Lucene search
+L
MageiaMost viewed

6218 matches found

Mageia
Mageia
added 2016/04/13 5:39 p.m.46 views

Updated mercurial packages fix security vulnerabilities

Updated mercurial packages fix security vulnerabilities: Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary code execution on clone CVE-2016-3068. Blake Burkhart discovered that Mercurial allows arbitrary code execution when converting Git...

8.8CVSS3.5AI score0.05405EPSS
SaveExploits0References2
Mageia
Mageia
added 2016/03/25 6:38 a.m.46 views

Updated filezilla packages fix security vulnerability

Many versions of PSCP in PuTTY prior to 0.67 have a stack corruption vulnerability in their treatment of the 'sink' direction i.e. downloading from server to client of the old-style SCP protocol. In order for this vulnerability to be exploited, the user must connect to a malicious server and...

9.8CVSS4.3AI score0.34216EPSS
SaveExploits4References4
Mageia
Mageia
added 2016/03/02 6:28 p.m.46 views

Updated wireshark packages fix security vulnerabilities

Updated wireshark packages fix security vulnerabilities: ASN.1 BER dissector crash CVE-2016-2522. DNP dissector infinite loop CVE-2016-2523. X.509AF dissector crash CVE-2016-2524. HTTP/2 dissector crash CVE-2016-2525. HiQnet dissector crash CVE-2016-2526. 3GPP TS 32.423 Trace file parser crash...

7.1CVSS1.4AI score0.03104EPSS
SaveExploits1References20
Mageia
Mageia
added 2016/02/19 8:40 a.m.46 views

Updated nodejs packages fix security vulnerability

A request smuggling vulnerability was found in Node.js that can be exploited under certain unspecified circumstances CVE-2016-2086. It was reported that HTTP header parsing in Node.js is vulnerable to response splitting attacks. While Node.js has been protecting against response splitting attacks...

7.5CVSS1.9AI score0.07013EPSS
SaveExploits0References4
Mageia
Mageia
added 2016/02/09 7:05 p.m.46 views

Updated nettle packages fix security vulnerabilities

Updated nettle2.7 and nettle packages fix security vulnerabilities: Two carry propagation bugs in elliptic curve scalar multiplications that affect the NIST P-256 curve. The bugs are in the C code and affect multiple architectures CVE-2015-8803, CVE-2015-8805. A carry propagation bug in elliptic...

9.8CVSS9.3AI score0.04212EPSS
SaveExploits0References3
Mageia
Mageia
added 2016/02/05 5:26 p.m.46 views

Updated krb5 packages fix security vulnerability

In all versions of MIT krb5, an authenticated attacker can cause kadmind to read beyond the end of allocated memory by sending a string without a terminating zero byte. Information leakage may be possible for an attacker with permission to modify the database CVE-2015-8629. In MIT krb5 1.12 and...

7.5CVSS6.5AI score0.04643EPSS
SaveExploits0References2
Mageia
Mageia
added 2016/01/29 11:02 a.m.46 views

Updated firefox packages fix security vulnerability

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2016-1930, CVE-2016-1935...

10CVSS4.1AI score0.05992EPSS
SaveExploits0References5
Mageia
Mageia
added 2015/11/19 10:08 p.m.46 views

Updated uglify-js packages fix security vulnerability

The UglifyJS node module has a problem where the combination of De Morgan's Law and non-boolean values can lead to a case where code is incorrectly minified, which can lead to possibly malicious minified JS code...

2.2AI score
SaveExploits0References2
Mageia
Mageia
added 2015/11/19 10:08 p.m.46 views

Updated libpng/libpng12 packages fix security vulnerability

Multiple buffer overflows in the pngsetPLTE and pnggetPLTE functions in libpng before 1.6.19 allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a small bit-depth value in an IHDR aka image header chunk in a PNG image CVE-2015-8126...

7.5CVSS8.5AI score0.10339EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/10/13 10:40 p.m.46 views

Updated openjpeg2 package fixes security vulnerability

Use-after-free vulnerability was found in j2k.c in opjj2kwritemco function rhbz1263359. Double free vulnerability in the opjj2kcopydefaulttcpandcreatetcd function in j2k.c in OpenJPEG allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption by triggeri...

