Lucene search
+L
MageiaMost viewed

6143 matches found

Mageia
Mageia
added 2017/03/25 4:56 p.m.48 views

Updated libwmf packages fix security vulnerability

The gdImageCreate function in the GD Graphics Library aka libgd before 2.2.4 allows remote attackers to cause a denial of service system hang via an oversized image. CVE-2016-9317 The gdImageCreateFromGd2Ctx function in gdgd2.c in the GD Graphics Library aka libgd before 2.2.4 allows remote...

7.8CVSS5.7AI score0.03736EPSS
SaveExploits0References1
Mageia
Mageia
added 2017/02/26 10:02 p.m.48 views

Updated libevent packages fix security vulnerability

The DNS code of Libevent contains an OOB read which can trigger a crash CVE-2016-10197 The libevent evutilparsesockaddrport contains a buffer overflow which can cause a segmentation fault CVE-2016-10196 The nameparse function in libevent's DNS code is vulnerable to a buffer overread CVE-2016-1019...

9.8CVSS4.3AI score0.06681EPSS
SaveExploits3References3
Mageia
Mageia
added 2016/12/29 10:29 a.m.48 views

Updated openjpeg2 packages fix security vulnerabilities

A NULL pointer dereference flaw was found in the way openjpeg decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image CVE-2016-9572. A heap buffer...

8.8CVSS2.2AI score0.02565EPSS
SaveExploits4References3
Mageia
Mageia
added 2016/12/29 10:29 a.m.48 views

Updated hdf5 packages fix security vulnerabilities

In the HDF5 1.8.16 library's failure to check if the number of dimensions for an array read from the file is within the bounds of the space allocated for it, a heap-based buffer overflow will occur, potentially leading to arbitrary code execution CVE-2016-4330. When decoding data out of a dataset...

8.6CVSS1.9AI score0.00812EPSS
SaveExploits8References2
Mageia
Mageia
added 2016/12/09 8:42 a.m.48 views

Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.9, when the user does not specify a blowfishsecret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created using a weak algorithm. This could allow an attacker to determine the user's...

9.8CVSS0.2AI score0.02542EPSS
SaveExploits0References15
Mageia
Mageia
added 2016/12/05 9:49 p.m.48 views

Updated firefox packages fix security vulnerability

A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-9079...

7.5CVSS4.4AI score0.87423EPSS
SaveExploits13References4
Mageia
Mageia
added 2016/10/23 8:49 a.m.48 views

Updated openjpeg packages fix security vulnerability

The openjpeg library was vulnerable to a crash when converting images due to a NULL pointer dereference in readpnmheader CVE-2016-7445...

7.5CVSS2.4AI score0.04191EPSS
SaveExploits1References2
Mageia
Mageia
added 2016/09/23 8:57 p.m.48 views

Updated golang package fixes security vulnerability

Updated golang packages fix security vulnerability: Go: sets environmental variable based on user supplied Proxy request header CVE-2016-5386...

8.1CVSS2.1AI score0.0522EPSS
SaveExploits0References2
Mageia
Mageia
added 2016/09/21 8:38 p.m.48 views

Updated curl packages fix security vulnerability

The four libcurl functions curlescape, curleasyescape, curlunescape and curleasyunescape perform string URL percent escaping and unescaping. They accept custom string length inputs in signed integer arguments. The provided string length arguments were not properly checked and due to arithmetic in...

9.8CVSS0.5AI score0.11737EPSS
SaveExploits0References2
Mageia
Mageia
added 2016/08/31 5:34 p.m.48 views

Updated python3/python packages fix security vulnerability

Fix for CVE-2016-1000110 HTTPoxy attack. Many software projects and vendors have implemented support for the “Proxy” request header in their respective CGI implementations and languages by creating the “HTTPPROXY” environmental variable based on the header value. When this variable is used in man...

6.1CVSS2AI score0.04526EPSS
SaveExploits0References4
Mageia
Mageia
added 2016/07/14 8:33 p.m.48 views

Updated sqlite3 packages fix security vulnerability

It was discovered that sqlite3 would reject a temporary directory e.g., as specified by the TMPDIR environment variable to which the executing user did not have read permissions. This could result in information leakage as less secure global temporary directories e.g., /var/tmp or /tmp would be...

5.9CVSS2.1AI score0.0048EPSS
SaveExploits0References2
Mageia
Mageia
added 2016/07/05 3:47 p.m.48 views

Updated phpmyadmin packages fix security vulnerability

In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows a BBCode injection to setup script in case it's not accessed on https CVE-2016-5701. In phpMyAdmin before 4.4.15.7, a vulnerability was discovered that allows an SQL injection attack to run arbitrary commands as the control...

