6221 matches found
Updated varnish packages fix security vulnerability
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and Varnish Enterprise Cache Plus 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections. CVE-2022-23959...
Updated lrzsz packages fix security vulnerability
lrzsz before version 0.12.21rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a sizet to wrap around. CVE-2018-10195...
Updated webkit2 packages fix security vulnerability
Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy. CVE-2021-30887 Processing maliciously crafted web content may lead to universal cross site scripting. CVE-2021-30890...
Updated tunnel packages fix security vulnerability
Updated stunnel package fixes security vulnerability: Client certificate not correctly verified when redirect and verifyChain options are used CVE-2021-20230...
Updated microcode packages fix security vulnerabilities
Updated microcodes for Intel processors, fixing various functional issues, and at least the following security issues: Incomplete cleanup in some IntelR VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access CVE-2020-24489. Improper isolation ...
Updated openjpeg2 packages fix a security vulnerability
There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The...
Updated libtiff packages fix security vulnerabilities
The updated libtiff packages fix security vulnerabilities: - Integer overflow in tifgetimage.c CVE-2020-35523. - Heap-based buffer overflow in TIFF2PDF tool CVE-2020-35524. - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the “TIFFVGetField” funtion in the...
Updated minidlna packages fix security vulnerabilities
It was discovered that minidlna does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue CVE-2020-12695. Minidlna before versions 1.3.0 allows remote code execution...
Updated jasper packages fix security vulnerability
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability CVE-2020-27828...
Updated java-1.8.0-openjdk packages fix security vulnerabilities
High memory usage during deserialization of Proxy class with many interfaces. CVE-2020-14779 Credentials sent over unencrypted LDAP connection. CVE-2020-14781 Certificate blacklist bypass via alternate certificate encodings. CVE-2020-14782 Integer overflow leading to out-of-bounds access...
Updated phpmyadmin packages fix security vulnerabilities
A vulnerability was discovered where an attacker can cause an XSS attack through the transformation feature. If an attacker sends a crafted link to the victim with the malicious JavaScript, when the victim clicks on the link, the JavaScript will run and complete the instructions made by the...
Updated nasm packages fix security vulnerability
Netwide Assembler NASM 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Remote attackers could leverage this vulnerability to cause a denial of service or possibly have unspecified other impact via a crafted ELF file CVE-2018-10254. Netwide Assembler NAS...
Updated libvirt packages fix security vulnerability
Updated libvirt packages fix security vulnerability: A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this...
Updated roundcubemail packages fix security vulnerability
The latest maintenance release of roundcubemail fixes some xss issues: - Fix XSS issue in template object 'username' - Fix cross-site scripting XSS via malicious XML attachment and improves the fix for CVE-2020-12641...
Updated log4net packages fix security vulnerability
Updated log4net packages fix security vulnerability This patch fixes a security vulnerability reported by Karthik Balasundaram. The security vulnerability was found in the way how log4net parses xml configuration files where it allowed to process XML External Entity Processing. An attacker could...
Updated vim packages fix security vulnerability
It was discovered that the autocmd feature in window.c in Vim before 8.1.2136 accesses freed memory CVE-2019-20079...
Updated webkit2 packages fix security vulnerability
Updated webkit2 packages fix security vulnerability: WebKitGTK through 2.26.4 contains a memory corruption issue use-after-free that may lead to arbitrary code execution CVE-2020-10018...
Updated ppp packages fix security vulnerability
Updated ppp packages fix security vulnerability: Ilja Van Sprundel discovered a buffer overflow vulnerability in ppp. When receiving an EAP Request message in client mode, an attacker was able to overflow the rhostname array by providing a very long name CVE-2020-8597...
Updated libgd packages fix security vulnerability
The updated packages fix a security vulnerability: When using the gdImageCreateFromXbm function in the GD Graphics Library aka LibGD 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause t...
Updated spamassassin packages fix security vulnerabilities
The updated packages fix security vulnerabilities: In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that...
Updated libgit2 packages fix security vulnerabilities
libgit2 has been updated to version 0.28.4 to fix several security issues: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. CVE-2019-1348: the fast-import stream command "feature export-marks=path"...
Updated unbound packages fix security vulnerability
Updated unbound package to version 1.9.5 to fix a potential security vulnerability. In case users recompiled the Mageia package with --enable-ipsecmod, and ipsecmod is enabled and used in the configuration, shell code execution would end up being possible after receiving a specially crafted answe...
Updated sysstat packages fix security vulnerabilities
Updated sysstat package fix security vulnerabilities: Out-of-bounds read during a memmove call inside the remapstruct function CVE-2018-19416. Out-of-bounds read during a memset call inside the remapstruct function CVE-2018-19517...
Updated firefox packages fix security vulnerability
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow CVE-2019-9810. Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and...
Updated libpng packages fix security vulnerability
pngimagefree in png.c in libpng 1.6.0 up to 1.6.36 had a use-after-free because pngimagefreefunction is called under pngsafeexecute CVE-2019-7317...
Updated libvncserver packages fix security vulnerability
LibVNC through 0.9.12 contains a heap out-of-bounds write vulnerability in libvncserver/rfbserver.c CVE-2018-20750...