7.5CVSS9.6AI score0.02677EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/09/08 5:55 p.m.46 views

Updated ruby-RubyGems packages fix security vulnerabilities

Updated ruby-RubyGems package fixes security vulnerability: RubyGems does not validate the hostname when fetching gems or making API request, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack" CVE-2015-3900...

5CVSS8.2AI score0.08934EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/09/08 5:55 p.m.46 views

Updated vorbis-tools packages fix CVE-2015-6749

Updated vorbis-tools package fixes security vulnerability: A buffer overread is possible in vorbis-tools in oggenc/audio.c when opening a specially crafted AIFF file CVE-2015-6749...

4.3CVSS5.9AI score0.03786EPSS
SaveExploits1References2
Mageia
Mageia
added 2015/08/03 8:55 p.m.46 views

Updated moodle package fixes security vulnerabilities

In Moodle before 2.8.7, phishing is possible when redirecting to external site using referer headers in error messages CVE-2015-3272. In Moodle before 2.8.7, several web services returning user information did not clean text in text custom profile fields, leading to possible XSS CVE-2015-3274. In...

7.4CVSS6.6AI score0.01849EPSS
SaveExploits0References6
Mageia
Mageia
added 2015/07/28 9:01 p.m.46 views

Updated springframework package fixes security vulnerability

In Spring Framework before 3.2.14, if DTD is not entirely disabled, inline DTD declarations can be used to perform denial of service attacks known as XML bombs. Such declarations are both well-formed and valid according to XML schema rules but when parsed can cause out of memory errors. To protec...

5.5CVSS6AI score0.02555EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/05/13 5:18 p.m.46 views

Updated rawtherapee packages fix CVE-2015-3885

Updated rawtherapee package fixes security vulnerability: The dcraw tool suffers from an integer overflow condition which lead to a buffer overflow. The vulnerability concerns the 'len' variable, parsed without validation from opened images, used in the ljpegstart function. A maliciously crafted...

4.3CVSS7.2AI score0.0544EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/05/08 11:54 p.m.46 views

Updated wordpress packages fix security vulnerabilities

Updated wordpress packages fixes security vulnerabilities: The wordpress package has been updated to version 3.9.6, which fixes multiple cross-site scripting issues, including CVE-2015-3440, and other bugs. Note that upstream has advised us that WordPress 3.9.x is no longer supported. As this...

4.3CVSS6.6AI score0.16889EPSS
SaveExploits2References3
Mageia
Mageia
added 2015/05/05 1:36 p.m.46 views

Updated gstreamer0.10-plugins-bad packages fix security vulnerabilities

Updated gstreamer0.10-plugins-bad packages fix security vulnerability: Aki Helin discovered a buffer overflow in the GStreamer plugin for MP4 playback, which could lead in the execution of arbitrary code CVE-2015-0797...

6.8CVSS8.2AI score0.05402EPSS
SaveExploits0References2
Mageia
Mageia
added 2015/04/30 9:57 p.m.46 views

Updated libreoffice packages fix CVE-2015-1774

Updated libreoffice packages fix security vulnerability: The HWP filter in LibreOffice before 4.3.7 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write CVE-2015-1774...

6.8CVSS7.5AI score0.07593EPSS
SaveExploits0References3
Mageia
Mageia
added 2015/04/15 9:01 a.m.46 views

Updated arj packages fix security vulnerabilities

Updated arj package fixes security vulnerabilities: ARJ follows symlinks when unpacking stuff, even the symlinks that were created during the same unpack process, making it vulnerable to a directory traversal CVE-2015-0556. To protect from directory traversals, ARJ strips leading slash from the...

7.5CVSS6.8AI score0.05848EPSS
SaveExploits2References2
Mageia
Mageia
added 2015/03/23 11:58 p.m.46 views

Updated firefox packages fix security vulnerabilities

A flaw was discovered in the implementation of typed array bounds checking in the Javascript just-in-time compilation. If a user were tricked in to opening a specially crafted website, an attacked could exploit this to execute arbitrary code with the privileges of the user invoking Firefox...

