nghttp2: use-after-free

nghttp2 1.6.0 fixes a heap-based use-after-free bug in idle stream handling code, where an idle/closed stream could possibly be destroyed while it was still referenced...

chromium: information leakage

The PDF viewer does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and outofprocessinstance.cc...

vorbis-tools: denial of service

Buffer overflow in the aiffopen function in oggenc/audio.c allows local attackers to cause a denial of service crash via a crafted AIFF file...

jasper: denial of service

A double free issue has been discovered in the function jasperimagestopload. This vulnerability can be triggered by loading a specially crafted image through jasper...

aircrack-ng: multiple vulnerabilities

Nick Sampanis discovered the following vulnerabilities: - CVE-2014-8321 code execution and privilege escalation A stack overflow at airodump-ng gpstracker which may lead to code execution and privilege escalation. - CVE-2014-8322 remote code execution A length parameter inconsistency at aireplay...

[ASA-202112-10] gitlab: multiple issues

Arch Linux Security Advisory ASA-202112-10 ========================================== Severity: High Date : 2021-12-11 CVE-ID : CVE-2021-39910 CVE-2021-39915 CVE-2021-39917 CVE-2021-39919 CVE-2021-39931 CVE-2021-39932 CVE-2021-39933 CVE-2021-39934 CVE-2021-39935 CVE-2021-39936 CVE-2021-39937...

[ASA-202111-6] grafana: access restriction bypass

Arch Linux Security Advisory ASA-202111-6 ========================================= Severity: Medium Date : 2021-11-18 CVE-ID : CVE-2021-41244 Package : grafana Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-2559 Summary ======= The package grafana before...

[ASA-202010-7] kdeconnect: arbitrary code execution

Arch Linux Security Advisory ASA-202010-7 ========================================= Severity: High Date : 2020-10-18 CVE-ID : CVE-2020-26164 Package : kdeconnect Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1241 Summary ======= The package kdeconnect befo...

[ASA-202007-3] tcpreplay: information disclosure

Arch Linux Security Advisory ASA-202007-3 ========================================= Severity: Medium Date : 2020-07-31 CVE-ID : CVE-2020-12740 Package : tcpreplay Type : information disclosure Remote : No Link : https://security.archlinux.org/AVG-1154 Summary ======= The package tcpreplay before...

[ASA-202006-2] gnutls: man-in-the-middle

Arch Linux Security Advisory ASA-202006-2 ========================================= Severity: High Date : 2020-06-06 CVE-ID : CVE-2020-13777 Package : gnutls Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-1177 Summary ======= The package gnutls before version...

[ASA-201908-1] chromium: multiple issues

Arch Linux Security Advisory ASA-201908-1 ========================================= Severity: High Date : 2019-08-02 CVE-ID : CVE-2019-5850 CVE-2019-5851 CVE-2019-5852 CVE-2019-5853 CVE-2019-5854 CVE-2019-5855 CVE-2019-5856 CVE-2019-5857 CVE-2019-5858 CVE-2019-5859 CVE-2019-5860 CVE-2019-5861...

[ASA-201907-5] squid: arbitrary code execution

Arch Linux Security Advisory ASA-201907-5 ========================================= Severity: Critical Date : 2019-07-17 CVE-ID : CVE-2019-12527 Package : squid Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1004 Summary ======= The package squid before...

[ASA-201906-11] chromium: arbitrary code execution

Arch Linux Security Advisory ASA-201906-11 ========================================== Severity: High Date : 2019-06-14 CVE-ID : CVE-2019-5842 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-981 Summary ======= The package chromium before...

[ASA-201905-17] live-media: multiple issues

Arch Linux Security Advisory ASA-201905-17 ========================================== Severity: Critical Date : 2019-05-31 CVE-ID : CVE-2019-7314 CVE-2019-7733 Package : live-media Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-870 Summary ======= The package...

[ASA-201901-12] matrix-synapse: private key recovery

Arch Linux Security Advisory ASA-201901-12 ========================================== Severity: High Date : 2019-01-24 CVE-ID : CVE-2019-5885 Package : matrix-synapse Type : private key recovery Remote : No Link : https://security.archlinux.org/AVG-846 Summary ======= The package matrix-synapse...

[ASA-201811-10] thunderbird: arbitrary code execution

Arch Linux Security Advisory ASA-201811-10 ========================================== Severity: Critical Date : 2018-11-06 CVE-ID : CVE-2018-12389 CVE-2018-12390 CVE-2018-12392 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-803 Summary...

[ASA-201807-11] znc: multiple issues

Arch Linux Security Advisory ASA-201807-11 ========================================== Severity: High Date : 2018-07-19 CVE-ID : CVE-2018-14055 CVE-2018-14056 Package : znc Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-737 Summary ======= The package znc before...

