CVE-2015-2221 denial of...

drupal: multiple issues

CVE-2015-2559 access bypass Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be exploited on sites where...

mediawiki: Cross-site Scripting (XSS)

It was discovered that MediaWiki, a wiki engine, did not sufficiently filter CSS in uploaded SVG files, allowing for cross site scripting...

[ASA-201906-2] python-django: cross-site scripting

Arch Linux Security Advisory ASA-201906-2 ========================================= Severity: Medium Date : 2019-06-04 CVE-ID : CVE-2019-11358 CVE-2019-12308 Package : python-django Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-969 Summary ======= The package...

[ASA-201901-5] wireshark-cli: multiple issues

Arch Linux Security Advisory ASA-201901-5 ========================================= Severity: Medium Date : 2019-01-10 CVE-ID : CVE-2019-5716 CVE-2019-5717 CVE-2019-5718 CVE-2019-5719 Package : wireshark-cli Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-844 Summary...

[ASA-201706-27] openvpn: multiple issues

Arch Linux Security Advisory ASA-201706-27 ========================================== Severity: Critical Date : 2017-06-22 CVE-ID : CVE-2017-7508 CVE-2017-7512 CVE-2017-7520 CVE-2017-7521 Package : openvpn Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-318 Summary...

ntp: distributed denial of service amplification

CVE-2016-4953 distributed denial of service amplification An attacker who knows the origin timestamp and can send a spoofed packet containing a CRYPTO-NAK to an ephemeral peer target before any other response is sent can demobilize that association. Credit to Miroslav Lichvar of Red Hat -...

wireshark-cli: denial of service

CVE-2016-2522: The dissectberconstrainedbitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 2.0.x before 2.0.2 does not verify that a certain length is nonzero, which allows remote attackers to cause a denial of service out-of-bounds read and application...

apache: multiple issues

CVE-2015-0228 denial of service: modlua: A maliciously crafted websockets PING after a script calls r:wsupgrade can cause a child process crash. - CVE-2015-0253 denial of service: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in...

jre7-openjdk: multiple issues

CVE-2014-3566 man-in-the-middle Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6585 out-of-bounds read Allows remote attackers to affect confidentiality via font parsing...

unzip: arbitrary code execution

CVE-2014-8139 heap buffer overflow A heap-based buffer overflow exists in the CRC32 verification that allows attackers to potentially execute arbitrary code or cause a denial of service memory corruption. - CVE-2014-8140 out-of-bounds read/write Out-of-bounds access both read and write issues...

[ASA-202506-10] libblockdev: privilege escalation

Arch Linux Security Advisory ASA-202506-10 ========================================== Severity: High Date : 2025-06-22 CVE-ID : CVE-2025-6019 Package : libblockdev Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2905 Summary ======= The package libblockdev before...

[ASA-202204-4] rizin: multiple issues

Arch Linux Security Advisory ASA-202204-4 ========================================= Severity: Medium Date : 2022-04-04 CVE-ID : CVE-2021-4022 CVE-2021-43814 Package : rizin Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-2590 Summary ======= The package rizin before...