6135 matches found
Updated nvidia390 packages fix security vulnerabilities
Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko, where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges,...
Updated poppler packages fix security vulnerability
A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service DoS via a crafted PDF file. CVE-2022-27337...
Updated python-django packages fix security vulnerability
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...
Updated golang packages fix security vulnerability
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service. CVE-2022-32189...
Updated libtiff packages fix security vulnerability
A stack overflow was discovered in the TIFFVGetField function of Tiffsplit CVE-2022-34526...
Updated ruby-sinatra packages fix security vulnerability
Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970...
Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.58 and fixes at least the following security issues: Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled CVE-2022-21505. Aliases in the branch predictor may cause some AMD processors to predict the wrong...
Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.58 and fixes at least the following security issues: Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled CVE-2022-21505. Aliases in the branch predictor may cause some AMD processors to predict the...
Updated python-m2crypto packages fix security vulnerability
Bleichenbacher timing attacks in the RSA decryption API CVE-2020-25657...
Updated mingw-giflib packages fix security vulnerability
It was discovered that giflib 5.2.1 including mingw-giflib which has giflib 5.2.1 bundled contained a heap-buffer-overflow in function DumpScreen2RGB CVE-2022-28506...
Updated sqlite3 packages fix security vulnerability
It was discovered that sqlite contained an assertion failure upon queries when compiled with -DSQLITEENABLESTAT4 CVE-2022-35737...
Updated osmo packages fix security vulnerability
Phishing website URL removed from package spec file and replaced with new official site link...
Updated chromium-browser-stable packages fix security vulnerability
1325699 High CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous on 2022-05-16 1335316 High CVE-2022-2604: Use after free in Safe Browsing. Reported by Nan Wang@eternalsakura13 and Guang Gong of 360 Alpha Lab on 2022-06-10 1338470 High CVE-2022-2605: Out of bounds read in Dawn. Report...
Updated webmin packages fix security vulnerability
The webmin package has been updated to version 1.998, fixing XSS issues in the HTTP Tunnel and Read Mail modules, along with several other bugs...
Updated python-ujson packages fix security vulnerability
Add support for arbitrary size integers. Replace 'wchart' string decoding implementation with a 'uint32t'-based one; fix handling of surrogates on decoding CVE-2022-31116 Potential double free of buffer during string decoding - Fix memory leak on encoding errors when the buffer was resized -...
Updated gdk-pixbuf2.0 packages fix security vulnerability
It was discovered that gdk-pixbuf contained a buffer overwrite in io-gif-animation.c compositeframe exploitable using a crafted GIF CVE-2021-46829...
Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to version 103.0.5060.134 branch, fixing many bugs and 11 CVE. Some of them are listed below. Use after free in Guest View. CVE-2022-2477 Use after free in PDF. CVE-2022-2478 Insufficient validation of untrusted input in File. CVE-2022-2479 Use...
Updated firefox packages fix security vulnerability
When visiting directory listings for chrome:// URLs as source text, some parameters were reflected CVE-2022-36318. When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed CVE-2022-36319...
Updated logrotate packages fix security vulnerability
Improved coredump handing for SUID binaries. bsc1192449...
Updated libtiff packages fix security vulnerability
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. CVE-2022-2056, CVE-2022-2057, CVE-2022-2058...
Updated virtualbox packages fix security vulnerabilities
This update provides the upstream 6.1.36 maintenance release that fixes at least the following security vulnerabilities: A vulnerability in the Oracle VM VirtualBox prior to 6.1.36 contains an easily exploitable vulnerability that allows a high privileged attacker with logon to the infrastructure...
Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.55 and fixes at least the following security issues: There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any privileges CVE-2022-2318. Xen Block and Networ...
Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.55 and fixes at least the following security issues: There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any privileges CVE-2022-2318. Xen Block and...
Updated golang packages fix security vulnerability
net/http: improper sanitization of Transfer-Encoding header The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to...
Updated java packages fix security vulnerability
OpenJDK: Defective secure validation in Apache Santuario Libraries, 8278008 CVE-2022-21476 OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions JAXP, 8270504 CVE-2022-21426 OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler Libraries, 8277672...
