6209 matches found
Updated apache packages fix security vulnerabilities
HTTP response splitting. CVE-2024-42516 SSRF with modheaders setting Content-Type header. CVE-2024-43204 modssl error log variable escaping. CVE-2024-47252 modproxyhttp2 denial of service. CVE-2025-49630 modssl access control bypass with session resumption. CVE-2025-23048 modssl TLS upgrade attac...
Updated python-flask-cors packages fix security vulnerabilities
Log Injection Vulnerability in corydolphin/flask-cors. CVE-2024-1681 Improper Access Control in corydolphin/flask-cors. CVE-2024-6221 Improper Regex Path Matching in corydolphin/flask-cors. CVE-2024-6839 Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-cors...
Updated pam packages fix security vulnerability
libpam vulnerable to leaking hashed passwords. CVE-2024-10041...
Updated dcmtk packages fix security vulnerabilities
A buffer overflow in DCMTK allows attackers to cause a Denial of Service DoS via a crafted DCM file CVE-2025-25472. DCMTK was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h CVE-2025-25474. A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK allo...
Updated postgresql15 & postgresql13 packages fix security vulnerability
PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation. CVE-2025-1094...
Updated php-tcpdf packages fix security vulnerabilities
An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute. CVE-2024-56519 An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPTSSLVERIFYHOST and CURLOPTSSLVERIFYPEER are set unsafely. CVE-2024-56521 An issue was discovered in...
Updated libxml2 packages fix security vulnerability
xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. CVE-2022-49043...
Updated assimp packages fix security vulnerability
Heap-based buffer overflow vulnerability in Assimp allows a local attacker to execute arbitrary code by inputting a specially crafted file into the program...
Updated emacs packages improve Wayland support and fix a security vulnerability
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %... link abbrev even when it specifies an unsafe function, such as shell-command-to-string. CVE-2024-39331...
Updated strongswan packages fix security vulnerability
Fixes CVE-2023-41913 buffer overflow and possible RCE, various IKEv2 improvements...
Updated wireshark packages fix security vulnerabilities
Memory handling issue in editcap could cause denial of service via crafted capture file. CVE-2024-4853 MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file. CVE-2024-485...
Updated python-sqlparse packages fix security vulnerability
Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...
Updated tpm2-tss packages fix security vulnerabilities
A flaw was found in the tpm2-tss package, where there was no check that the magic number in the attest is equal to the TPM2GENERATEDVALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by FapiVerifyQuote...
Updated xfig packages fix security vulnerability
Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints. CVE-2023-45920...
Updated irssi packages fix security vulnerabilities
The updated packages fix a security vulnerability: Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference. This occurs when printing of a non-formatted line is concurrent with printing of a formatted line. CVE-2023-29132...
Updated ghostscript packages fix a security vulnerability
The updated packages fix a security vulnerability. An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. CVE-2023-46751...
Updated fish packages fix a security vulnerability
Mageia 9 is updated to version 3.6.4 to fix CVE-2023-49284. Mageia 8 receives an upstream patch to fix CVE-2023-49284. CVE-2023-49284: fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command...
Updated virtualbox packages fix security vulnerabilities and other bugs
This update fixes several security issues and other bugs, among them: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon t...
Updated vim packages fix security vulnerability
Use of Out-of-range Pointer Offset in GitHub repository vim/vim. CVE-2023-2426...
Updated sniproxy packages fix security vulnerability
A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy. A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a malicious packet to trigger this vulnerability. CVE-2023-25076...
Updated libheif packages fix security vulnerability
Vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. An attacker could exploit this through a crafted image file to cause a buffer overflow in linear memory during a memcpy call. CVE-2023-0996...
Updated jupyter-core packages fix security vulnerability
Arbitrary code execution when loading configuration files CVE-2022-39286...
Updated cups packages fix security vulnerability
Authentication bypass and code execution vulnerability. CVE-2022-26691...
Updated logrotate packages fix security vulnerability
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an...
Updated python-rencode packages fix security vulnerability
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding such as via ;\x2f\x7f, enabling a remote attack that consumes CPU and memory. CVE-2021-40839...
