[ASA-201903-9] libelf: denial of service

Arch Linux Security Advisory ASA-201903-9 ========================================= Severity: Medium Date : 2019-03-18 CVE-ID : CVE-2019-7148 CVE-2019-7149 CVE-2019-7150 CVE-2019-7664 CVE-2019-7665 Package : libelf Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-86...

[ASA-201903-4] pcre: denial of service

Arch Linux Security Advisory ASA-201903-4 ========================================= Severity: Low Date : 2019-03-03 CVE-ID : CVE-2017-11164 Package : pcre Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-351 Summary ======= The package pcre before version 8.43-1 is...

[ASA-201810-13] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201810-13 ========================================== Severity: Critical Date : 2018-10-18 CVE-ID : CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12383 CVE-2018-12385 Package : thunderbird Type : multiple issues Remote : Yes Link :...

[ASA-201805-8] llpp: multiple issues

Arch Linux Security Advisory ASA-201805-8 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : llpp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-690...

[ASA-201805-6] libmupdf: multiple issues

Arch Linux Security Advisory ASA-201805-6 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : libmupdf Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-6...

[ASA-201804-2] openssl: multiple issues

Arch Linux Security Advisory ASA-201804-2 ========================================= Severity: Medium Date : 2018-04-01 CVE-ID : CVE-2017-3738 CVE-2018-0739 Package : openssl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-540 Summary ======= The package openssl befor...

[ASA-201802-3] go-pie: arbitrary code execution

Arch Linux Security Advisory ASA-201802-3 ========================================= Severity: High Date : 2018-02-09 CVE-ID : CVE-2018-6574 Package : go-pie Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-606 Summary ======= The package go-pie before version...

[ASA-201801-28] mupdf-gl: arbitrary code execution

Arch Linux Security Advisory ASA-201801-28 ========================================== Severity: High Date : 2018-01-30 CVE-ID : CVE-2017-17858 Package : mupdf-gl Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-599 Summary ======= The package mupdf-gl before...

[ASA-201711-32] exim: multiple issues

Arch Linux Security Advisory ASA-201711-32 ========================================== Severity: Critical Date : 2017-11-30 CVE-ID : CVE-2017-1000369 CVE-2017-10140 CVE-2017-16943 CVE-2017-16944 Package : exim Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-518 Summar...

[ASA-201710-19] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201710-19 ========================================== Severity: Critical Date : 2017-10-12 CVE-ID : CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818 CVE-2017-7819 CVE-2017-7823 CVE-2017-7824 Package : thunderbird Type : multiple issues Remote :...

[ASA-201710-11] lame: denial of service

Arch Linux Security Advisory ASA-201710-11 ========================================== Severity: Low Date : 2017-10-09 CVE-ID : CVE-2017-15018 Package : lame Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-437 Summary ======= The package lame before version 3.99.5-4 ...

[ASA-201710-1] dnsmasq: multiple issues

Arch Linux Security Advisory ASA-201710-1 ========================================= Severity: Critical Date : 2017-10-02 CVE-ID : CVE-2017-14491 CVE-2017-14492 CVE-2017-14493 CVE-2017-14494 CVE-2017-14495 CVE-2017-14496 Package : dnsmasq Type : multiple issues Remote : Yes Link :...

[ASA-201709-3] bluez: information disclosure

Arch Linux Security Advisory ASA-201709-3 ========================================= Severity: High Date : 2017-09-12 CVE-ID : CVE-2017-1000250 Package : bluez Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-396 Summary ======= The package bluez before version...

[ASA-201708-16] curl: information disclosure

Arch Linux Security Advisory ASA-201708-16 ========================================== Severity: Medium Date : 2017-08-22 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000101 Package : curl Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-370 Summary...

[ASA-201708-13] strongswan: denial of service

Arch Linux Security Advisory ASA-201708-13 ========================================== Severity: Low Date : 2017-08-14 CVE-ID : CVE-2017-11185 Package : strongswan Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-382 Summary ======= The package strongswan before...

