openssl: multiple issues

CVE-2015-1787 denial of service If client auth is used then a server can segfault in the event of a DHE ciphersuite being selected and a zero length ClientKeyExchange message being sent by the client. This could be exploited in a DoS attack. - CVE-2015-0207 denial of service The DTLSv1listen...

putty: information disclosure

When PuTTY has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed durin...

postgresql: multiple issues

CVE-2014-8161 information leak Some server error messages show the values of columns that violate a constraint, such as a unique constraint. If the user does not have SELECT privilege on all columns of the table, this could mean exposing values that the user should not be able to see. Adjust the...

nvidia-340xx: arbitrary code execution

It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation...

[ASA-202204-14] mediawiki: cross-site scripting

Arch Linux Security Advisory ASA-202204-14 ========================================== Severity: Medium Date : 2022-04-15 CVE-ID : CVE-2022-28202 Package : mediawiki Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2677 Summary ======= The package mediawiki before...

[ASA-202110-3] virtualbox: multiple issues

Arch Linux Security Advisory ASA-202110-3 ========================================= Severity: High Date : 2021-10-21 CVE-ID : CVE-2021-2475 CVE-2021-35538 CVE-2021-35540 CVE-2021-35542 CVE-2021-35545 Package : virtualbox Type : multiple issues Remote : No Link :...

[ASA-202010-10] freetype2: arbitrary code execution

Arch Linux Security Advisory ASA-202010-10 ========================================== Severity: High Date : 2020-10-20 CVE-ID : CVE-2020-15999 Package : freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1254 Summary ======= The package freetype2 befo...

[ASA-202006-4] thunderbird: multiple issues

Arch Linux Security Advisory ASA-202006-4 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-12398 CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12410 Package : thunderbird Type : multiple issues Remote : Yes Link :...

[ASA-201906-12] linux-hardened: denial of service

Arch Linux Security Advisory ASA-201906-12 ========================================== Severity: High Date : 2019-06-17 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-hardened Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-986 Summary =======...

[ASA-201903-10] wordpress: directory traversal

Arch Linux Security Advisory ASA-201903-10 ========================================== Severity: High Date : 2019-03-18 CVE-ID : CVE-2019-8943 Package : wordpress Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-909 Summary ======= The package wordpress before...

[ASA-201810-11] net-snmp: multiple issues

Arch Linux Security Advisory ASA-201810-11 ========================================== Severity: High Date : 2018-10-17 CVE-ID : CVE-2015-5621 CVE-2018-18065 Package : net-snmp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-777 Summary ======= The package net-snmp...

[ASA-201711-15] lib32-openssl: multiple issues

Arch Linux Security Advisory ASA-201711-15 ========================================== Severity: Medium Date : 2017-11-08 CVE-ID : CVE-2017-3735 CVE-2017-3736 Package : lib32-openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-478 Summary ======= The package...

[ASA-201707-27] lib32-expat: denial of service

Arch Linux Security Advisory ASA-201707-27 ========================================== Severity: Medium Date : 2017-07-26 CVE-ID : CVE-2016-9063 CVE-2017-9233 Package : lib32-expat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-305 Summary ======= The package...

[ASA-201704-10] libtiff: multiple issues

Arch Linux Security Advisory ASA-201704-10 ========================================== Severity: Medium Date : 2017-04-28 CVE-ID : CVE-2017-7592 CVE-2017-7593 CVE-2017-7594 CVE-2017-7595 CVE-2017-7596 CVE-2017-7597 CVE-2017-7598 CVE-2017-7599 CVE-2017-7600 CVE-2017-7601 CVE-2017-7602 Package :...

[ASA-201702-18] linux-zen: multiple issues

Arch Linux Security Advisory ASA-201702-18 ========================================== Severity: High Date : 2017-02-22 CVE-ID : CVE-2016-10088 CVE-2016-9588 CVE-2017-5986 CVE-2017-6074 Package : linux-zen Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-186 Summary...

