chromium: multiple issues

CVE-2016-1696 cross-origin bypass: Cross-origin bypass in Extension bindings. Credit to anonymous. - CVE-2016-1697 cross-origin bypass: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2016-1698 information leakage: Information leak in Extension bindings. Credit to Rob Wu. -...

perl: improper input validation

Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint...

chromium: multiple issues

CVE-2015-8126: Buffer overflow vulnerabilities in functions pnggetPLTE/pngsetPLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bitdepth less than 8...

chromium: multiple issues

CVE-2015-6755 cross-origin bypass: Cross-origin bypass in Blink. Credit to Mariusz Mlynski. - CVE-2015-6756 use-after-free: Use-after-free in PDFium. - CVE-2015-6757 use-after-free: Use-after-free in ServiceWorker. Credit to Collin Payne. - CVE-2015-6758: Bad-cast in PDFium. Credit to Atte...

gnutls: denial of service

Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName DN entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version...

wordpress: multiple issues

CVE-2015-2213: SQL injection in comments ID. - CVE-2015-5730: Timing attack in widgets. - CVE-2015-5731: Denial of service by locking a post from being edited. - CVE-2015-5732, CVE-2015-5733 CVE-2015-5734: XSS...

libtasn1: arbitrary code execution

A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded input. A specially crafted, DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash or, possibly, execute arbitrary code. The he...

jre8-openjdk-headless: multiple issues

CVE-2005-1080 CVE-2015-0480 directory traversal A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted. - CVE-2015-0460...

firefox: multiple issues

CVE-2015-0819 tab spoofing: Mozilla developer Matthew Noorenberghe reported that whitelisted Mozilla domains could make UITour API calls while the UI Tour pages for Firefox are present in background tabs. If one of these Mozilla domains was compromised and open in another tab, an attacker could...

glibc: multiple issues

glibc has multiple issues including heap- and stack overflows that could be exploitable. The heap- and stack-overflow is possible in the swscanf function...

chromium: multiple issues

CVE-2015-1209 use-after-free Use-after-free in DOM, possibly leading to arbitrary code execution. Credit to Maksymillian Motyl. - CVE-2015-1210 cross-origin bypass Cross-origin-bypass in V8 bindings allows an attacker to bypass the same-origin policy. - CVE-2015-1211 privilege escalation...

jre8-openjdk-headless: multiple issues

CVE-2014-3566 man-in-the-middle Nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. - CVE-2014-6549 arbitrary code execution Incorrect class loader permission check in ClassLoader...

firefox: multiple issues

CVE-2014-1587: Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, and Max Jonas Werner reported memory safety problems and crashes that affect Firefox ESR 31.2 and Firefox 33. CVE-2014-1588: Christian Holler, Gary Kwong, Jon Coppeard, Eric Rahm, Byron Campen, Eric Rescorla, and Xidorn Quan...

[ASA-202410-1] oath-toolkit: privilege escalation

Arch Linux Security Advisory ASA-202410-1 ========================================= Severity: High Date : 2024-10-04 CVE-ID : CVE-2024-47191 Package : oath-toolkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2857 Summary ======= The package oath-toolkit befor...

[ASA-202203-1] postgresql: man-in-the-middle

Arch Linux Security Advisory ASA-202203-1 ========================================= Severity: High Date : 2022-03-25 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ======= The package postgresql before...

[ASA-202112-5] isync: arbitrary code execution

Arch Linux Security Advisory ASA-202112-5 ========================================= Severity: Medium Date : 2021-12-03 CVE-ID : CVE-2021-3657 CVE-2021-44143 Package : isync Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2579 Summary ======= The package isyn...

[ASA-202110-12] bind: denial of service

Arch Linux Security Advisory ASA-202110-12 ========================================== Severity: Medium Date : 2021-10-29 CVE-ID : CVE-2021-25219 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2502 Summary ======= The package bind before version...

[ASA-202011-3] wordpress: multiple issues

Arch Linux Security Advisory ASA-202011-3 ========================================= Severity: Critical Date : 2020-11-03 CVE-ID : CVE-2020-28032 CVE-2020-28033 CVE-2020-28034 CVE-2020-28035 CVE-2020-28036 CVE-2020-28037 CVE-2020-28038 CVE-2020-28039 CVE-2020-28040 Package : wordpress Type :...

