Freenet: Deanonymization Vulnerability

Background Freenet is an encrypted network without censorship. Description A vulnerability has been discovered in Freenet. Please review the CVE identifier referenced below for details. Impact This release fixes as an XSS vulnerability that may allow an attacker to deanonymize the user. Workaroun...

Tor: Multiple Vulnerabilities

Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Multiple vulnerabilities have been discovered in Tor. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...

haveged: Privilege escalation

Background haveged is a simple entropy daemon using the HAVEGE algorithm. Description A vulnerability has been discovered in haveged. Please review the CVE identifier referenced below for details. Impact Root privilege escalation may be achieved by an attacker. Workaround There is no known...

GPL Ghostscript: Multiple Vulnerabilities

Background Ghostscript is an interpreter for the PostScript language and for PDF. Description Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workarou...

openh264: Heap Overflow

Background OpenH264 is a codec library which supports H.264 encoding and decoding. It is suitable for use in real time applications such as WebRTC. Description A vulnerability has been discovered in openh264. Please review the CVE identifiers referenced below for details. Impact A vulnerability i...

GStreamer, GStreamer Plugins: Multiple Vulnerabilities

Background GStreamer is an open source multimedia framework. Description Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There...

Atop: Heap Corruption

Background Atop is an ASCII full-screen performance monitor for Linux that is capable of reporting the activity of all processes even if processes have finished during the interval, daily logging of system and process activity for long-term analysis, highlighting overloaded system resources by...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

OpenDKIM: Root privilege escalation

Background A community effort to develop and maintain a C library for producing DKIM-aware applications and an open source milter for providing DKIM service. Description It was discovered that Gentoo’s OpenDKIM ebuild does not properly set permissions or place the pid file in a safe directory...

ImageMagick: Multiple vulnerabilities

Background Imagemagick is a collection of tools and libraries for many image formats. Description Multiple vulnerabilities have been discovered in ImageMagick including, but not limited to, various overflows and potential Denials of Service. Please visit the references and related bug reports for...

Trac: File upload vulnerability

Background Trac is a minimalistic web-based project management, wiki and bug tracking system including a Subversion interface. Description Stefan Esser of the Hardened-PHP project discovered that Trac fails to validate the "id" parameter when uploading attachments to the wiki or the bug tracking...

PHP: Memory disclosure and arbitrary location file upload

Background PHP is a general-purpose scripting language widely used to develop web-based applications. It can run inside a web server using the modphp module or the CGI version of PHP, or can run stand-alone in a CLI. Description Stefano Di Paola discovered two bugs in PHP. The first is a parse...

Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

needrestart: Multiple vulnerabilities

Background needrestart is a tool to restart daemons after library updates. Description Multiple vulnerabilities have been discovered in needrestart. Please review the CVE identifier referenced below for details. Impact An attacker could achieve root privilege escalation. Workaround There is no...

PAM: Multiple Vulnerabilities

Background PAM Pluggable Authentication Modules is an architecture allowing the separation of the development of privilege granting software from the development of secure and appropriate authentication schemes. Description Multiple vulnerabilities have been discovered in PAM. Please review the C...

UDisks, libblockdev: Privilege escalation

Background UDisks provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies. libblockdev is a library for manipulating block devices. Description Multiple vulnerabilities have been discovered in UDisks and libblockdev. Please review the CVE identifier...

pip: arbitrary configuration injection

Background pip is a tool for installing and managing Python packages. Description Multiple vulnerabilities have been discovered in pip. Please review the CVE identifiers referenced below for details. Impact When installing a package from a Mercurial VCS URL ie "pip install hg+...", the specified...

GIMP: Multiple Vulnerabilities

Background GIMP is the GNU Image Manipulation Program. XCF is the native image file format used by GIMP. Description Multiple vulnerabilities have been discovered in GIMP. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

rsync: Multiple Vulnerabilities

Background rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree. Description Multiple vulnerabilities have been discovered in rsync. Please review the CVE...

Mozilla Thunderbird: Multiple Vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

tmux: Null Pointer Dereference

Background tmux is a terminal multiplexer. Description A null pointer dereference issue was discovered in function windowpanesetevent in window.c in which allows attackers to cause denial of service or other unspecified impacts. Impact Manipulating tmux window state could result in a null pointer...

Stellarium: Arbitrary File Write

Background Stellarium is a free open source planetarium for your computer. It shows a realistic sky in 3D, just like what you see with the naked eye, binoculars or a telescope. Description A vulnerability has been discovered in Stellarium. Please review the CVE identifier referenced below for...

AMD64 x86 emulation GTK+ library: User-assisted execution of arbitrary code

Background Cairo is a 2D vector graphics library with cross-device output support. The AMD64 x86 emulation GTK+ library packages Cairo libraries for 32bit x86 emulation on AMD64. Description The Cairo versions used by the AMD64 x86 emulation GTK+ libraries were vulnerable to integer overflow...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is the next-generation web browser from the Mozilla project. Description The following vulnerabilities were found and fixed in Mozilla Firefox: "mozbugra4" and "shutdown" discovered that Firefox was improperly cloning base objects MFSA 2005-56. Michael Krax reported tha...

