6314 matches found
Updated soundtouch packages fix security vulnerability
Updated soundtouch package fixes security vulnerabilities: - Reachable assertion in FIRFilter.cpp causing denial of service CVE-2018-14045. - Reachable assertion in RateTransposer::setChannels causing denial of service CVE-2018-14044. - Heap-based buffer overflow in...
Updated flash-player-plugin packages fix security vulnerability
Updated flash-player-plugin packages fix security vulnerability: Successful exploitation of the currently un-disclosed vulerability could lead to information disclosure CVE-2018-15967...
Updated ncurses packages fix security vulnerability
A flaw was found in ncurses before 6.1.20180414 where a NULL Pointer Dereference in the ncparseentry function of tinfo/parseentry.c could lead to a remote denial of service if the terminfo library code is used to process untrusted terminfo data in which a use-name is invalid syntax CVE-2018-10754...
Updated roundcubemail packages fix security vulnerability
Updated roundcubemail package fixes security vulnerability: This update fixes a recently discovered IMAP command injection vulnerability caused by insufficient input validation within the archive plugin. CVE-2018-9846...
Updated 389-ds-base packages fix security vulnerability
It was discovered that a lack of size check in slapictmemcmp function may lead to authentication bypass through pre-hashed userPassword attributes under highly specific circumstances CVE-2017-15135...
Updated advancecomp packages fix security vulnerability
Joonun Jang discovered a vulnerability in AdvanceCOMP that could be used to crash or run programs if it opened a specially crafted ZIP file...
Updated gifsicle package fixes security vulnerability
It was discovered that gifsicle contained a flaw that could lead to arbitrary code execution CVE-2017-1000421...
Updated flash-player-plugin package fixes security vulnerability
Adobe Flash Player 28.0.0.137 addresses an important out-of-bounds read vulnerability that could lead to information exposure CVE-2018-4871...
Updated flightgear packages fix security vulnerability
In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affects the contents of the global Property Tree. Mageia provides 2017.3.1 version as a security and bugfix update, allowing to connect to latest multiplayer serve...
Updated 389-ds-base packages fix security vulnerability
The directory server password lockout policy prevents binds from operating once a threshold of failed passwords has been met. During this lockout, if you bind with a successful password, a different error code is returned. This means that an attacker has no ratelimit or penalty during an account...
Updated perltidy packages fix security vulnerability
perltidy relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink CVE-2016-10374...
Updated gdm packages fix security vulnerability
It was found that gdm could crash due to a signal handler dispatched to an invalid conversation. An attacker could crash gdm by holding the escape key when the screen is locked, possibly bypassing the locked screen CVE-2015-7496...
Updated libetpan packages fix security vulnerability
It was discovered that libetpan, a C language mail access and handling library that is used in a number of MUAs, contained a NULL dereference vulnerability in the MIME handling code CVE-2017-8825...
Updated kodi packages fix security vulnerability
Updated Kodi package to fix world readable $HOME/.kodi directory which could potentially contain clear passwords for add-ons...
Updated putty packages fix security vulnerability
In PuTTY before 0.68, if SSH agent forwarding is enabled, local attackers that are also able to connect to the UNIX domain socket could have overwritten heap data CVE-2017-6542...
Updated lighttpd packages fix security vulnerability
Dominic Scheirlinck and Scott Geary of Vend reported an insecure behaviour in the lighttpd web server. Lighttpd assigned Proxy header values from client requests to internal HTTPPROXY environment variables. This could be used to carry out Man in the Middle Attacks MIDM or create connections to...
Updated libass packages fixes security vulnerabilities
Amount of memory allocated during memory reallocation in the shaper wasn't tracked, possibly resulting in undefined behavior CVE-2016-7972. Illegal read in Gaussian blur coefficient calculations CVE-2016-7970. Mode 0/3 line wrapping equalization in specific cases could result in illegal reads whi...
Updated python-twisted-web packages fix a security vulnerability
It was discovered that python-twisted-web used the value of the Proxy header from HTTP requests to initialize the HTTPPROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote...
Updated sudo packages fix security vulnerability
A vulnerability in functionality for adding support of SHA-2 digests along with the command was found. The sudoers plugin performs this digest verification while matching rules, and later independently calls execve to execute the binary. This results in a race condition if the digest functionalit...
Updated pidgin packages fix security vulnerability
A buffer overflows vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet...
Updated php-ZendFramework2 packages fix CVE-2015-7503
Updated php-ZendFramework2 packages fix security vulnerability: Zend\Crypt\PublicKey\Rsa\PublicKey has a call to opensslpublicencrypt which uses PHP's default $padding argument, which specifies OPENSSLPKCS1PADDING, indicating usage of PKCS1v1.5 padding. This padding has a known vulnerability, the...
Updated krb5 packages fix security vulnerability
It was reported that in all versions of MIT krb5, an authenticated attacker with permission to modify a principal entry can cause kadmind to dereference a null pointer by supplying an empty DB argument to the modifyprincipal command, if kadmind is configured to use the LDAP KDB module...
Updated cpio packages fix CVE-2016-2037
Updated cpio package fixes security vulnerability: An out-of-bounds write in cpio was found in the parsing of cpio files, in the processcopyin function in src/copyin.c CVE-2016-2037...
Updated gambas3 packages fix CVE-2013-7447
Updated gambas3 packages fix security vulnerability: Due to a logic error, an attempt to allocate a large block of memory fails in gtcairocreatesurface, leading to a crash of gambas3 CVE-2013-7447...
Updated pitivi packages fix security vulnerability
In pitivi before 0.95, double-clicking a file in the user's media library with a specially-crafted path or filename allows for arbitrary code execution with the permissions of the user running Pitivi CVE-2015-0855...