[ASA-202006-8] python-django: multiple issues

Arch Linux Security Advisory ASA-202006-8 ========================================= Severity: Medium Date : 2020-06-06 CVE-ID : CVE-2020-13254 CVE-2020-13596 Package : python-django Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1176 Summary ======= The package...

[ASA-202004-8] firefox: multiple issues

Arch Linux Security Advisory ASA-202004-8 ========================================= Severity: Critical Date : 2020-04-08 CVE-ID : CVE-2020-6821 CVE-2020-6823 CVE-2020-6824 CVE-2020-6825 CVE-2020-6826 Package : firefox Type : multiple issues Remote : Yes Link :...

[ASA-202002-9] thunderbird: multiple issues

Arch Linux Security Advisory ASA-202002-9 ========================================= Severity: Critical Date : 2020-02-13 CVE-ID : CVE-2020-6792 CVE-2020-6793 CVE-2020-6794 CVE-2020-6795 CVE-2020-6798 CVE-2020-6800 Package : thunderbird Type : multiple issues Remote : Yes Link :...

[ASA-201910-6] unbound: denial of service

Arch Linux Security Advisory ASA-201910-6 ========================================= Severity: High Date : 2019-10-11 CVE-ID : CVE-2019-16866 Package : unbound Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1042 Summary ======= The package unbound before version...

[ASA-201909-2] firefox: multiple issues

Arch Linux Security Advisory ASA-201909-2 ========================================= Severity: High Date : 2019-09-04 CVE-ID : CVE-2019-5849 CVE-2019-9812 CVE-2019-11734 CVE-2019-11735 CVE-2019-11737 CVE-2019-11738 CVE-2019-11740 CVE-2019-11741 CVE-2019-11742 CVE-2019-11743 CVE-2019-11744...

[ASA-201905-16] curl: arbitrary code execution

Arch Linux Security Advisory ASA-201905-16 ========================================== Severity: High Date : 2019-05-31 CVE-ID : CVE-2019-5436 Package : curl Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-964 Summary ======= The package curl before version...

[ASA-201902-4] spice: arbitrary code execution

Arch Linux Security Advisory ASA-201902-4 ========================================= Severity: Critical Date : 2019-02-11 CVE-ID : CVE-2019-3813 Package : spice Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-866 Summary ======= The package spice before versi...

[ASA-201901-15] haproxy: denial of service

Arch Linux Security Advisory ASA-201901-15 ========================================== Severity: Medium Date : 2019-01-24 CVE-ID : CVE-2018-20102 CVE-2018-20103 Package : haproxy Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-836 Summary ======= The package haproxy...

[ASA-201901-3] elfutils: denial of service

Arch Linux Security Advisory ASA-201901-3 ========================================= Severity: Medium Date : 2019-01-08 CVE-ID : CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 Package : elfutils Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-785 Summary ======= The...

[ASA-201810-14] firefox: multiple issues

Arch Linux Security Advisory ASA-201810-14 ========================================== Severity: Critical Date : 2018-10-24 CVE-ID : CVE-2018-12388 CVE-2018-12390 CVE-2018-12392 CVE-2018-12395 CVE-2018-12396 CVE-2018-12397 CVE-2018-12398 CVE-2018-12399 CVE-2018-12401 CVE-2018-12402 CVE-2018-12403...

[ASA-201808-5] linux-lts: denial of service

Arch Linux Security Advisory ASA-201808-5 ========================================= Severity: High Date : 2018-08-08 CVE-ID : CVE-2018-5390 Package : linux-lts Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-748 Summary ======= The package linux-lts before version...

[ASA-201807-14] jenkins: multiple issues

Arch Linux Security Advisory ASA-201807-14 ========================================== Severity: High Date : 2018-07-21 CVE-ID : CVE-2018-1999001 CVE-2018-1999002 CVE-2018-1999003 CVE-2018-1999004 CVE-2018-1999005 CVE-2018-1999006 CVE-2018-1999007 Package : jenkins Type : multiple issues Remote :...

[ASA-201806-14] firefox: multiple issues

Arch Linux Security Advisory ASA-201806-14 ========================================== Severity: Critical Date : 2018-06-27 CVE-ID : CVE-2018-5186 CVE-2018-5187 CVE-2018-5188 CVE-2018-12356 CVE-2018-12358 CVE-2018-12359 CVE-2018-12360 CVE-2018-12361 CVE-2018-12362 CVE-2018-12363 CVE-2018-12364...

