[ASA-201810-13] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201810-13 ========================================== Severity: Critical Date : 2018-10-18 CVE-ID : CVE-2018-12376 CVE-2018-12377 CVE-2018-12378 CVE-2018-12379 CVE-2018-12383 CVE-2018-12385 Package : thunderbird Type : multiple issues Remote : Yes Link :...

[ASA-201806-3] krb5: insufficient validation

Arch Linux Security Advisory ASA-201806-3 ========================================= Severity: Medium Date : 2018-06-05 CVE-ID : CVE-2018-5729 CVE-2018-5730 Package : krb5 Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-586 Summary ======= The package krb5...

[ASA-201805-22] wireshark-gtk: multiple issues

Arch Linux Security Advisory ASA-201805-22 ========================================== Severity: Critical Date : 2018-05-25 CVE-ID : CVE-2018-11354 CVE-2018-11355 CVE-2018-11356 CVE-2018-11357 CVE-2018-11358 CVE-2018-11359 CVE-2018-11360 CVE-2018-11361 CVE-2018-11362 Package : wireshark-gtk Type :...

[ASA-201805-15] lib32-libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201805-15 ========================================== Severity: Critical Date : 2018-05-18 CVE-ID : CVE-2018-1000300 CVE-2018-1000301 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-696 Summary ======= Th...

[ASA-201803-22] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201803-22 ========================================== Severity: Critical Date : 2018-03-24 CVE-ID : CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5144 CVE-2018-5145 CVE-2018-5146 Package : thunderbird Type : multiple issues Remote : Yes Link :...

[ASA-201803-15] curl: multiple issues

Arch Linux Security Advisory ASA-201803-15 ========================================== Severity: Medium Date : 2018-03-19 CVE-ID : CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 Package : curl Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-653 Summary ======= The...

[ASA-201711-30] powerdns: access restriction bypass

Arch Linux Security Advisory ASA-201711-30 ========================================== Severity: Low Date : 2017-11-27 CVE-ID : CVE-2017-15091 Package : powerdns Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-519 Summary ======= The package powerdns before...

[ASA-201709-19] chromium: arbitrary code execution

Arch Linux Security Advisory ASA-201709-19 ========================================== Severity: Critical Date : 2017-09-23 CVE-ID : CVE-2017-5121 CVE-2017-5122 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-411 Summary ======= The package...

[ASA-201709-4] linux-hardened: arbitrary code execution

Arch Linux Security Advisory ASA-201709-4 ========================================= Severity: High Date : 2017-09-13 CVE-ID : CVE-2017-1000251 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-395 Summary ======= The package...

[ASA-201707-29] chromium: multiple issues

Arch Linux Security Advisory ASA-201707-29 ========================================== Severity: Critical Date : 2017-07-27 CVE-ID : CVE-2017-5091 CVE-2017-5092 CVE-2017-5093 CVE-2017-5094 CVE-2017-5095 CVE-2017-5097 CVE-2017-5098 CVE-2017-5099 CVE-2017-5100 CVE-2017-5101 CVE-2017-5102 CVE-2017-51...

[ASA-201706-16] kmail: information disclosure

Arch Linux Security Advisory ASA-201706-16 ========================================== Severity: Medium Date : 2017-06-14 CVE-ID : CVE-2017-9604 Package : kmail Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-299 Summary ======= The package kmail before version...

[ASA-201705-25] sudo: access restriction bypass

Arch Linux Security Advisory ASA-201705-25 ========================================== Severity: Medium Date : 2017-05-30 CVE-ID : CVE-2017-1000367 Package : sudo Type : access restriction bypass Remote : No Link : https://security.archlinux.org/AVG-282 Summary ======= The package sudo before...

[ASA-201705-18] libplist: multiple issues

Arch Linux Security Advisory ASA-201705-18 ========================================== Severity: High Date : 2017-05-16 CVE-ID : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437 CVE-2017-6438 CVE-2017-6439 CVE-2017-6440 Package :...

[ASA-201705-8] flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201705-8 ========================================= Severity: Critical Date : 2017-05-09 CVE-ID : CVE-2017-3068 CVE-2017-3069 CVE-2017-3070 CVE-2017-3071 CVE-2017-3072 CVE-2017-3073 CVE-2017-3074 Package : flashplugin Type : arbitrary code execution Remote : Yes Li...