7.5CVSS9.6AI score0.03681EPSS
SaveExploits0References6
Mageia
Mageia
added 2015/01/17 10:31 p.m.46 views

Updated firefox and thunderbird packages fixes security vulnerabilities

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it CVE-2014-8634. It was found that the Beacon interface...

7.5CVSS9.7AI score0.04158EPSS
SaveExploits0References9
Mageia
Mageia
added 2015/01/09 4:44 p.m.46 views

Updated gcab packages fix CVE-2015-0552

Updated gcab packages fix security vulnerability: Jakub Wilk reported a directory traversal vulnerability due to gcab not filtering leading slashes from paths in CAB files CVE-2015-0552...

6.4CVSS6.3AI score0.02791EPSS
SaveExploits1References2
Mageia
Mageia
added 2015/01/05 4:30 p.m.46 views

Updated openvas-manager packages fix security vulnerability

Updated openvas-manager packages fixes security vulnerability: It has been identified that OpenVAS Manager before 4.0.6 is vulnerable to sql injections due to a improper handling of the timezone parameter in modifyschedule OMP command. It has been identified that this vulnerability may allow...

7.5CVSS6.2AI score0.02065EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/09/01 10:44 a.m.46 views

Updated distcc packages fix CVE-2014-4607

Updated distcc packages fix security vulnerability: An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The distcc package is...

8.8CVSS9.3AI score0.05315EPSS
SaveExploits1References2
Mageia
Mageia
added 2014/08/27 8:21 a.m.46 views

Updated kdenetwork4 packages fixes security vulnerability in krfb

An integer overflow in liblzo before 2.07 allows attackers to cause a denial of service or possibly code execution in applications using performing LZO decompression on a compressed payload from the attacker CVE-2014-4607. The libvncserver library is built with a bundled copy of minilzo, which is...

8.8CVSS9.3AI score0.05315EPSS
SaveExploits1References3
Mageia
Mageia
added 2014/08/22 10:58 a.m.46 views

Updated krb5 package fixes security vulnerabilities

MIT Kerberos 5 allows attackers to cause a denial of service via a buffer over-read or NULL pointer dereference, by injecting invalid tokens into a GSSAPI application session CVE-2014-4341, CVE-2014-4342. MIT Kerberos 5 allows attackers to cause a denial of service via a double-free flaw or NULL...

8.5CVSS9.2AI score0.08085EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/08/21 9:36 a.m.46 views

Updated python-imaging & python-pillow packages fix CVE-2014-3589

Updated python-imaging and python-pillow packages fix security vulnerabilities: The Python Imaging Library is vulnerable to a denial of service attack in the IcnsImagePlugin CVE-2014-3589...

5CVSS6.9AI score0.03362EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/07/26 12:57 p.m.46 views

Updated cacti package fixes security vulnerabilities

Multiple security issues cross-site scripting, cross-site request forgery, SQL injections, missing input sanitising have been found in Cacti CVE-2014-2326, CVE-2014-2328, CVE-2014-2708, CVE-2014-2709, CVE-2014-4002...

7.5CVSS7.2AI score0.04957EPSS
SaveExploits3References2
Mageia
Mageia
added 2014/07/08 10:47 p.m.46 views

Updated dpkg packages fixes security vulnerabilities

Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package, leading to the creation of files outside the directory of the source being unpacked CVE-2014-0471. Multiple vulnerabilities were discovered in dpkg...

6.4CVSS6.6AI score0.07322EPSS
SaveExploits2References3
Mageia
Mageia
added 2014/06/06 10:27 a.m.46 views

Updated wordpress package fixes multiple vulnerabilities

Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...

6.4CVSS6.3AI score0.0893EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/05/17 12:20 a.m.46 views

Updated postgresql packages fix multiple vulnerabilities

Updated postgresql packages fix security vulnerabilities: Granting a role without ADMIN OPTION is supposed to prevent the grantee from adding or removing members from the granted role, but this restriction was easily bypassed by doing SET ROLE first. The security impact is mostly that a role memb...