[ASA-201610-7] wpa_supplicant: multiple issues

Arch Linux Security Advisory ASA-201610-7 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-4476 CVE-2016-4477 Package : wpasupplicant Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package...

linux-grsec: information disclosure

A security issue has been found in the Linux kernel's implementation of challenge ACKs as specified in RFC 5961. An attacker which knows a connection's client IP, server IP and server port can abuse the challenge ACK mechanism to determine the accuracy of a normally 'blind' attack on the client o...

firefox: multiple issues

CVE-2016-0718 arbitrary code execution Out-of-bounds read during XML parsing in Expat library. - CVE-2016-2830 information disclosure Favicon network connection can persist when page is closed. - CVE-2016-2835 CVE-2016-2836 arbitrary code execution Mozilla developers and community members...

nginx: denial of service

A vulnerability was found in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while handling the client request body...

mercurial: arbitrary code execution

Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545. Reported and fixed by Blake...

libsndfile: multiple issues

CVE-2014-9496 unspecified impact The sd2parsersrcfork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a 1 map offset or 2 rsrc marker, which triggers an out-of-bounds read. - CVE-2014-9756 denial of service The psffwrite function in fileio.c in...

lib32-curl: authentication bypass

A vulnerability was found in a way libcurl uses NTLM-authenticated proxy connections. Libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. Since NTLM-based authentication is...

firefox: multiple issues

CVE-2015-4473 Memory safety bugs fixed in Firefox ESR 38.2 and Firefox 40: Gary Kwong, Christian Holler, and Byron Campen reported memory safety problems and crashes that affect Firefox ESR 38.1 and Firefox 39. - CVE-2015-4474 Memory safety bugs fixed in Firefox 40: Tyson Smith, Bobby Holley,...

polarssl: multiple issues

CVE-2014-8627 weak signature negotiation A mistake resulted in servers negotiating the lowest common hash from signaturealgorithms extension in TLS 1.2. - CVE-2014-8628 memory leaks Two issues were found that result in remotely triggerable memory leaks when parsing crafted ClientHello messages or...

[ASA-202205-2] git: arbitrary command execution

Arch Linux Security Advisory ASA-202205-2 ========================================= Severity: Medium Date : 2022-05-16 CVE-ID : CVE-2022-24765 Package : git Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2679 Summary ======= The package git before version...

[ASA-202004-3] linux-lts: privilege escalation

Arch Linux Security Advisory ASA-202004-3 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1121 Summary ======= The package linux-lts before versi...

[ASA-201908-7] postgresql-libs: multiple issues

Arch Linux Security Advisory ASA-201908-7 ========================================= Severity: Medium Date : 2019-08-10 CVE-ID : CVE-2019-10208 CVE-2019-10209 Package : postgresql-libs Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1019 Summary ======= The package...

[ASA-201908-3] python2-django: multiple issues

Arch Linux Security Advisory ASA-201908-3 ========================================= Severity: Medium Date : 2019-08-05 CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package : python2-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1014...

[ASA-201908-2] python-django: multiple issues

Arch Linux Security Advisory ASA-201908-2 ========================================= Severity: Medium Date : 2019-08-05 CVE-ID : CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1015...

[ASA-201906-14] linux-lts: denial of service

Arch Linux Security Advisory ASA-201906-14 ========================================== Severity: High Date : 2019-06-18 CVE-ID : CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 Package : linux-lts Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-984 Summary ======= The...

[ASA-201904-9] dovecot: denial of service

Arch Linux Security Advisory ASA-201904-9 ========================================= Severity: Medium Date : 2019-04-18 CVE-ID : CVE-2019-10691 Package : dovecot Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-950 Summary ======= The package dovecot before version...

[ASA-201812-11] go: multiple issues

Arch Linux Security Advisory ASA-201812-11 ========================================== Severity: High Date : 2018-12-18 CVE-ID : CVE-2018-16873 CVE-2018-16874 CVE-2018-16875 Package : go Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-835 Summary ======= The package g...

[ASA-201811-2] linux-lts: denial of service

Arch Linux Security Advisory ASA-201811-2 ========================================= Severity: Low Date : 2018-11-01 CVE-ID : CVE-2018-18445 Package : linux-lts Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-801 Summary ======= The package linux-lts before version...