[ASA-201704-8] jenkins: multiple issues

Arch Linux Security Advisory ASA-201704-8 ========================================= Severity: High Date : 2017-04-27 CVE-ID : CVE-2017-1000354 CVE-2017-1000355 CVE-2017-1000356 Package : jenkins Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-255 Summary ======= The...

[ASA-201701-25] python2-crypto: arbitrary code execution

Arch Linux Security Advisory ASA-201701-25 ========================================== Severity: Critical Date : 2017-01-15 CVE-ID : CVE-2013-7459 Package : python2-crypto Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-118 Summary ======= The package...

[ASA-201610-10] guile: multiple issues

Arch Linux Security Advisory ASA-201610-10 ========================================== Severity: High Date : 2016-10-16 CVE-ID : CVE-2016-8605 CVE-2016-8606 Package : guile Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package guile before...

libupnp: arbitrary filesystem access

A vulnerability was found in libupnp. If there's no registered handler for a POST or GET request, the default behavior is to write to or read from the filesystem. This allows an unauthenticated attacker to store or retrieve arbitrary data. This issue allows full host filesystem access if the...

glibc: denial of service

CVE-2016-3075 denial of service The getnetbyname implementation in nssdns contains a potentially unbounded alloca call in the form of a call to strdupa, leading to a stack overflow stack exhaustion and a crash if getnetbyname is invoked on a very long name. - CVE-2016-5417 denial of service The...

libreoffice-fresh: arbitrary code execution

A use after free vulnerability was found in the RTF parser of LibreOffice. The vulnerability lies in the parsing of documents containing both stylesheet and superscript tokens. A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an...

haproxy: denial of service

A problem has been discovered with the new field "ruledenystatus" into struct httptxn, which is filled only by actions "http-request deny" and "http-request tarpit". It's then used in the deny code path to emit the proper error message, but is used uninitialized when the deny comes from a "reqden...

webkit2gtk: arbitrary code execution

WebKitGTK+ allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, a different vulnerability than CVE-2016-1854, CVE-2016-1855, and CVE-2016-1856. Credit to Jeonghoon Shin at A.D.D and Liang Chen, Zhen Feng, wushi of KeenLab, Tencen...

python-django: permission bypass

If a ModelAdmin uses saveas=True not the default, the admin provides an option when editing objects to "Save as new". A regression in Django 1.9 prevented that form submission from raising a "Permission Denied" error for users without the "add" permission...

python2-rsa: signature forgery

The verify function in the RSA package for Python Python-RSA before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack...

roundcubemail: remote code execution

High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to execute arbitrary code and totally compromise the vulnerable server. The vulnerability exists du...

wordpress: cross-side scripting

A cross-site scripting vulnerability has been discovered that could allow a site to be compromised...

putty: arbitrary code execution

A potential memory-corrupting integer overflow has been discovered in the handling of the ECH erase characters control sequence in the terminal emulator. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal...

chromium: cross-origin bypass

CVE-2015-1303: Cross-origin bypass in DOM. Credit to Mariusz Mlynski. - CVE-2015-1304: Cross-origin bypass in V8. Credit to Mariusz Mlynski...

glibc: denial of service

It was found that the files backend of Name Service Switch NSS did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service...

crypto++: private key recovery

Evgeny Sidorov discovered that it is possible to recover the private key when using Rabin-Williams signatures due to a bad interaction with the blinding value used to mask private key operations. The bad interaction had to do with the random value not meeting certain Jacobi requirements, which...

e2fsprogs: arbitrary code execution

If corrupted file system didn't trip over some corruption check, and then the file system was modified via tune2fs or debugfs, such that the superblock was marked dirty and then written out via the closefs path, it's possible that the buffer overrun could be triggered when the file system is...

flashplugin: multiple issues

CVE-2014-0580 policy bypass A flaw allows remote attackers to bypass the same origin policy via unspecified vectors. - CVE-2014-0587 arbitrary code execution A flaw allows attackers to execute arbitrary code or cause a denial of service memory corruption via unspecified vectors. - CVE-2014-8443...

avr-binutils: multiple issues

CVE-2014-8484 invalid read Invalid read flaw leads to denial of service while parsing specially crafted files in programs using libbfd. - CVE-2014-8485 out-of-bounds write Lack of range checking leading to controlled write in bfdelfsetupsections which results in denial of service or possible code...

imagemagick: denial of service

Converting some specially crafted jpeg with convert could lead to a dos...

rsyslog: remote denial of service

Sending a syslog message containing an invalid PRI value to a vulnerable rsyslog server accepting remote message will trigger a denial of service by crashing the rsyslog process...