6.5CVSS9.5AI score0.06666EPSS
SaveExploits6References4
Mageia
Mageia
added 2014/05/03 4:37 p.m.46 views

Updated openssl packages fix CVE-2014-0198

Updated openssl packages fix security vulnerability: A null pointer dereference bug in OpenSSL 1.0.1g and earlier in sossl3write could possibly allow an attacker to cause generate an SSL alert which would cause OpenSSL to crash, resulting in a denial of service CVE-2014-0198...

4.3CVSS7.6AI score0.43828EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/03/07 2:16 p.m.46 views

Updated net-snmp packages fix two vulnerabilities

Updated net-snmp packages fix security vulnerabilities: Remotely exploitable denial of service vulnerability in Net-SNMP, in the Linux implementation of the ICMP-MIB, making the SNMP agent vulnerable if it is making use of the ICMP-MIB table objects CVE-2014-2284. Remotely exploitable denial of...

5CVSS6.2AI score0.03979EPSS
SaveExploits0References5
Mageia
Mageia
added 2014/02/26 6:23 p.m.46 views

Updated lxc packages fix security vulnerability

Florian Sagar discovered that the LXC sshd template set incorrect mount permissions. An attacker could possibly use this flaw to cause privilege escalation on the host CVE-2013-6441...

7.2CVSS2.3AI score0.00498EPSS
SaveExploits1References2
Mageia
Mageia
added 2014/02/21 6:10 p.m.46 views

Updated imagemagick package fixes security vulnerabilities

A buffer overflow flaw was found in the way ImageMagick handled PSD images that use RLE encoding. An attacker could create a malicious PSD image file that, when opened in ImageMagick, would cause ImageMagick to crash or, potentially, execute arbitrary code with the privileges of the user running...

8.8CVSS8.7AI score0.11055EPSS
SaveExploits1References4
Mageia
Mageia
added 2014/02/11 10:13 p.m.46 views

Updated chrony package fixes security vulnerability

Updated chrony package fixes security vulnerability: In the chrony control protocol some replies are significantly larger than their requests, which allows an attacker to use it in an amplification attack CVE-2014-0021. Note: in the default configuration, cmdallow is restricted to localhost, so...

7.5CVSS7.6AI score0.03801EPSS
SaveExploits0References2
Mageia
Mageia
added 2014/01/21 4:14 p.m.46 views

Updated memcached package fixes multiple security vulnerabilities

Updated memcached packages fix security vulnerability: It was reported that SASL authentication could be bypassed due to a flaw related to the managment of the SASL authentication state. With a specially crafted request, a remote attacker may be able to authenticate with invalid SASL credentials...

4.8CVSS3.6AI score0.01498EPSS
SaveExploits3References2
Mageia
Mageia
added 2014/01/06 1:23 a.m.46 views

Updated openssl package fixes security vulnerability

A flaw was reported for OpenSSL 1.0.1e, that can cause application using OpenSSL to crash when using TLS version 1.2 CVE-2013-6449. Also, a NULL pointer reference issue has been fixed in SSLgetcertificate mga11549...

4.3CVSS3.1AI score0.21174EPSS
SaveExploits0References3
Mageia
Mageia
added 2014/01/06 12:49 a.m.46 views

Updated cxf, wss4j, and jacorb packages fix security vulnerability

Multiple denial of service flaws were found in the way StAX parser implementation of Apache CXF, an open-source web services framework, performed processing of certain XML files. If a web service application utilized the services of the StAX parser, a remote attacker could provide a...

5CVSS3.5AI score0.32259EPSS
SaveExploits6References5
Mageia
Mageia
added 2013/12/19 9:10 p.m.46 views

Updated wireshark packages fix two security vulnerabilities

Updated wireshark packages fix security vulnerabilities: The SIP dissector could go into an infinite loop CVE-2013-7112. The NTLMSSP v2 dissector could crash CVE-2013-7114...

