Go: Multiple vulnerabilities

Background Go is an open source programming language that makes it easy to build simple, reliable, and efficient software. Description Multiple vulnerabilities have been discovered in Go. Please review the CVE identifiers referenced below for details. Impact A remote attacker could cause arbitrar...

CouchDB: Multiple vulnerabilities

Background Apache CouchDB is a distributed, fault-tolerant and schema-free document-oriented database. Description Multiple vulnerabilities have been discovered in CouchDB. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code or...

Scala: Privilege escalation

Background Scala combines object-oriented and functional programming in one concise, high-level language. Description It was discovered that Scala’s compilation daemon does not properly manage permissions for private files. Impact A local attacker could escalate privileges. Workaround There is no...

SpamAssassin: Multiple vulnerabilities

Background SpamAssassin is an extensible email filter used to identify junk email. Description Multiple vulnerabilities have been discovered in SpamAssassin. Please review the referenced CVE identifiers for details. Impact A remote attacker could execute arbitrary code, escalate privileges, or...

EDE: Privilege escalation

Background A package that simplifies the task of creating, building, and debugging large programs with Emacs. It provides some of the features of an IDE, or Integrated Development Environment, in Emacs. Description An untrusted search path vulnerability was discovered in EDE. Impact A local...

ConnMan: Multiple vulnerabilities

Background ConnMan provides a daemon for managing Internet connections. Description Multiple vulnerabilities have been discovered in ConnMan. Please review the CVE identifiers referenced below for details. Impact A remote attacker, via a crafted DNS packet, could remotely execute code or cause a...

WebkitGTK+: Multiple vulnerabilities

Background WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Description Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the...

PHP: Multiple vulnerabilities

Background PHP is an open source general-purpose scripting language that is especially suited for web development. Description Multiple vulnerabilities have been discovered in PHP. Please review the referenced CVE identifiers for details. Impact An attacker could cause a Denial of Service conditi...

Nagios: Privilege escalation

Background Nagios is an open source host, service and network monitoring program. Description A vulnerability in Nagios was discovered due to the improper handling of configuration files which can be owned by a non-root user. Impact A local attacker can escalate privileges to root by leveraging...

PostgreSQL: SQL injection

Background PostgreSQL is an open source object-relational database management system. Description A vulnerability was discovered in PostgreSQL’s pgupgrade and pgdump. Impact An attacker, by enticing a user to process a specially crafted trigger definition, can execute arbitrary SQL statements wit...

libsndfile: Multiple vulnerabilities

Background libsndfile is a C library for reading and writing files containing sampled sound. Description Multiple vulnerabilities have been discovered in libsndfile. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to open a specially...

OpenSSL: Multiple vulnerabilities

Background OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Description Multiple vulnerabilities have been discovered in OpenSSL. Please review the referenced CVE identifiers for details. Impact A remote...

RPM: Multiple vulnerabilities

Background The Red Hat Package Manager RPM is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages. Description Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers...

Binutils: Multiple vulnerabilities

Background The GNU Binutils are a collection of tools to create, modify and analyse binary files. Many of the files use BFD, the Binary File Descriptor library, to do low-level manipulation. Description Multiple vulnerabilities have been discovered in Binutils. Please review the referenced CVE...

Tablib: Arbitrary command execution

Background Tablib is an MIT Licensed format-agnostic tabular dataset library, written in Python. It allows you to import, export, and manipulate tabular data sets. Description A vulnerability was discovered in Tablib’s Databook loading functionality, due to improper input validation. Impact A...

Libav: Multiple vulnerabilities

Background Libav is a complete solution to record, convert and stream audio and video. Description Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact A remote attacker, via a crafted Smacker stream, could cause a Denial o...

spice-gtk: Remote code execution

Background spice-gtk is a set of GObject and Gtk objects for connecting to Spice servers and a client GUI. Description A vulnerability was found in spice-gtk client due to the incorrect use of integer types and missing overflow checks. Impact An attacker, by enticing the user to join a malicious...

strongSwan: Multiple vulnerabilities

Background strongSwan is an IPSec implementation for Linux. Description Multiple vulnerabilities have been discovered in strongSwan. Please review the CVE identifiers referenced below for details. Impact A remote attacker could cause a Denial of Service condition or impersonate a user. Workaround...

MuPDF: Multiple vulnerabilities

Background A lightweight PDF, XPS, and E-book viewer. Description Multiple vulnerabilities have been discovered in MuPDF. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to process a specially crafted file, could possibly execute...

Asterisk: Multiple vulnerabilities

Background A Modular Open Source PBX System. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the referenced CVE identifiers for details. Impact A remote attacker could cause a Denial of Service condition or conduct information gathering. Workaround There is no...

GPL Ghostscript: Multiple vulnerabilities

Background Ghostscript is an interpreter for the PostScript language and for PDF. Description Multiple vulnerabilities have been discovered in GPL Ghostscript. Please review the CVE identifiers referenced below for additional information. Impact A context-dependent attacker could entice a user to...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the referenced Mozilla Foundation Security Advisories and CVE identifiers below for details. Impact A remo...

Exiv2: Multiple vulnerabilities

Background Exiv2 is a C++ library and a command line utility to manage image metadata. Description Multiple vulnerabilities have been discovered in Exiv2. Please review the CVE identifiers referenced below for details. Impact A remote attacker could cause a Denial of Service condition or obtain...

Chromium: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Description Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the referenced CVE identifiers and Google Chrom...

Okular: Directory traversal

Background Okular is a universal document viewer based on KPDF for KDE 4. Description It was discovered that Okular contains a Directory Traversal vulnerability in function unpackDocumentArchive in core/document.cpp. Impact A remote attacker could entice a user to open a specially crafted Okular...