9.8CVSS0.3AI score0.02948EPSS
SaveExploits0References10
Mageia
Mageia
added 2016/05/05 4:26 p.m.48 views

Updated jenkins-remoting packages fix CVE-2016-0792

Updated jenkins-remoting packages fix security vulnerability: Jenkins has several API endpoints that allow low-privilege users to POST XML files that then get deserialized by Jenkins. Maliciously crafted XML files sent to these API endpoints could result in arbitrary code execution. SECURITY-247 ...

9CVSS5.7AI score0.83259EPSS
SaveExploits23References3
Mageia
Mageia
added 2016/04/26 6:02 p.m.48 views

Updated libgd packages fix CVE-2016-3074

Updated libgd packages fix security vulnerability: A signedness vulnerability exists in libgd 2.1.1 and earlier which may result in a heap overflow when processing compressed gd2 data CVE-2016-3074...

9.8CVSS1.9AI score0.36974EPSS
SaveExploits8References2
Mageia
Mageia
added 2016/03/25 6:38 a.m.48 views

Updated webkit packages fix security vulnerability

The webkit package has been updated to version 2.4.10, fixing several security issues and other bugs...

6.8CVSS7.4AI score0.1087EPSS
SaveExploits2References3
Mageia
Mageia
added 2016/01/20 5:53 p.m.48 views

Updated moodle packages fix security vulnerability

In Moodle before 2.8.10, web services coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo did not check user permission to access hidden courses CVE-2016-0724. In Moodle before 2.8.10, search string in course management interface was not escaped when being output creating potential fo...

6.1CVSS3AI score0.0194EPSS
SaveExploits0References5
Mageia
Mageia
added 2015/12/16 9:01 p.m.48 views

Updated libpng packages fix security vulnerabilities

Updated libpng and libpng12 packages fix security vulnerability: The fix for CVE-2015-8126 was incomplete. While it defended against the potential overrun while reading PNG files, it did not detect a potential overrun by applications using pngsetPLTE directly CVE-2015-8472...

7.5CVSS7.9AI score0.06054EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/11/26 8:47 p.m.48 views

Updated libsndfile packages fix security vulnerability

Due to a heap overflow in libsndfile, a specially crafted AIFF header can manage index values in order to use memcpy to overwrite memory the heap CVE-2015-7805...

9.3CVSS6.3AI score0.13294EPSS
SaveExploits2References4
Mageia
Mageia
added 2015/11/10 9:26 p.m.48 views

Updated libreoffice packages fix security vulnerability

Federico Scrinzi discovered that LibreOffice incorrectly handled documents inserted into Writer or Calc via links. If a user were tricked into opening a specially crafted document, a remote attacker could possibly obtain the contents of arbitrary files CVE-2015-4551. It was discovered that...

6.8CVSS8.1AI score0.13826EPSS
SaveExploits0References14
Mageia
Mageia
added 2015/10/15 7:50 p.m.48 views

Updated wireshark packages fix security vulnerabilities

Updated wireshark packages fix security vulnerabilities: In Wireshark before 1.12.8, the pcapng file parser could crash while copying an interface filter. It may be possible to make Wireshark crash by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet...

4.3CVSS5.6AI score0.03037EPSS
SaveExploits0References4
Mageia
Mageia
added 2015/09/17 6:02 p.m.48 views

Updated wordpress package fixes security vulnerabilities

Updated wordpress packages fixes security vulnerabilities: The wordpress package has been updated to version 3.9.9, fixing two cross-site scripting issues and a potential privilege escalation issue CVE-2015-5714, CVE-2015-5715, as well as other bugs. See the upstream announcement and release note...

6.1CVSS6.3AI score0.06937EPSS
SaveExploits2References3
Mageia
Mageia
added 2015/09/13 9:58 p.m.48 views

Updated xfsprogs packages fix CVE-2012-2150

Updated xfsprogs packages fix security vulnerability: xfsmetadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generated image CVE-2012-2150...

5CVSS4.8AI score0.04498EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/09/08 7:20 a.m.48 views

Updated bind packages fix security vulnerabilities

Updated bind packages fix security vulnerability: Parsing a malformed DNSSEC key can cause a validating resolver to exit due to a failed assertion in buffer.c. It is possible for a remote attacker to deliberately trigger this condition, for example by using a query which requires a response from ...