5CVSS1.8AI score0.02307EPSS
SaveExploits1References5
Mageia
Mageia
added 2013/10/09 10:47 p.m.46 views

Updated gnupg packages fix CVE-2013-4402

Updated gnupg package fixes security vulnerability: Special crafted input data may be used to cause a denial of service against GPG. GPG can be forced to recursively parse certain parts of OpenPGP messages ad infinitum CVE-2013-4402...

5CVSS3.6AI score0.0503EPSS
SaveExploits0References2
Mageia
Mageia
added 2013/09/19 9:37 a.m.46 views

Updated wireshark package fixes security vulnerabilities

The NBAP dissector could crash CVE-2013-5718. The ASSA R3 dissector could go into an infinite loop CVE-2013-5719. The RTPS dissector could overflow a buffer CVE-2013-5720. The MQ dissector could crash CVE-2013-5721. The LDAP dissector could crash CVE-2013-5722. The Netmon file parser could crash...

5CVSS3.7AI score0.0284EPSS
SaveExploits1References10
Mageia
Mageia
added 2013/08/30 5:33 p.m.46 views

Updated ngircd package fixes CVE-2013-5580

Updated ngircd package fixes security vulnerability: Denial of service bug server crash in ngIRCd before 20.3 which could happen when the configuration option "NoticeAuth" is enabled which is NOT the default and ngIRCd failed to send the "notice auth" messages to new clients connecting to the...

4.3CVSS2.2AI score0.02322EPSS
SaveExploits0References3
Mageia
Mageia
added 2013/07/26 11:54 a.m.46 views

Updated qemu package fixes CVE-2013-2231

Updated qemu packages fix security vulnerability: An unquoted search path flaw was found in the way the QEMU Guest Agent service installation was performed on Windows. Depending on the permissions of the directories in the unquoted search path, a local, unprivileged user could use this flaw to ha...

7.2CVSS3.1AI score0.00448EPSS
SaveExploits0References2
Mageia
Mageia
added 2013/06/26 6:36 p.m.46 views

Updated puppet packages fix remote code execution vulnerability

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an...

7.5CVSS3.8AI score0.03408EPSS
SaveExploits0References2
Mageia
Mageia
added 2026/06/27 5:16 p.m.45 views

Updated krb5 packages fix security vulnerabilities

CVE-2025-3576, A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity...

7.5CVSS5.8AI score0.00611EPSS
SaveExploits2References6
Mageia
Mageia
added 2025/11/18 2:47 a.m.45 views

Updated apache packages fix security vulnerabilities

HTTP response splitting. CVE-2024-42516 SSRF with modheaders setting Content-Type header. CVE-2024-43204 modssl error log variable escaping. CVE-2024-47252 modproxyhttp2 denial of service. CVE-2025-49630 modssl access control bypass with session resumption. CVE-2025-23048 modssl TLS upgrade attac...

6.9AI score0.04799EPSS
SaveExploits2References10
Mageia
Mageia
added 2025/11/13 11:37 p.m.45 views

Updated ruby packages fix security vulnerabilities

Net::IMAP vulnerable to possible DoS by memory exhaustion. CVE-2025-25186 In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in the CGI library contains a potential Denial of Service DoS vulnerability. The method does not impose any limit on the length of the raw cookie value it...

7.5CVSS7.2AI score0.00833EPSS
SaveExploits0References2
Mageia
Mageia
added 2025/06/02 5:55 p.m.45 views

Updated golang packages fix security vulnerabilities

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied - CVE-2025-22870. The net/http package...

7.1AI score0.00811EPSS
SaveExploits2References4
Mageia
Mageia
added 2025/05/13 8:56 p.m.45 views

Updated java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk & java-latest-openjdk packages fix security vulnerabilities

Better TLS connection support. CVE-2025-21587 Improve compiler transformations. CVE-2025-30691 Enhance Buffered Image handling. CVE-2025-30698 The updated timezone data are needed by the new Java packages...

7.4CVSS7.6AI score0.00818EPSS
SaveExploits0References6
Total number of security vulnerabilities5000