Updated python-curl packages fix security vulnerability
A use-after-free vulnerability was found in Curl object's HTTPPOST setopt when a Unicode value is passed as a value with a FORMBUFFERPTR. The str object created from the passed in unicode object would have its buffer used but the unicode object would be stored instead of the str object rhbz127748...
Updated stunnel package fixes security vulnerability
Johan Olofsson discovered an authentication bypass vulnerability in Stunnel, a program designed to work as an universal SSL tunnel for network daemons. When Stunnel in server mode is used with the redirect option and certificate-based authentication is enabled with "verify = 2" or higher, then on...
Updated libjpeg packages fix security vulnerability
Passing a specially crafted jpeg file to libjpeg-turbo could lead to stack smashing CVE-2014-9092...
Updated openvpn package fixes CVE-2014-8104
Updated openvpn packages fix security vulnerability: Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel packets. An authenticated attacker could use this issue to cause an OpenVPN server to crash, resulting in a denial of service CVE-2014-8104...
Updated srtp package fixes security vulnerability
Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol SRTP, in how the cryptopolicysetfromprofileforrtp function applies cryptographic profiles to an srtppolicy. A remote attacker could...
Updated apt packages fix security vulnerability
The Google Security Team discovered a buffer overflow vulnerability in the HTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP request to an apt repository can trigger the buffer overflow, leading to a crash of the "http" apt method binary, or potentially to arbitrary cod...
Updated sdcc packages fix a security vulnerability
Integer overflow, leading to heap-buffer overflow by processing certain file headers via bfd binary. CVE-2012-3509 A nonfree package is also now available, which provides components that cannot be included in the core repository. In addition, this update obsoletes sdcc2.9, which is old and probab...
Updated flash-player-plugin packages fix multiple vulnerabilities
Adobe Flash Player 11.2.202.378 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system. This updates resolves cross-site-scripting vulnerabilities CVE-2014-0531, CVE-2014-0532, CVE-2014-0533. Th...
Updated libkdcraw packages fix CVE-2013-1438 & CVE-2013-1439
Updated libkdcraw packages fix libraw security vulnerabilities: It was discovered that LibRaw incorrectly handled photo files. If a user or automated system were tricked into processing a specially crafted photo file, applications linked against LibRaw could be made to crash, resulting in a denia...
Updated python-scipy packages fix a security vulnerability and missing deps
Updated python-scipy package fixes security vulnerability: scipy.weave will use /tmp/username as persistent storage cache, but it does not check whether or not this directory already exists, does not check whether it is a directory or a symlink, and also does not verify permissions or ownership,...
Updated chromium-browser-stable package fix security vulnerabilities
The chrome 29 development team found various issues from internal fuzzing audits, and other studies CVE-2013-2887. Krystian Bigaj discovered a file handling path sanitization issue CVE-2013-2900. Alex Chapman discovered an integer overflow issue in ANGLE, the Almost Native Graphics Layer...
Updated fail2ban packages fix CVE-2013-2178
Krzysztof Katowicz-Kowalewski discovered a vulnerability in Fail2ban, a log monitoring and system which can act on attack by preventing hosts to connect to specified services using the local firewall. When using Fail2ban to monitor Apache logs, improper input validation in log parsing could enabl...
Updated perl-Module-Signature package fixes CVE-2013-2145
Arbitrary code execution vulnerability in Module::Signature before 0.72 CVE-2013-2145...
Updated sqlite3 packages fix security vulnerabilities
CVE-2026-50812: A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and SQLite trunk builds before check-in e807d4e3798efd53 allows an attacker who can supply a malformed changeset blob to cause a denial of service. The issue occurs when sqlite3changesetapplyv3 applies a...
Updated opensc packages fix security vulnerabilities
CVE-2025-66038 Memory corruption via improper compact-TLV length validation CVE-2025-66215 Stack-buffer-overflow with physical access via crafted smart card or USB device CVE-2025-49010 Stack-buffer-overflow via crafted smart card or USB device responses CVE-2025-66037 Out-of-bounds read via...
Updated ruby-net-ssh packages fix security vulnerabilities
This update fixes CVE-2023-48795: Prefix Truncation Attacks in SSH Specification Terrapin Attack , for ruby-net-ssh...
Updated sdl2_sound packages fix security vulnerability
Updated packages fix CVE-2025-14369 in bundled drflac...
Updated libcaca packages fix security vulnerability
Heap OOB write in canvas import functions caused by int overflow. CVE-2026-42046...
Updated graphicsmagick packages fix a security vulnerability
The updated packages fix a security vulnerability: Stack buffer overflow in XTileImage. CVE-2026-42050...
Updated perl-HTTP-Daemon package fixes a security vulnerability
The updated package fixes a security vulnerability: HTTP::Daemon versions before 6.17 for Perl allow OS command injection via sendfile. CVE-2026-8450...
Updated nginx packages fix security vulnerabilities
NGINX ngxquicmodule vulnerability. CVE-2026-40460 NGINX ngxhttpsslmodule vulnerability. CVE-2026-40701 NGINX ngxhttpproxyv2module vulnerability. CVE-2026-42926 NGINX ngxhttpcharsetmodule vulnerability. CVE-2026-42934 NGINX ngxhttprewritemodule vulnerability. CVE-2026-42945 NGINX ngxhttpscgimodule...
Updated mariadb packages fix security vulnerabilities
MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., and 11.0 through 11.0. can sometimes crash with an empty backtrace log. This may be related to makeaggrtablesinfo and optimizestage2 - CVE-2023-52969. MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through...
Updated dropbear packages fix security vulnerability
dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used...