Cheetah: Untrusted module search path

Background Cheetah is a Python powered template engine and code generator. Description Brian Bird discovered that Cheetah searches for modules in the world-writable /tmp directory. Impact A malicious local user could place a module containing arbitrary code in /tmp, which when imported would run...

UnrealIRCd: Denial of service

Background UnrealIRCd is an Internet Relay Chat IRC daemon. Description A vulnerability has been discovered in UnrealIRCd. Please review the CVE identifier referenced below for details. Impact An attacker may be able to achieve denial of service. Workaround There is no known workaround at this...

Apache HTTPD: Multiple Vulnerabilities

Background The Apache HTTP server is one of the most popular web servers on the Internet. Description Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

FreeType: Multiple Vulnerabilities

Background FreeType is a software font engine that is designed to be small, efficient, highly customizable, and portable while capable of producing high-quality output glyph images. Description Multiple vulnerabilities have been discovered in FreeType. Please review the CVE identifiers referenced...

glibc: Multiple Vulnerabilities

Background glibc is a package that contains the GNU C library. Description Multiple vulnerabilities have been discovered in glibc. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workarou...

Spreadsheet-ParseExcel: Arbitrary Code Execution

Background Spreadsheet::ParseExcel is a perl module to extract information from Excel files. Description A vulnerability has been discovered in Spreadsheet::ParseExcel. Please review the CVE identifier referenced below for details. Impact Please review the referenced CVE identifier for details...

GPL Ghostscript: Multiple Vulnerabilities

Background Ghostscript is an interpreter for the PostScript language and for PDF. Description Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workarou...

Hunspell: Multiple Vulnerabilities

Background Hunspell is the spell checker of LibreOffice, OpenOffice.org, Mozilla Firefox & Thunderbird, Google Chrome. Description Malicious input to the hunspell spell checker could result in an application crash or other unspecified behavior. Impact Malicious input to the hunspell spell checker...

abcm2ps: Buffer overflow vulnerability

Background abcm2ps is a utility used to convert ABC music sheet files into PostScript format. Description Limin Wang has located a buffer overflow inside the putwords function in the abcm2ps code. Impact A remote attacker could convince the victim to download a specially-crafted ABC file. Upon...

GNU screen: Multiple Vulnerabilities

Background GNU screen is a full-screen window manager that multiplexes a physical terminal between several processes, typically interactive shells. Description Multiple vulnerabilities have been discovered in GNU screen. Please review the CVE identifiers referenced below for details. Impact Pleas...

Bubblewrap: Root privilege escalation

Background Bubblewrap is an unprivileged sandboxing tool namespaces-powered chroot-like solution. Description A vulnerability has been discovered in Bubblewrap. Please review the CVE identifier referenced below for details. Impact An attacker could achieve root privilege escalation if Bubblewrap ...

Orc: Arbitrary Code Execution

Background Orc is a library and set of tools for compiling and executing very simple programs that operate on arrays of data. The "language" is a generic assembly language that represents many of the features available in SIMD architectures, including saturated addition and subtraction, and many...

GnuTLS: Multiple Vulnerabilities

Background GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

EditorConfig core C library: arbitrary stack write

Background EditorConfig core library written in C for use by plugins supporting EditorConfig parsing Description A vulnerability has been discovered in EditorConfig Core C library. Please review the CVE identifier referenced below for details. Impact Please review the referenced CVE identifier fo...

Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

libinput: Multiple Vulnerabilities

Background A library to handle input devices in Wayland and, via xf86-input-libinput, in X.org. Description Multiple vulnerabilities have been discovered in libinput. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Chromium, Google Chrome, Microsoft Edge, Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

DTrace: Multiple Vulnerabilities

Background DTrace is a dynamic tracing tool for analysing or debugging the whole system. Specifically, dtprobed is a component of the DTrace system that keeps track of USDT probes within running processes, parsing and storing the DOF they provide for later consumption by dtrace proper. Descriptio...

Flatpak: Multiple Vulnerabilities

Background Flatpak is a Linux application sandboxing and distribution framework. Description Multiple vulnerabilities have been discovered in Flatpak. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There ...

PostgreSQL: Multiple Vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...

nginx: Multiple Vulnerabilities

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...

rsync: Multiple Vulnerabilities

Background rsync is a server and client utility that provides fast incremental file transfers. It is used to efficiently synchronize files between hosts and is used by emerge to fetch Gentoo's Portage tree. Description Multiple vulnerabilities have been discovered in rsync. Please review the CVE...

Tor: Multiple Vulnerabilities

Background Tor is an implementation of second generation Onion Routing, a connection-oriented anonymizing communication service. Description Multiple vulnerabilities have been discovered in Tor. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CV...

Chromium, Google Chrome, Microsoft Edge, Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...