Updated cpanminus packages fix security vulnerability
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. CVE-2020-16154...
Updated roundcubemail packages fix security vulnerability
XSS in handling an attachment's filename extension when displaying a MIME type warning message CVE-2021-44025. Potential SQL injection via search or searchparams CVE-2021-44026...
Updated cloud-init packages fix security vulnerability
cloud-init has the ability to generate and set a randomized password for system users. This functionality is enabled at runtime by passing cloud-config data such as: 'chpasswd: list: | user1:RANDOM' When instructing cloud-init to set a random password for a new user account, versions before 21.1....
Updated mediawiki packages fix security vulnerability
XSS vulnerability in Special:Search. CVE-2021-41798 ApiQueryBacklinks can cause a full table scan. CVE-2021-41799 Fix PoolCounter protection of Special:Contributions. CVE-2021-41800 ReplaceText continues performing actions if the user no longer has the correct permission such as by being blocked...
Updated cockpit packages fix security vulnerability
Restrict frame embedding to same origin...
Updated icu packages fix security vulnerability
Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2021-30535...
Updated lynx packages fix security vulnerability
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because they may appear in SNI data. CVE-2021-38165...
Updated nextcloud-client packages fix security vulnerability
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow. CVE-2021-22895 In versions prior to 3.3.0, the Nextcloud Desktop client fails to check if a private key belongs to...
Updated spice packages fix security vulnerability
Updated spice packages fix security vulnerability: A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service CPU consumption by performing many renegotiations within a single connection CVE-2021-20201...
Updated php-phpmailer package fixes security vulnerability
PHPMailer contained a vulnerability that can result in untrusted code being called CVE-2021-3603. See upstream release notes...
Updated pjproject packages fix a security vulnerability
An issue has been found in pjproject. Due to bad handling of two consecutive crafted answers to an INVITE, the attacker is able to crash the server resulting in a denial of service CVE-2021-21375...
Updated qtwebsockets5 packages fix a security vulnerability
In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier for attackers to cause a denial of service memory consumption CVE-2018-21035...
Updated python-pikepdf packages fix security vulnerability
models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries CVE-2021-29421...
Updated upx packages fix security vulnerabilities
The updated package fixes security vulnerabilities: A heap buffer overflow read was discovered in upx 4.0.0, because the check in plxelf.cpp is not perfect. CVE-2020-24119 A flaw was found in upx canPack in plxelf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service SEGV or...
Updated dnsmasq packages fix a security vulnerability
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ...
Updated sdl2 packages fix security vulnerabilities
This update fixes two security vulnerabilities which could result in heap corruption or over-read with crafted .BMP files CVE-2020-14409, CVE-2020-14410...
Updated screen packages fix security vulnerability
Felix Weinmann reported a flaw in the handling of combining characters in screen, which can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence CVE-2021-26937...
Updated gnome-autoar packages fix security vulnerability
Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution CVE-2020-36241...
Updated mutt packages fix a security vulnerability
It was discovered that Mutt incorrectly handled certain email messages. An attacker could possibly use this issue to cause a denial of service because rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service mailbox unavailability by sending email messages with sequence...
Updated perl-DBI packages fix security vulnerabilities
An issue was discovered in the DBI module before 1.643 for Perl. The hvfetch documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOKprofile, causing a NULL pointer dereference. CVE-2019-20919. An untrusted pointer dereference flaw was found in...
Updated nvidia390 packages fix security vulnerabilities
NVIDIA GPU Display Driver Linux contains a vulnerability in the kernel mode layer nvidia.ko IOCTL in which user-mode clients can access legacy privileged APIs, which may lead to denial of service, escalation of privileges, and information disclosure CVE‑2021‑1052. NVIDIA GPU Display Driver for...
Updated x11vnc package fixes a security vulnerability
scan.c in x11vnc 0.9.16 uses IPCCREAT|0777 in shmget calls, which allows access by actors other than the current user. CVE-2020-29074...
Updated libexif packages fix a security vulnerability
In exifentrygetvalue of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for...
Updated packagekit packages fix a security vulnerability
It was discovered that packagekit was subject to a vulnerability where the InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit accesses given files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the...