6099 matches found
Updated squid packages fix security vulnerability
Due to incorrect data validation Squid is vulnerable to a buffer overflow attack when processing specially crafted HTTP requests. This problem allows any trusted client or client script who can generate HTTP requests to trigger a buffer overflow in Squid, resulting in a termination of the Squid...
Updated php packages fix security vulnerabilies
Heap based buffer overflow in quotedprintableencode in PHP before version 5.4.16 CVE-2013-2110. Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service applicati...
Updated krb5-appl packages fix security vulnerability
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC Set Local Characters suboption handler because addslc does not check whether the buffer is full. CVE-2026-32746...
Updated chromium-browser-stable packages fix security vulnerabilities
Integer overflow in Layout. CVE-2024-7025 Insufficient data validation in Mojo. CVE-2024-9369 Inappropriate implementation in V8. CVE-2024-9370 Type Confusion in V8. CVE-2024-9602 Type Confusion in V8. CVE-2024-9603...
Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 125.0.6422.76 release. It includes 6 security fixes Please, do note, that since some versions ago, only x8664 is supported. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for th...
Updated python-pymongo packages fix security vulnerability
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...
Updated php-tcpdf packages fix security vulnerability
TCPDF version =6.6.5 is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted HTML page with a crafted color. CVE-2024-22640...
Updated golang packages fix security vulnerability
CVE-2023-45288: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...
Updated gnutls packages fix security vulnerabilities
The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLSPRIVKEYFLAGREPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits,...
Updated apache-mod_auth_openidc packages fix security vulnerability
Missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to DoS attack. CVE-2024-24814...
Updated ncurses packages fix security vulnerability
The updated packages fix a security vulnerability: Local users can trigger security-relevant memory corruption via malformed data. CVE-2023-29491...
Updated vorbis-tools packages fix a security vulnerability
The upstream patch to fix CVE-2023-43361 was added...
Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Queued up rendering could have allowed websites to clickjack. CVE-2023-5721 Address bar spoofing via bidirectional characters. CVE-2023-5732 Large WebGL draw could have led to a crash. CVE-2023-5724 WebExtensions could open arbitrary URLs...
Updated firefox/nss packages fix security vulnerability
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS CVE-2023-37201. Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free in...
Updated glib2.0 packages fix security vulnerability
Denial of service caused by handling a malicious text-form variant. CVE-2023-24593 Denial of service caused by malicious serialised variant. CVE-2023-25180...
Updated golang packages fix security vulnerability
Angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in unexpectedly closing the CSS context and allowing for injection of unexpected HMTL, if executed with untrusted input...
Updated libfastjson packages fix security vulnerability
Integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbufmemappend. CVE-2020-12762...
Updated python-flask-security packages fix security vulnerability
Open redirect CVE-2021-23385...
Updated gssntlmssp packages fix security vulnerability
Multiple out-of-bounds read when decoding NTLM fields. CVE-2023-25563 Memory corruption when decoding UTF16 strings. CVE-2023-25564 Incorrect free when decoding target information. CVE-2023-25565 Memory leak when parsing usernames. CVE-2023-25566 Out-of-bounds read when decoding target informatio...
Updated webkit2 packages fix security vulnerability
Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2022-42826 CVE-2023-23517 CVE-2023-23518...
Updated thunderbird packages fix security vulnerability
An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages CVE-2022-46872. A drag-and-dropped file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious...
Updated pcre packages fix security vulnerability
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compilexclassmatchingpath function of the pcre2jitcompile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in...
Updated gdk-pixbuf2.0 packages fix security vulnerability
GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. CVE-2021-44648...
Updated unbound packages fix security vulnerability
Non-Responsive Delegation Attack. CVE-2022-3204 Improves performance when under load, by cutting promiscuous queries for nameserver discovery and limiting the number of times a delegation point can look in the cache for missing records...
Updated python-lxml packages fix security vulnerability
NULL pointer dereference due to state leak between parser runs CVE-2022-2309...
Updated dovecot packages fix security vulnerability
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect usernamefilter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead...