[ASA-201805-8] llpp: multiple issues

Arch Linux Security Advisory ASA-201805-8 ========================================= Severity: High Date : 2018-05-10 CVE-ID : CVE-2018-5686 CVE-2018-6187 CVE-2018-6192 CVE-2018-6544 CVE-2018-1000051 Package : llpp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-690...

[ASA-201801-28] mupdf-gl: arbitrary code execution

Arch Linux Security Advisory ASA-201801-28 ========================================== Severity: High Date : 2018-01-30 CVE-ID : CVE-2017-17858 Package : mupdf-gl Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-599 Summary ======= The package mupdf-gl before...

[ASA-201801-30] mupdf-tools: arbitrary code execution

Arch Linux Security Advisory ASA-201801-30 ========================================== Severity: High Date : 2018-01-30 CVE-ID : CVE-2017-17858 Package : mupdf-tools Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-599 Summary ======= The package mupdf-tools...

[ASA-201801-25] lib32-libcurl-gnutls: multiple issues

Arch Linux Security Advisory ASA-201801-25 ========================================== Severity: Medium Date : 2018-01-29 CVE-ID : CVE-2018-1000005 CVE-2018-1000007 Package : lib32-libcurl-gnutls Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-597 Summary ======= The...

[ASA-201712-1] samba: multiple issues

Arch Linux Security Advisory ASA-201712-1 ========================================= Severity: High Date : 2017-12-02 CVE-ID : CVE-2017-14746 CVE-2017-15275 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-535 Summary ======= The package samba before...

[ASA-201711-29] varnish: information disclosure

Arch Linux Security Advisory ASA-201711-29 ========================================== Severity: Medium Date : 2017-11-26 CVE-ID : CVE-2017-8807 Package : varnish Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-502 Summary ======= The package varnish before...

[ASA-201710-20] flashplugin: arbitrary code execution

Arch Linux Security Advisory ASA-201710-20 ========================================== Severity: Critical Date : 2017-10-16 CVE-ID : CVE-2017-11292 Package : flashplugin Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-449 Summary ======= The package flashplug...

[ASA-201709-8] linux-lts: arbitrary code execution

Arch Linux Security Advisory ASA-201709-8 ========================================= Severity: High Date : 2017-09-14 CVE-ID : CVE-2017-1000251 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-393 Summary ======= The package linux-lts befor...

[ASA-201708-11] xorg-server: multiple issues

Arch Linux Security Advisory ASA-201708-11 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-10971 CVE-2017-10972 Package : xorg-server Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-341 Summary ======= The package...

[ASA-201706-35] libnl: privilege escalation

Arch Linux Security Advisory ASA-201706-35 ========================================== Severity: Medium Date : 2017-06-28 CVE-ID : CVE-2017-0553 Package : libnl Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-292 Summary ======= The package libnl before version...

[ASA-201706-33] poppler: arbitrary code execution

Arch Linux Security Advisory ASA-201706-33 ========================================== Severity: High Date : 2017-06-26 CVE-ID : CVE-2017-9775 CVE-2017-9776 Package : poppler Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-326 Summary ======= The package...

[ASA-201706-2] freeradius: authentication bypass

Arch Linux Security Advisory ASA-201706-2 ========================================= Severity: High Date : 2017-06-02 CVE-ID : CVE-2017-9148 Package : freeradius Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-281 Summary ======= The package freeradius before...

[ASA-201705-14] git: access restriction bypass

Arch Linux Security Advisory ASA-201705-14 ========================================== Severity: High Date : 2017-05-12 CVE-ID : CVE-2017-8386 Package : git Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-267 Summary ======= The package git before version...

[ASA-201705-12] kauth: privilege escalation

Arch Linux Security Advisory ASA-201705-12 ========================================== Severity: High Date : 2017-05-10 CVE-ID : CVE-2017-8422 Package : kauth Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-269 Summary ======= The package kauth before version...

[ASA-201705-3] ghostscript: arbitrary command execution

Arch Linux Security Advisory ASA-201705-3 ========================================= Severity: High Date : 2017-05-07 CVE-ID : CVE-2017-8291 Package : ghostscript Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-256 Summary ======= The package ghostscript...

[ASA-201702-11] kdenetwork-kopete: content spoofing

Arch Linux Security Advisory ASA-201702-11 ========================================== Severity: Medium Date : 2017-02-12 CVE-ID : CVE-2017-5593 Package : kdenetwork-kopete Type : content spoofing Remote : Yes Link : https://security.archlinux.org/AVG-173 Summary ======= The package...

[ASA-201701-40] thunderbird: multiple issues

Arch Linux Security Advisory ASA-201701-40 ========================================== Severity: Critical Date : 2017-01-29 CVE-ID : CVE-2017-5373 CVE-2017-5375 CVE-2017-5376 CVE-2017-5378 CVE-2017-5380 CVE-2017-5383 CVE-2017-5390 CVE-2017-5396 Package : thunderbird Type : multiple issues Remote :...