[ASA-201708-10] libytnef: arbitrary code execution

Arch Linux Security Advisory ASA-201708-10 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-9058 Package : libytnef Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-275 Summary ======= The package libytnef before...

[ASA-201707-29] chromium: multiple issues

Arch Linux Security Advisory ASA-201707-29 ========================================== Severity: Critical Date : 2017-07-27 CVE-ID : CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094 CVE-2017-5095 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099 CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-51...

[ASA-201707-14] evince: arbitrary command execution

Arch Linux Security Advisory ASA-201707-14 ========================================== Severity: Critical Date : 2017-07-14 CVE-ID : CVE-2017-1000083 Package : evince Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-348 Summary ======= The package evince...

[ASA-201706-18] bind: denial of service

Arch Linux Security Advisory ASA-201706-18 ========================================== Severity: Medium Date : 2017-06-15 CVE-ID : CVE-2017-3140 Package : bind Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-301 Summary ======= The package bind before version...

[ASA-201705-12] kauth: privilege escalation

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version...

[ASA-201705-10] lib32-freetype2: arbitrary code execution

Arch Linux Security Advisory ASA-201705-10 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8105 CVE-2017-8287 Package : lib32-freetype2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-258 Summary ======= The...

[ASA-201703-9] jasper: multiple issues

Arch Linux Security Advisory ASA-201703-9 ========================================= Severity: High Date : 2017-03-14 CVE-ID : CVE-2016-8886 CVE-2016-9591 Package : jasper Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-69 Summary ======= The package jasper before...

[ASA-201701-23] nginx: privilege escalation

Arch Linux Security Advisory ASA-201701-23 ========================================== Severity: High Date : 2017-01-15 CVE-ID : CVE-2016-1247 Package : nginx Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-138 Summary ======= The package nginx before version...

[ASA-201610-10] guile: multiple issues

Arch Linux Security Advisory ASA-201610-10 ========================================== Severity: High Date : 2016-10-16 CVE-ID : CVE-2016-8605 CVE-2016-8606 Package : guile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package guile before...

chromium: multiple issues

CVE-2016-5139 arbitrary code execution Multiple integer overflows in the opjtcdinittile function in tcd.c in OpenJPEG, as used in PDFium, allow remote attackers to cause a denial of service heap-based buffer overflow or possibly have other unspecified impact via crafted JPEG 2000 data. -...

libndp: man-in-the-middle

Libndp before version 1.6 does properly validate and check the origin of Neighbor Discovery Protocol NDP messages. An attacker on a non-local network can exploit this flaw to advertise a node as a router, which allows them to re-route the traffic through an attacker-controlled node...

libksba: denial of service

An out-of-bound read access due to incorrect utf-8 strings handling has been in found in the ksbadntostr function. This issue is due to an incomplete fix for CVE-2016-4356, caused by an off-by-one error when handling incorrect utf-8 strings...

latex2rtf: arbitrary code execution

A format string vulnerability was found in the CmdKeywords function, where the user-controlled variable 'keywords' is passed as a format argument to vnsprintf, when processing the \keywords command in a TeX file...

libgcrypt: secret key extraction

A vulnerability was found in a way the ECDH encryption algorithm decrypts data. An attacker with a specialized setup can extract the secret decryption key from a target located in an adjacent room within seconds. This is done by measuring the target's electromagnetic emanations...

nghttp2: denial of service

HTTP/2 uses HPACK to compress header fields. The basic idea is that HTTP header field is stored in the receiver with the numeric index number. The memory used by this storage is tightly constrained, and it is 4KiB by default. When sender sends the same header field, it just sends the correspondin...

python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

bind: denial of service

CVE-2015-8704 denial of service A buffer size check used to guard against overflow could cause named to exit with an INSIST failure In apl42.c. A server could exit while performing certain string formatting operations. Examples include but may not be limited to: 1 Slaves using text-format db...