Updated squid packages fix security vulnerabilities
Due to incorrect input handling, Squid is vulnerable to a Cross-Site Scripting vulnerability when generating HTTPS response messages about TLS errors CVE-2018-19131. Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack CVE-2018-19132...
Updated virtualbox packages fix security vulnerabilities
This update provides virtualbox 5.2.20 and fixes the following security vulnerabilities: During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of tim...
Updated libtiff packages fix security vulnerabilities
The updated packages fix security vulnerabilities: An issue was discovered in LibTIFF 4.0.9. There is a int32 overflow in multiplyms in tools/ppm2tiff.c, which can cause a denial of service crash or possibly have unspecified other impact via a crafted image file CVE-2018-17100. An issue was...
Updated 389-ds-base packages fix security vulnerabilities
Updated 389-ds-base package fixes security vulnerabilities: a race condition on reference counter leads to DoS using persistent search CVE-2018-10850 ldapsearch with server side sort allows users to cause a crash CVE-2018-10935 a server crash through the modify command with large DN CVE-2018-1462...
Updated texlive packages fix security vulnerability
Updated texlive packages fix security vulnerability: A buffer overflow in the handling of Type 1 fonts allowed arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex CVE-2018-17407...
Updated openssh packages fix security vulnerability
OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c CVE-2018-15473...
Updated file packages fix a security vulnerability
The updated packages fix a security vulnerability: The docorenote function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted ELF file. CVE-2018-10360...
Updated python-django packages fix security vulnerabilities
The python-django package has been updated to fix 2 security issues. CVE-2018-7536: Denial-of-service possibility in urlize and urlizetrunc template filters. CVE-2018-7537: Denial-of-service possibility in truncatecharshtml and truncatewordshtml template filters...
Updated mariadb packages fix security vulnerability
It was discovered that mariadb contained a security vulnerability CVE-2017-15365. This update fixes a few more bugs on the InnoDB Engine...
Updated samba packages fix security vulnerability
Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a man in the middle attack. CVE-2017-12150 Yihan Lian and Zhibin Hu discovered that Samba incorrectly handled memory when SMB1 is being used. A remote...
Updated openjpeg2 packages fix security vulnerability
A heap-based buffer overflow was discovered in the opjt2encodepacket function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact CVE-2017-14039. An invalid write access was discovered in bin/jp2/convert.c,...
Updated lame packages fix security vulnerabilities
LAME 3.100 has been released including fixes to security vulnerabilities. Note the MP3 patents have expired...
Updated botan packages fix security vulnerabilities
While decoding BER length fields, an integer overflow could occur. This could occur while parsing untrusted inputs such as X.509 certificates. The overflow does not seem to lead to any obviously exploitable condition, but exploitation cannot be positively ruled out. Only 32-bit platforms are like...
Updated ffmpeg packages fix security vulnerabilities
This update provides ffmpeg version 3.3.3, which fixes several security vulnerabilities and other bugs which were corrected upstream...
Updated libraw packages fix security vulnerabilities
A memory corruption in parsetiffifd function CVE-2017-6886. A memory corruption via e.g. a specially crafted KDC file parsetiffifd CVE-2017-6887. An integer overflow error within the "foveonloadcamf" function CVE-2017-6889. A boundary error within the "foveonloadcamf" function CVE-2017-6890...
Updated python-lshell package fixes security vulnerabilities
Shell outbreak due to bad syntax parse CVE-2016-6902. Shell outbreak with multiline commands CVE-2016-6903...
Updated java-1.8.0-openjdk packages fix security vulnerability
An untrusted library search path flaw was found in the JCE component of OpenJDK. A local attacker could possibly use this flaw to cause a Java application using JCE to load an attacker-controlled library and hence escalate their privileges CVE-2017-3511. It was found that the JAXP component of...
Updated ming packages fix security vulnerability
The update fixes CVE-2017-7578: Multiple heap-based buffer overflows in parser.c in libming 0.4.7 allow remote attackers to cause a denial of service listswf application crash or possibly have unspecified other impact via a crafted SWF file. NOTE: This issue exists because of an incomplete fix fo...
Updated mupdf packages fix security vulnerability
A flaw was discovered in the pdfloadmeshparams function allowing out-of-bounds write access to memory locations. With carefully crafted input, that could trigger a heap overflow, resulting in application crash or possibly having other unspecified impact CVE-2016-6525. Also, mupdf already containe...
Updated p7zip packages fix CVE-2016-2335
Updated p7zip package fixes security vulnerability: An out of bound read vulnerability exists in the CInArchive::ReadFileItem method functionality of 7zip for handling UDF files that can lead to denial of service or code execution CVE-2016-2335...
Updated pidgin-otr packages fix security vulnerability
The pidgin-otr plugin before 4.0.2 is vulnerable to a heap use after free error. The bug is triggered when a user tries to authenticate a buddy and happens in the function createsmpdialog CVE-2015-8833...
Updated firefox packages fix security vulnerabilities
Updated firefox packages fix security vulnerabilities: Multiple memory safety issues in Firefox were discovered. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary...
Updated struts packages fix CVE-2015-0899
Updated struts packages fix security vulnerability: The Validator in Apache Struts 1.1 and later contains a function to efficiently define rules for input validation across multiple pages during screen transitions. This function contains a vulnerability where input validation may be bypassed. Whe...