7.8CVSS7.6AI score0.33652EPSS
SaveExploits0References5
Mageia
Mageia
added 2015/09/08 7:20 a.m.48 views

Updated openafs package fixes security vulnerabilities

Updated openafs packages fix security vulnerabilities: Memory allocated by vos for VLDB entry structures was not cleared prior to use, meaning stack data could be sent over the network, possibly in the clear if crypt mode was not in use CVE-2015-3282. The default use by bos of clear rather than...

6.8CVSS6.8AI score0.02081EPSS
SaveExploits0References10
Mageia
Mageia
added 2015/08/27 8:49 p.m.48 views

Updated python-django and python-django14 packages fix security vulnerabilities

Lin Hua Cheng discovered that Django incorrectly handled the session store. A remote attacker could use this issue to cause the session store to fill up, resulting in a denial of service...

5CVSS6.3AI score0.05206EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/08/11 8:22 p.m.48 views

Updated firefox packages fixes security vulnerabilities

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2015-4473, CVE-2015-4475, CVE-2015-4478, CVE-2015-4479,...

10CVSS8.6AI score0.09027EPSS
SaveExploits0References13
Mageia
Mageia
added 2015/07/05 5:22 p.m.48 views

Updated curl package fixes security vulnerability

libcurl can wrongly send HTTP credentials when re-using connections. Even if the handle for an HTTP connection is reset, it retains the credentials, which can cause them to be unintentionally leaked in subsequent requests CVE-2015-3236. libcurl can get tricked by a malicious SMB server to send of...

6.4CVSS9.1AI score0.08302EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/05/05 1:36 p.m.48 views

Updated squid packages fix CVE-2015-3455

Updated squid packages fix security vulnerability: Squid configured with client-first SSL-bump does not correctly validate X509 server certificate domain / hostname fields CVE-2015-3455...

2.6CVSS8.6AI score0.11402EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/05/03 12:19 a.m.48 views

Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 42.0.2311.135 fixes security issues: a use-after-free in DOM CVE-2015-1243, and various fixes from internal audits, fuzzing and other initiatives CVE-2015-1250...

7.5CVSS6.4AI score0.02326EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/05/03 12:19 a.m.48 views

Updated cherokee packages fix CVE-2014-4668

Updated cherokee packages fix security vulnerability: The cherokeevalidatorldapcheck function in validatorldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty...

6.8CVSS6.8AI score0.02844EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/03/27 9:12 p.m.48 views

Updated python-requests packages fix security vulnerability

In python-requests before 2.6.0, a cookie without a host value set would use the hostname for the redirected URL exposing requests users to session fixation attacks and potentially cookie stealing CVE-2015-2296...

6.8CVSS5.9AI score0.03424EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/03/06 6:08 p.m.48 views

Updated apache packages fix CVE-2015-0228

Updated apache packages fix security vulnerability: In the modlua module in the Apache HTTP Server through 2.4.10, a maliciously crafted websockets PING after a script calls r:wsupgrade can cause a child process crash CVE-2015-0228...

5CVSS9AI score0.18812EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/03/05 10:05 p.m.48 views

Updated vlc package fixes security vulnerability

Updated vlc packages 2.1.6 are an upgrade with some fixes. Some of the problems fixed upstream were already fixed by a previous Mageia update to VLC see the link to MGASA-2015-0053. VLC versions before 2.1.5 contain a vulnerability in the transcode module that may allow a corrupted stream to...

9.8CVSS9.8AI score0.04985EPSS
SaveExploits1References2
Mageia
Mageia
added 2015/02/26 8:26 a.m.48 views

Updated apache-poi packages fix CVE-2014-9527

Updated apache-poi packages fixes security vulnerability: A denial of service flaw was found in the way the HSLFSlideShow class implementation in Apache POI handled certain PPT files. A remote attacker could submit a specially crafted PPT file that would cause Apache POI to hang indefinitely...

5CVSS6.2AI score0.07922EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/01/27 9:08 p.m.48 views

Updated python-pillow packages fix CVE-2014-9601

Updated python-pillow packages fix security vulnerability: Pillow before 2.7.0 and 2.6.2 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed CVE-2014-9601...

5CVSS6.6AI score0.04573EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/01/07 4:32 p.m.48 views

Updated apache packages fix CVE-2014-8109

Updated apache packages fix security vulnerability: modlua.c in the modlua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers...

4.3CVSS7.4AI score0.22016EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/12/26 5:04 p.m.48 views

Updated wss4j packages fix CVE-2014-3623

Updated wss4j packages fixes security vulnerability: Apache WSS4J before 1.6.17, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors CVE-2014-3623...

5CVSS6.5AI score0.09224EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/12/20 1:51 p.m.48 views

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated CVE-2014-9293. ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys...