putty: arbitrary code execution

A potential memory-corrupting integer overflow has been discovered in the handling of the ECH erase characters control sequence in the terminal emulator. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal...

flashplugin: multiple issues

CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 arbitrary code execution It has been discovered that multiple use-after-free...

vorbis-tools: denial of service

Buffer overflow in the aiffopen function in oggenc/audio.c allows local attackers to cause a denial of service crash via a crafted AIFF file...

chromium: cross-origin bypass

CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski...

libuser: multiple issues

CVE-2015-3245 denial of service It was found that libuser, as used by the chfn userhelper functionality, did not properly filter out newline characters in GECOS fields. A local, authenticated user could use this flaw to corrupt the /etc/passwd file, resulting in a denial-of-service on the system...

firefox: arbitrary code execution

Mozilla developer Robert Kaiser reported that a specially crafted HTML, when loaded by the target user, will trigger a use-after-free race condition when a plugin fails to initialize, which may lead to a memory corruption error in AsyncPaintWaitEvent::AsyncPaintWaitEvent and arbitrary code...

tcpdump: denial of service

A vulnerability was discovered in print-wb.c that is leading to a segmentation fault triggered through feeding into tcpdump a crafted packet, either from a live network interface or from a .pcap file...

icecast: denial of service

CVE-2015-3026 denial of service: The bug can only be triggered if "streamauth" is being used. This means, that all installations that use a default configuration are NOT affected.The default configuration only uses source-password. Neither are simple mountpoints affected that use password. A...

subversion: denial of service

CVE-2014-3580 denial of service A NULL pointer dereference flaw was found in the way moddavsvn handled REPORT requests. A remote, unauthenticated attacker could use a crafted REPORT request to crash moddavsvn. - CVE-2014-8108 denial of service A NULL pointer dereference flaw was found in the way...

graphviz: format string vulnerability

A format string vulnerability has been found in the error reporting part of the parser used by graphviz...

binutils: multiple issues

CVE-2014-8484 invalid read Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 out-of-bounds write Lack of range checking leading to controlled write in bfdelfsetupsections which results in denial of service or possible code...

wget: arbitrary filesystem access

It was found that wget was susceptible to a symlink attack which could create arbitrary files, directories or symbolic links and set their permissions when retrieving a directory recursively through FTP. By default, when retrieving ftp directories recursively and a symbolic link is encountered, t...

rsyslog: remote denial of service

Sending a syslog message containing an invalid PRI value to a vulnerable rsyslog server accepting remote message will trigger a denial of service by crashing the rsyslog process...

[ASA-202505-8] nodejs-lts-iron: multiple issues

Arch Linux Security Advisory ASA-202505-8 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2025-23165 CVE-2025-23166 CVE-2025-23167 Package : nodejs-lts-iron Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2873 Summary ======= T...

[ASA-202111-5] grafana: cross-site scripting

Arch Linux Security Advisory ASA-202111-5 ========================================= Severity: Medium Date : 2021-11-05 CVE-ID : CVE-2021-41174 Package : grafana Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2517 Summary ======= The package grafana before versi...

[ASA-202010-5] lua: arbitrary code execution

Arch Linux Security Advisory ASA-202010-5 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-15888 CVE-2020-15889 Package : lua Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1207 Summary ======= The package lua...

[ASA-202007-3] tcpreplay: information disclosure

Arch Linux Security Advisory ASA-202007-3 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-12740 Package : tcpreplay Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1154 Summary ======= The package tcpreplay before...

[ASA-202005-10] powerdns-recursor: multiple issues

Arch Linux Security Advisory ASA-202005-10 ========================================== Severity: Medium Date : 2020-05-19 CVE-ID : CVE-2020-10995 CVE-2020-12244 Package : powerdns-recursor Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1163 Summary ======= The packag...