Icecast: Arbitrary code execution

Background Icecast is an open source alternative to SHOUTcast that supports MP3, OGG Vorbis/Theora and AAC streaming. Description Multiple buffer overflows have been discovered in Icecast. Please review the CVE identifier referenced below for details. Impact A remote attacker, by sending a...

PHProjekt: Multiple vulnerabilities

Background PHProjekt is an application suite that supports communication and management of teams and companies. Description Multiple vulnerabilities have been discovered in PHProjekt due to embedded Zend Framework. Please review the GLSA identifiers referenced below for details. Impact Remote...

Pango: Denial of service

Background Library for layout and rendering of internationalized text. Description Processing certain invalid Emoji sequences in a GTK+ application can trigger a reachable assertion resulting in an application crash. Impact A remote attacker could provide a specially crafted Emoji sequences,...

libde265: Multiple vulnerabilities

Background Open h.265 video codec implementation. Description Multiple vulnerabilities have been discovered in libde265. Please review libde265 changelog referenced below for details. Impact A remote attacker could entice a user to open a specially crafted media file using libde265 or linked...

X.Org X11 library: Multiple vulnerabilities

Background X.Org is an implementation of the X Window System. The X.Org X11 library provides the X11 protocol library files. Description Multiple vulnerabilities have been discovered in X.Org X11 library. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by...

Python: Buffer overflow

Background Python is an interpreted, interactive, object-oriented programming language. Description A buffer overflow vulnerability have been discovered in Python. Please review the CVE identifiers referenced below for details. Impact A remote attacker, in special situations such as function as a...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla Project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact A remote attacker could entice a user to view a specially...

OpenSSL: Denial of service

Background OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 as well as a general purpose cryptography library. Description It was discovered that OpenSSL allow malicious servers to send very large primes to a client during DHE...

systemd: Multiple vulnerabilities

Background A system and service manager. Description Multiple vulnerabilities have been discovered in systemd. Please review the CVE identifiers referenced below for details. Impact An attacker could possibly execute arbitrary code, cause a Denial of Service condition, or gain escalated privilege...

X.Org X Server: Privilege escalation

Background The X Window System is a graphical windowing system based on a client/server model. Description An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to...

xkbcommon: Multiple vulnerabilities

Background xkbcommon is a library to handle keyboard descriptions, including loading them from disk, parsing them and handling their state. Description Multiple vulnerabilities have been discovered in libxkbcommon. Please review the CVE identifiers referenced below for details. Impact A local...

PostgreSQL: Multiple vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the referenced CVE identifiers for details. In addition it was discovered that Gentoo’s PostgreSQL installation suffered fro...

Mutt, NeoMutt: Multiple vulnerabilities

Background Mutt is a small but very powerful text-based mail client. NeoMutt is a command line mail reader or MUA. It’s a fork of Mutt with added features. Description Multiple vulnerabilities have been discovered in Mutt, and NeoMutt. Please review the CVE identifiers referenced below for detail...

Xen: Multiple vulnerabilities

Background Xen is a bare-metal hypervisor. Description Multiple vulnerabilities have been discovered in Xen. Please review the referenced CVE identifiers for details. Impact A local attacker could cause a Denial of Service condition or disclose sensitive information. Workaround There is no known...

OpenSSH: User enumeration vulnerability

Background OpenSSH is a complete SSH protocol implementation that includes SFTP client and server support. Description It was discovered that OpenSSH was prone to a user enumeration vulnerability. Impact A remote attacker could conduct user enumeration. Workaround There is no known workaround at...

ImageMagick: Security hardening

Background ImageMagick is a collection of tools and libraries for many image formats. Description If you process an image with ImageMagick and don’t validate the file before e.g. check magic byte, ImageMagick will call any coders found in the given file. So if ImageMagick will find Ghostscript fo...

SoX: Multiple vulnerabilities

Background SoX is a command line utility that can convert various formats of computer audio files in to other formats. Description Multiple vulnerabilities have been discovered in SoX. Please review the referenced CVE identifiers for details. Impact A remote attacker, by enticing a user to proces...

Mozilla Firefox: Multiple vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla Project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the referenced CVE identifiers for details. Impact A remote attacker could entice a user to view a specially crafte...

WebkitGTK+: Multiple vulnerabilities

Background WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Description Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the...

NetworkManager VPNC plugin: Privilege escalation

Background NetworkManager is an universal network configuration daemon for laptops, desktops, servers and virtualization hosts. The VPNC plugin provides easy access Cisco Concentrator based VPN’s utilizing NetworkManager. Description When initiating a VPNC connection, NetworkManager spawns a new...

LinuX Containers user space utilities: Arbitrary file read

Background LinuX Containers user space utilities. Description lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to check for the existence of a path which they wouldn’t otherwise be able to reac...

Chromium, Google Chrome: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Description Multiple vulnerabilities have been discovered in Chromium and...

cURL: Heap-based buffer overflow

Background A command line tool and library for transferring data with URLs. Description A heap-based buffer overflow was discovered in cURL’s Curlsmtpescapeeob function. Impact An attacker could cause a Denial of Service condition or execute arbitrary code via SMTP connections. Workaround There i...

ZNC: Multiple Vulnerabilities

Background ZNC is an advanced IRC bouncer. Description Multiple vulnerabilities have been discovered in ZNC. Please review the CVE identifiers referenced below for details. Impact A remote attacker could read arbitary files and esclate privileges. Workaround There is no known workaround at this...

Passenger: Multiple Vulnerabilities

Background Passenger runs and manages your Ruby, Node.js, and Python apps. Description Multiple vulnerabilities have been discovered in Passenger. Please review the CVE identifiers referenced below for details. Impact A remote attacker could escalate privileges, execute arbitrary code, cause a...