[ASA-201807-8] libcurl-compat: arbitrary code execution

Arch Linux Security Advisory ASA-201807-8 ========================================= Severity: High Date : 2018-07-16 CVE-ID : CVE-2018-0500 Package : libcurl-compat Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-733 Summary ======= The package libcurl-compa...

[ASA-201712-7] quagga: denial of service

Arch Linux Security Advisory ASA-201712-7 ========================================= Severity: Medium Date : 2017-12-13 CVE-ID : CVE-2017-16227 Package : quagga Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-481 Summary ======= The package quagga before version...

[ASA-201708-5] libsoup: arbitrary code execution

Arch Linux Security Advisory ASA-201708-5 ========================================= Severity: Critical Date : 2017-08-10 CVE-ID : CVE-2017-2885 Package : libsoup Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-376 Summary ======= The package libsoup before...

[ASA-201702-9] webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-201702-9 ========================================= Severity: Critical Date : 2017-02-11 CVE-ID : CVE-2017-2350 CVE-2017-2354 CVE-2017-2355 CVE-2017-2356 CVE-2017-2362 CVE-2017-2363 CVE-2017-2364 CVE-2017-2365 CVE-2017-2366 CVE-2017-2369 CVE-2017-2371 CVE-2017-2373...

[ASA-201701-13] icoutils: arbitrary code execution

Arch Linux Security Advisory ASA-201701-13 ========================================== Severity: High Date : 2017-01-09 CVE-ID : CVE-2017-5208 Package : icoutils Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-129 Summary ======= The package icoutils before...

[ASA-201610-6] imagemagick: multiple issues

Arch Linux Security Advisory ASA-201610-6 ========================================= Severity: High Date : 2016-10-08 CVE-ID : CVE-2016-7799 CVE-2016-7906 Package : imagemagick Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package imagemagi...

lib32-flashplugin: multiple issues

CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132, CVE-2016-4133, CVE-2016-4134, CVE-2016-4137, CVE-2016-4141, CVE-2016-4150, CVE-2016-4151, CVE-2016-4152, CVE-2016-4153, CVE-2016-4154,...

lib32-glibc: denial of service

clntudpcall allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack frame overflow denial of...

nginx-mainline: denial of service

A vulnerability was found in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while handling the client request body...

imlib2: multiple issues

CVE-2011-5326 denial of service Kevin Ryde discovered that attempting to draw a 2x1 radi ellipse results in a floating point exception. - CVE-2016-3993 information leakage Yuriy M. Kaminskiy discovered that drawing using coordinates from an untrusted source could lead to an out-of-bound memory...

jre8-openjdk: sandbox escape

It was discovered that the security fix for CVE-2013-5838 was incomplete and still allowed remote attackers to escape the Java security sandbox mechanism. The root problem is that the Reflection API does not properly guarantee type safety when Method Handle objects were invoked across two differe...

lib32-libssh2: man-in-the-middle

There is a bits/bytes confusion bug resulting in generation of a significantly short ephemeral secret for the diffie-hellman-group1 and diffie-hellman-group14 key exchange methods. The resulting secret is 128 bits long, instead of the recommended sizes of 1024 and 2048 bits respectively. There ar...

syncthing: information leakage

This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibly leak their RSA private key due to this issue. Other protocol implementations that create many RSA signatures could also be impacted in the same way. Specifically,...

phpmyadmin: content spoofing

This vulnerability allows an attacker to perform a content spoofing attack using the phpMyAdmin's redirection mechanism to external sites. This vulnerability is not considered to be critical since the spoofed content is escaped and no HTML injection is possible...

spice: multiple issues

CVE-2015-3247 race condition flaw: A race condition flaw was found in spice's workerupdatemonitorsconfig function, leading to a heap-based memory corruption. A user in a guest could leverage this flaw to crash the host QEMU-KVM process or, possibly, execute arbitrary code with the privileges of...

hostapd: denial of service

CVE-2015-4141 denial of service A vulnerability was found in the WPS UPnP function shared by hostapd WPS AP and wpasupplicant WPS external registrar. This may allow a possible denial of service attack through - CVE-2015-4142 denial of service A vulnerability was found in WMM Action frame...

bind: denial of service

CVE-2015-5722 Parsing malformed keys may cause BIND to exit due to a failed assertion in buffer.c: Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example...