Updated pgadmin4 packages fix security vulnerability
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. CVE-2022-0959 In addition,...
Updated gerbv packages fix security vulnerability
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev commit b5f1eacd, and the forked version of Gerbv commit 71493260. CVE-2021-40391 An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling...
Updated python-coookiecutter packages fix security vulnerability
Command Injection via hg argument CVE-2022-24065...
Updated gnupg2 packages fix security vulnerability
In unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line. CVE-2022-34903...
Updated x11-server packages fix security vulnerabilities
Updated x11-server packages fix security vulnerabilities: ProcXkbSetGeometry Out-Of-Bounds Access. The handler for the ProcXkbSetGeometry request of the Xkb extension does not properly validate the request length leading to out of bounds memory write CVE-2022-2319. ProcXkbSetDeviceInfo...
Updated openssl packages fix security vulnerability
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption...
Updated webkit2 packages fix security vulnerability
The webkit2 package has been updated to version 2.36.4, fixing several security issues and other bugs...
Updated ruby-git packages fix security vulnerability
Command Injection via git argument injection CVE-2022-25648...
Updated squid packages fix security vulnerability
Denial of Service in Gopher Processing. CVE-2021-46784...
Updated firefox packages fix security vulnerability
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution CVE-2022-2200. An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing...
Updated thunderbird packages fix security vulnerability
A popup window could be resized in a way to overlay the address bar with web content. CVE-2022-34479 Use-after-free in nsSHistory. CVE-2022-34470 CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI. CVE-2022-34468 An email with a mismatching OpenPGP signature...
Updated cyrus-imapd packages fix security vulnerability
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service multiple-minute daemon hang via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. CVE-2021-33582...
Updated ruby-rack packages fix security vulnerability
Crafted multipart POST request may cause a DoS CVE-2022-30122 Crafted requests can cause shell escape sequences CVE-2022-30123...
Updated curl packages fix security vulnerability
Set-Cookie denial of service. CVE-2022-32205 HTTP compression denial of service. CVE-2022-32206 Unpreserved file permissions. CVE-2022-32207 FTP-KRB bad message verification. CVE-2022-32208...
Updated python-pyjwt packages fix security vulnerability
An attacker submitting the JWT token can choose the used signing algorithm CVE-2022-29217...
Updated openssl packages fix security vulnerability
The crehash script allows command injection. CVE-2022-2068...
Updated python-bottle packages fix security vulnerability
Bottle before 0.12.20 mishandles errors during early request binding. CVE-2022-31799...
Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.50 and fixes at least the following security issues: Incomplete cleanup of multi-core shared buffers for some Intel Processors may allow an authenticated user to potentially enable information disclosure via local access CVE-2022-21123. Incomplete...
Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.50 and fixes at least the following security issues: Incomplete cleanup of multi-core shared buffers for some Intel Processors may allow an authenticated user to potentially enable information disclosure via local access CVE-2022-21123. Incomplet...
Updated exo packages fix security vulnerability
Changed to prevent executing possibly malicious .desktop files from online sources ftp://, http:// etc...
Updated 389-ds-base packages fix security vulnerability
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows...
Updated libtiff packages fix security vulnerability
Heap-buffer-overflow in TIFFReadRawDataStriped in tiffinfo.c. CVE-2022-1354 Stack-buffer-overflow in tiffcp.c in main. CVE-2022-1355 Out-of-bounds read in LZWDecode. CVE-2022-1622, CVE-2022-1623...
Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 103.0.5060.53 branch, fixing many bugs and 14 CVE. Some of them are listed below: Use after free in Base. CVE-2022-2156 Use after free in Interest groups. CVE-2022-2157 Type Confusion in V8. CVE-2022-2158 Insufficient policy enforcement ...
Updated php packages fix security vulnerability
CLI -Fixed bug 8575 CLI closes standard streams too early. Core -Fixed Haiku ZTS builds. Date -Fixed bug 8471 Segmentation fault when converting immutable and mutable DateTime instances created using reflection. php-fpm - Fixed bug 72185 writes empty fcgi record causing nginx 502. Mysqlnd - Fixed...
Updated exempi packages fix security vulnerability
XMP Toolkit SDK versions 2020.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victi...