[ASA-201802-2] go: arbitrary code execution

Arch Linux Security Advisory ASA-201802-2 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6574 Package : go Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-606 Summary ======= The package go before version 1.9.4-1...

[ASA-201711-25] icu: arbitrary code execution

Arch Linux Security Advisory ASA-201711-25 ========================================== Severity: Critical Date : 2017-11-19 CVE-ID : CVE-2017-14952 Package : icu Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-504 Summary ======= The package icu before versio...

[ASA-201710-14] wireshark-cli: denial of service

Arch Linux Security Advisory ASA-201710-14 ========================================== Severity: Medium Date : 2017-10-12 CVE-ID : CVE-2017-15189 CVE-2017-15190 CVE-2017-15191 CVE-2017-15192 CVE-2017-15193 Package : wireshark-cli Type : denial of service Remote : Yes Link :...

[ASA-201706-9] wireshark-cli: denial of service

Arch Linux Security Advisory ASA-201706-9 ========================================= Severity: Low Date : 2017-06-12 CVE-ID : CVE-2017-9343 CVE-2017-9344 CVE-2017-9345 CVE-2017-9346 CVE-2017-9347 CVE-2017-9348 CVE-2017-9349 CVE-2017-9350 CVE-2017-9351 CVE-2017-9352 CVE-2017-9353 CVE-2017-9354...

[ASA-201701-26] python-crypto: arbitrary code execution

Arch Linux Security Advisory ASA-201701-26 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package...

wireshark-cli: denial of service

CVE-2016-6505 denial of service It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. - CVE-2016-6506 denial of service It may be possible to make Wireshark consume excessive CPU resources by...

libgcrypt: information disclosure

Felix Drre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the RNG can trivially predict the next 160 bits of output. This bug exists since 1998 in all GnuPG and...

glibc: denial of service

clntudpcall allocates a buffer, using alloca, to store the payload of an incoming socket error. If a malicious server floods the client with crafted ICMP and UDP packets, this can cause the client to allocate sufficiently many such temporary buffers to cause a stack frame overflow denial of...

quassel-core: denial of service

CVE-2016-4414 denial of service It was found that quasselcore is vulnerable to a denial of service attack by unauthenticated clients. The protocol negotiation did not take into account lack of a match, in which case PeerFactory::createPeer returns a nullptr, which is immediately dereferenced...

expat: arbitrary code execution

Multiple integer overflows in the XMLGetBuffer function in Expat through 2.1.0 allow remote attackers to cause a denial of service heap-based buffer overflow or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716...

lib32-glibc: multiple issues

CVE-2015-7547 arbitrary code execution A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the...

openssl: man-in-the-middle

CVE-2015-3197 man-in-the-middle A flaw was found in the way malicious SSL/TLS clients could negotiate SSLv2 ciphers that have been disabled on the server. This could result in weak SSLv2 ciphers being used for SSL/TLS connections, making them vulnerable to man-in-the-middle attacks. -...

miniupnpc: arbitrary code execution

An exploitable buffer overflow vulnerability exists in the XML parser functionality of the MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this...

firefox: cross-origin restriction bypass

Security researcher Abdulrahman Alqabandi reported that the fetch API did not correctly implement the Cross-Origin Resource Sharing CORS specification, allowing a malicious page to access private data from other origins. Mozilla developer Ben Kelly independently reported the same issue...

bugzilla: unauthorized account creation

Login names usually an email address longer than 127 characters are silently truncated in MySQL which could cause the domain name of the email address to be corrupted. An attacker could use this vulnerability to create an account with an email address different from the one originally requested...

wordpress: multiple issues

CVE-2015-5714 cross-side scripting A cross-site scripting vulnerability has been discovered when processing shortcode tags. - CVE-2015-5715 permission bypass It has been discovered that users without proper permissions could publish private posts and make them sticky...

mariadb-clients: denial of service

A heap-based buffer overflow was found in the way PCRE handled certain malformed regular expressions. This issue could cause a crash while parsing malicious regular expressions related to an assertion that allows zero repeats...

cpio: directory traversal

It was reported that cpio is vulnerable to a directory traversal vulnerability when using the --no-absolute-filenames option. While extracting an archive, it will extract symlinks and then follow them if they are referenced in further entries. This can be exploited by a rogue archive to write to...

xorg-server: information leak and denial of service

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the...