Updated ruby-sinatra packages fix security vulnerability
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...
Updated ruby-rack packages fix security vulnerability
Crafted multipart POST request may cause a DoS CVE-2022-30122 Crafted requests can cause shell escape sequences CVE-2022-30123...
Updated python-bottle packages fix security vulnerability
Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799...
Updated 389-ds-base packages fix security vulnerability
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...
Updated librecad packages fix security vulnerability
A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document. CVE-2021-45341 A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and olde...
Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 99.0.4844.74 version that fixes multiples security vulnerabilities. 1299422 Critical CVE-2022-0971: Use after free in Blink Layout. 1301320 High CVE-2022-0972: Use after free in Extensions. 1297498 High CVE-2022-0973: Use after free in...
Updated nonfree firmware packages fix security vulnerabilities
This update provides new and updated nonfree firmwares and fixes at least the following security issues: Improper input validation in firmware for IntelR PROSet/Wireless Wi-Fi may allow an unauthenticated user to potentially enable escalation of privilege via local access CVE-2021-0066 / SA-00539...
Updated squashfs-tools packages fix security vulnerability
squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations...
Updated privoxy packages fix security vulnerabilities
Updated privoxy packages fix security vulnerabilities: A security issue has been found in Privoxy before version 3.0.33. geturlspecparam did not free memory of compiled pattern spec before bailing CVE-2021-44540. A security issue has been found in Privoxy before version 3.0.33...
Updated chromium-browser-stable packages fix security vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities. The chromium-browser-stable package has been updated to 96.0.4664.110 version that fixes multiples security vulnerabilities. One of these CVEs is known to be actively exploited. Insufficient data validation in Mojo...
Updated webkit2 packages fix security vulnerability
Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.32.4, fixing various bugs and the following security issue: Processing maliciously crafted web content may lead to arbitrary code execution CVE-2021-30858...
Updated ghostscript packages fix security vulnerability
Trivial -dSAFER bypass in 9.55. CVE-2021-3781...
Updated cpio packages fix security vulnerability
GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c dsfgetstr integer overflow that triggers an out-of-bounds heap write. CVE-2021-38185...
Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.62 and fixes at least the following security issues: A flaw use-after-free in function scosocksendmsg of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIOREGISTER or other way triggers race condition of the call scoconndel...
Updated python-pillow packages fix security vulnerabilities
Updated python-pillow packages fix security vulnerabilities: An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2kugrayala CVE-2021-25287. An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2kugrayi...
Updated netty packages fix security vulnerabilities
In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by Http2MultiplexHandler as it is propagated up. This is fine as long as the...
Updated firefox packages fix security vulnerabilities
A malicious webpage could have triggered a use-after-free in accessibility features of a document, causing memory corruption and a potentially exploitable crash when accessibility was enabled CVE-2021-29970. Mozilla developers Valentin Gosu, Randell Jesup, Emil Ghitta, Tyson Smith, and Olli Petta...
Updated binutils packages fix security vulnerabilities
This update provides binutils 2.36.1 and fixes at least the following security issues: There's a flaw in the BFD library of binutils in versions before 2.36. An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to syst...
Updated php packages fix security vulnerabilities
Updated php packages provides upstream 8.0.8 and fixes the following security vulnerabilities: - PDOFirebird: Fix Stack buffer overflow in firebirdinfocb CVE-2021-21704. Fix SIGSEGV in firebirdhandledoer CVE-2021-21704. Fix SIGSEGV in firebirdstmtexecute CVE-2021-21704. Fix Crash while parsing...
Updated nettle packages fix security vulnerabilities
Remote crash in RSA decryption via manipulated ciphertext CVE-2021-3580. A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with...
Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. The bitbucketpipelinevariable module exposed secured values CVE-2021-20180. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been updated to version 2.9.18...
Updated firejail package fixes a security vulnerability
Roman Fiedler discovered a vulnerability in the OverlayFS code in firejail, which could result in root privilege escalation. This update disables OverlayFS support in firejail CVE-2021-26910...