7.5CVSS7.4AI score0.7809EPSS
SaveExploits4References8
Mageia
Mageia
added 2014/12/09 8:12 p.m.48 views

Updated graphviz packages fix CVE-2014-9157

Updated graphviz packages fix security vulnerability: Format string vulnerability in the yyerror function in lib/cgraph/scan.l in Graphviz allows remote attackers to have unspecified impact via format string specifiers in unknown vector, which are not properly handled in an error string...

7.5CVSS6.7AI score0.05569EPSS
SaveExploits1References2
Mageia
Mageia
added 2014/10/28 11:33 a.m.48 views

Updated chromium-browser-stable packages fix security vulnerabilities

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium CVE-2014-3188, CVE-2014-3189, CVE-2014-3190, CVE-2014-3191,...

10CVSS5.7AI score0.05999EPSS
SaveExploits0References4
Mageia
Mageia
added 2014/10/09 2:39 p.m.48 views

Updated golang packages fix CVE-2014-7189

Updated golang packages fix security vulnerability: Go 1.1 through 1.3.2 has an issue that affects programs that use crypto/tls to implement a TLS server. If the server enables TLS client authentication using certificates and explicitly sets SessionTicketsDisabled to true in the tls.Config, then ...

4.3CVSS9.2AI score0.01383EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/09/22 8:31 a.m.48 views

Updated flash-player-plugin packages fix multiple security vulnerabilities

Adobe Flash Player 11.2.202.406 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves memory leakage vulnerabilities that could be used to bypass memory address...

10CVSS9.1AI score0.84298EPSS
SaveExploits7References2
Mageia
Mageia
added 2014/09/15 10:36 a.m.48 views

Updated dump package fix CVE-2014-4607

Updated dump packages fix security vulnerability: An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The dump package is buil...

8.8CVSS9.3AI score0.05315EPSS
SaveExploits1References2
Mageia
Mageia
added 2014/09/05 9:07 a.m.48 views

Updated squid packages fix CVE-2014-3609

Updated squid packages fix security vulnerability: Matthew Daley discovered that Squid 3 did not properly perform input validation in request parsing. A remote attacker could send crafted Range requests to cause a denial of service CVE-2014-3609...

5CVSS6.2AI score0.5622EPSS
SaveExploits0References4
Mageia
Mageia
added 2014/08/18 9:14 a.m.48 views

Updated flash-player-plugin packages fix security vulnerabilities

Adobe Flash Player 11.2.202.400 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This update resolves memory leakage vulnerabilities that could be used to bypass memory address...

10CVSS7.1AI score0.07552EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/05/29 6:55 a.m.48 views

Updated qt4 and qtbase5 packages fix security vulnerability

A NULL pointer dereference flaw was found in QGIFFormat::fillRect in QtGui. If an application using the qt-x11 libraries opened a malicious GIF file with invalid width and height values, it could cause the application to crash CVE-2014-0190. Qt4 has been patched to correct this flaw and has been...

4.3CVSS8.4AI score0.03957EPSS
SaveExploits0References5
Mageia
Mageia
added 2014/05/19 6:53 p.m.48 views

Updated python-django package fix two vulnerabilities

Updated python-django and python-dgango14 packages fix security vulnerabilities: Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby discovered that Django improperly removed Vary and Cache-Control headers from HTTP responses when replying to a request from an Internet Explorer or...

6.4CVSS6.4AI score0.03149EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/04/16 1:08 p.m.48 views

Updated json-c packages fix security vulnerabilities

Updated json-c packages fix security vulnerabilities: Florian Weimer reported that the printbuf APIs used in the json-c library used ints for counting buffer lengths, which is inappropriate for 32bit architectures. These functions need to be changed to using sizet if possible for sizes, or to be...

5CVSS1.1AI score0.04194EPSS
SaveExploits1References3
Mageia
Mageia
added 2014/04/15 6:22 p.m.48 views

Updated asterisk packages fix security vulnerabilities

Updated asterisk packages fix security vulnerabilities: In Asterisk before 11.8.1, sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request...

7.5CVSS7.5AI score0.1639EPSS
SaveExploits2References3
Mageia
Mageia
added 2014/04/15 6:10 p.m.48 views

Updated cups-filters packages fix security vulnerabilities

Updated cups-filters packages fix security vulnerabilities: Florian Weimer discovered that cups-filters incorrectly handled memory in the urftopdf filter. An attacker could possibly use this issue to execute arbitrary code with the privileges of the lp user CVE-2013-6473. Florian Weimer discovere...

6.8CVSS7.5AI score0.03429EPSS
SaveExploits2References2
Total number of security vulnerabilities5000