[ASA-201701-29] powerdns: multiple issues

Arch Linux Security Advisory ASA-201701-29 ========================================== Severity: Medium Date : 2017-01-19 CVE-ID : CVE-2016-2120 CVE-2016-7068 CVE-2016-7072 CVE-2016-7073 CVE-2016-7074 Package : powerdns Type : multiple issues Remote : Yes Link :...

thunderbird: arbitrary code execution

CVE-2016-2835 arbitrary code execution Carsten Book, Christian Holler, Gary Kwong, Jesse Ruderman, Andrew McCreight, Phil Ringnalda and Philipp reported memory safety problems and crashes. - CVE-2016-2836 arbitrary code execution Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, and...

lib32-flashplugin: multiple issues

CVE-2016-4175 CVE-2016-4179 CVE-2016-4180 CVE-2016-4181 CVE-2016-4182 CVE-2016-4183 CVE-2016-4184 CVE-2016-4185 CVE-2016-4186 CVE-2016-4187 CVE-2016-4188 CVE-2016-4189 CVE-2016-4190 CVE-2016-4217 CVE-2016-4218 CVE-2016-4219 CVE-2016-4220 CVE-2016-4221 CVE-2016-4233 CVE-2016-4234 CVE-2016-4235...

libdwarf: arbitrary code execution

CVE-2016-5027 denial of service Multiple NULL pointer dereference issues in several functions of libdwarf/dwarfleb.c, where leb128length was wrongly assumed non-NULL. - CVE-2016-5028 denial of service NULL pointer dereference issue in printframeinstbytes. - CVE-2016-5029 denial of service NULL...

libtasn1: denial of service

The libtasn1 library, in its 4.7 version, can loop for a long time or indefinitely when it is used to parse DER representations of X.509 certificates, leading to a denial of service. Some of these loops may in addition increase heap or stack usage, leading to more issues...

blueman: privilege escalation

A local privilege escalation vulnerability has been found in the Network::EnableNetwork method of blueman. An unsanitized string is received over DBUS into the dhcphandler parameter and passed to eval, thus allowing arbitrary command execution with the privileges of the user running blueman...

claws-mail: buffer overflow

A remotely triggerable buffer overflow has been found in the code of claws-mail handling character conversion, in functions convjistoeuc, conveuctojis and convsjistoeuc, in codeconv.c. There was no bounds checking on buffers passed to these functions, some stack-based but other potentially...

wesnoth: information leakage

Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function filesystem::getwmllocation to resolve file paths so that only...

webkitgtk2: man-in-the-middle

It was found that WebKitGTK+ version performed TLS certificate verification too late, after sending an HTTP request rather than before. This issue allows a man-in-the-middle attack to possibly gain sensitive information...

samba: privilege elevation

Samba's Active Directory Domain Controller AD DC allows the administrator to delegate creation of user or computer accounts to specific users or groups. Samba's AD DC did not implement the additional required check on the UFSERVERTRUSTACCOUNT bit in the userAccountControl attributes. Most Samba...

glibc: command execution

The wordexp function could ignore the WRDENOCMD flag under certain input conditions resulting in the execution of a shell for command substitution when the application did not request it. The implementation now checks WRDENOCMD immediately before executing the shell and returns the error WRDECMDS...

[ASA-202505-10] python-django: denial of service

Arch Linux Security Advisory ASA-202505-10 ========================================== Severity: Medium Date : 2025-05-19 CVE-ID : CVE-2025-32873 Package : python-django Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2876 Summary ======= The package python-django...

[ASA-202505-3] webkit2gtk: arbitrary code execution

Arch Linux Security Advisory ASA-202505-3 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2023-42875 CVE-2023-42970 Package : webkit2gtk Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-2869 Summary ======= The package...

[ASA-202505-7] nodejs-lts-jod: denial of service

Arch Linux Security Advisory ASA-202505-7 ========================================= Severity: High Date : 2025-05-18 CVE-ID : CVE-2025-23165 CVE-2025-23166 Package : nodejs-lts-jod Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2872 Summary ======= The package...

[ASA-202006-14] imagemagick: information disclosure

Arch Linux Security Advisory ASA-202006-14 ========================================== Severity: Medium Date : 2020-06-28 CVE-ID : CVE-2020-13902 Package : imagemagick Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-1181 Summary ======= The package imagemagick...

[ASA-202004-18] openssl: denial of service

Arch Linux Security Advisory ASA-202004-18 ========================================== Severity: High Date : 2020-04-21 CVE-ID : CVE-2020-1967 Package : openssl Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1139 Summary ======= The package openssl before version...