[ASA-202505-8] nodejs-lts-iron: multiple issues

Arch Linux Security Advisory ASA-202505-8 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2025-23165 CVE-2025-23166 CVE-2025-23167 Package : nodejs-lts-iron Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-2873 Summary ======= T...

[ASA-202111-5] grafana: cross-site scripting

Arch Linux Security Advisory ASA-202111-5 ========================================= Severity: Medium Date : 2021-11-05 CVE-ID : CVE-2021-41174 Package : grafana Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-2517 Summary ======= The package grafana before versi...

[ASA-202004-17] webkit2gtk: arbitrary code execution

Arch Linux Security Advisory ASA-202004-17 ========================================== Severity: Critical Date : 2020-04-19 CVE-ID : CVE-2020-11793 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1137 Summary ======= The package webkit2gt...

[ASA-202003-7] mbedtls: private key recovery

Arch Linux Security Advisory ASA-202003-7 ========================================= Severity: High Date : 2020-03-11 CVE-ID : CVE-2019-18222 Package : mbedtls Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-1104 Summary ======= The package mbedtls before version...

[ASA-202002-13] opensmtpd: arbitrary command execution

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtp...

[ASA-202001-7] salt: arbitrary command execution

Arch Linux Security Advisory ASA-202001-7 ========================================= Severity: Medium Date : 2020-01-29 CVE-ID : CVE-2019-17361 Package : salt Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1087 Summary ======= The package salt before...

[ASA-202001-5] chromium: multiple issues

Arch Linux Security Advisory ASA-202001-5 ========================================= Severity: Critical Date : 2020-01-17 CVE-ID : CVE-2020-6378 CVE-2020-6379 CVE-2020-6380 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1088 Summary ======= The...

[ASA-201904-12] chromium: multiple issues

Arch Linux Security Advisory ASA-201904-12 ========================================== Severity: Critical Date : 2019-04-24 CVE-ID : CVE-2019-5805 CVE-2019-5806 CVE-2019-5807 CVE-2019-5808 CVE-2019-5809 CVE-2019-5810 CVE-2019-5811 CVE-2019-5813 CVE-2019-5814 CVE-2019-5815 CVE-2019-5818 CVE-2019-58...

[ASA-201901-1] tar: denial of service

Arch Linux Security Advisory ASA-201901-1 ========================================= Severity: Low Date : 2019-01-08 CVE-ID : CVE-2018-20482 Package : tar Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-841 Summary ======= The package tar before version 1.31-1 is...

[ASA-201810-4] lib32-libxml2: denial of service

Arch Linux Security Advisory ASA-201810-4 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-9251 Package : lib32-libxml2 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-673 Summary ======= The package lib32-libxml2 befor...

[ASA-201809-5] mediawiki: multiple issues

Arch Linux Security Advisory ASA-201809-5 ========================================= Severity: Medium Date : 2018-09-25 CVE-ID : CVE-2018-0503 CVE-2018-0505 CVE-2018-13258 Package : mediawiki Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-765 Summary ======= The...

[ASA-201801-9] glibc: multiple issues

Arch Linux Security Advisory ASA-201801-9 ========================================= Severity: High Date : 2018-01-10 CVE-ID : CVE-2017-15670 CVE-2017-15671 Package : glibc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-460 Summary ======= The package glibc before...

[ASA-201710-34] wget: multiple issues

Arch Linux Security Advisory ASA-201710-34 ========================================== Severity: Critical Date : 2017-10-29 CVE-ID : CVE-2017-13089 CVE-2017-13090 CVE-2017-6508 Package : wget Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-473 Summary ======= The...

[ASA-201710-6] lib32-libcurl-compat: multiple issues

Arch Linux Security Advisory ASA-201710-6 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : lib32-libcurl-compat Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-388 Summa...

[ASA-201710-5] libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201710-5 ========================================= Severity: Medium Date : 2017-10-05 CVE-ID : CVE-2017-1000099 CVE-2017-1000100 CVE-2017-1000254 Package : libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-387 Summary...