CLSA-2023-1691070506 Update of nss

Update to CKBI 2.62 from NSS 3.91 - Added: - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root CA2"...

CLSA-2023-1691070280 Update of ca-certificates

Update to CKBI 2.62 from NSS 3.91 - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root CA2"...

CLSA-2023-1691069752 Update of nss

Update to CKBI 2.62 from NSS 3.91 - Added: - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root CA2"...

CLSA-2023-1691068607 Update of ca-certificates

Update to CKBI 2.62 from NSS 3.91 - Certificate "BJCA Global Root CA1" - Certificate "BJCA Global Root CA2"...

CLSA-2023-1690395540 Fix of 12 CVEs

Bionic update: upstream stable patchset 2021-11-12 LP: 1950816 // CVE- url: https://ubuntu.com/security/CVE-2021-20321 - ovl: fix missing negative dentry check in ovlrename CVE-url: https://ubuntu.com/security/CVE-2021-20321 - ovl: cleanup unused var in rename2 Jammy update: v5.15.93 upstream...

CLSA-2023-1690395161 Fix of 12 CVEs

Bionic update: upstream stable patchset 2021-11-12 LP: 1950816 // CVE- url: https://ubuntu.com/security/CVE-2021-20321 - ovl: fix missing negative dentry check in ovlrename CVE-url: https://ubuntu.com/security/CVE-2021-20321 - ovl: cleanup unused var in rename2 Jammy update: v5.15.93 upstream...

CLSA-2023-1690294029 kernel: Fix of 29 CVEs

ALSA: pcm: Fix races among concurrent prealloc proc writes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent prepare and hwparams/hwfree calls CVE-2022-1048 - ALSA: pcm: Fix races among concurrent read/write and buffer changes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent hwparams and...

CLSA-2023-1690287378 kernel: Fix of 28 CVEs

ALSA: pcm: Fix races among concurrent prealloc proc writes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent prepare and hwparams/hwfree calls CVE-2022-1048 - ALSA: pcm: Fix races among concurrent read/write and buffer changes CVE-2022-1048 - ALSA: pcm: Fix races among concurrent hwparams and...

CLSA-2023-1689886440 python: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit - Also correct the first CVE-2023-24329 patch: Fix testattributesbadscheme to check for non-ascii symbol as first character of url...

CLSA-2023-1689886120 python: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit - Also correct the first CVE-2023-24329 patch: Fix testattributesbadscheme to check for non-ascii symbol as first character of url...

CLSA-2023-1689885970 Fix CVE(s): CVE-2023-24329

SECURITY UPDATE: urllib.parse space handling CVE-2023-24329 appears unfixed - debian/patches/CVE-2023-24329-2.patch: Start stripping C0 control and space chars in urlsplit - CVE-2023-24329...

CLSA-2023-1689885838 Fix CVE(s): CVE-2023-24329

SECURITY UPDATE: urllib.parse space handling CVE-2023-24329 appears unfixed - debian/patches/CVE-2023-24329-2-v2.7.patch: Start stripping C0 control and space chars in urlsplit - debian/patches/CVE-2023-24329-v2.7.patch: Fix testattributesbadscheme to check for non-ascii symbol as first character...

CLSA-2023-1689885583 python3: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit...

CLSA-2023-1689885378 python2: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit - Also correct the first CVE-2023-24329 patch: Fix testattributesbadscheme to check for non-ascii symbol as first character of url...

CLSA-2023-1689885237 python3: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit...

CLSA-2023-1689885005 python2: Fix of CVE-2023-24329

CVE-2023-24329: part2: Start stripping C0 control and space chars in urlsplit - Also correct the first CVE-2023-24329 patch: Fix testattributesbadscheme to check for non-ascii symbol as first character of url...

CLSA-2023-1689701064 Fix CVE(s): CVE-2021-3737

SECURITY UPDATE: Denial of service - debian/patches/CVE-2021-3737.patch: Fix http client infinite line reading DoS after a HTTP 100 continue in Lib/httplib.py, Lib/test/testhttplib.py. - CVE-2021-3737 take building tests into account, fix failed tests - debian/patches/expat-regression.patch: fix...

CLSA-2023-1689702499 openldap: Fix of CVE-2023-2953

CVE-2023-2953: added check for strdup failure, to avoid null pointer dereference...

CLSA-2023-1689702307 openldap: Fix of CVE-2023-2953

CVE-2023-2953: added check for strdup failure, to avoid null pointer dereference...

CLSA-2023-1689701864 perl: Fix of CVE-2023-31486

CVE-2023-31486: add verifySSL=1 to HTTP::Tiny default configuration...

CLSA-2023-1689701433 perl: Fix of CVE-2023-31486

CVE-2023-31486: add verifySSL=1 to HTTP::Tiny default configuration...

CLSA-2023-1689701258 Fix CVE(s): CVE-2021-20230

SECURITY UPDATE: Attacker bypasses redirection using unauthorized CA-signed certificate. - debian/patches/CVE-2021-20230.patch: Patch enhancing certificate verification process to prevent unauthorized redirection with CA-signed certificates by refining session data checks. - CVE-2021-20230 Fix...

CLSA-2023-1689701119 Fix CVE(s): CVE-2021-3738, CVE-2022-42898

SECURITY UPDATE: use after free in Samba AD DC RPC server - debian/patches/CVE-2021-3738-pre.patch: prepare service routines before fixing CVE-2021-3738 - debian/patches/CVE-2021-3738.patch: avoids a crash caused by use-after-free in Samba AD DC RPC server - CVE-2021-3738.patch SECURITY UPDATE:...

CLSA-2023-1689700589 Fix CVE(s): CVE-2023-31486

SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module - debian/patches/CVE-2023-31486.patch: add verifySSL=1 to HTTP::Tiny default configuration - CVE-2023-31486...

CLSA-2023-1689700476 Fix CVE(s): CVE-2023-31486

SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module - debian/patches/CVE-2023-31486.patch: add verifySSL=1 to HTTP::Tiny default configuration - CVE-2023-31486...

CLSA-2023-1689700365 Fix CVE(s): CVE-2023-2953

SECURITY UPDATE: null pointer dereference in bermemallocx - debian/patches/CVE-2023-2953.patch: added check for strdup failure in ldifopenurl, ldapurlparsehosts. - CVE-2023-2953...

CLSA-2023-1689259392 Fix CVE(s): CVE-2021-28861

SECURITY UPDATE: Redirection vulnerability in http.server - debian/patches/CVE-2021-28861.patch: Fix an open redirection vulnerability in the http.server module when an URI path starts with // - debian/patches/expat-regression.patch: some tests were fixed - CVE-2021-28861...

CLSA-2023-1689259028 Fix CVE(s): CVE-2022-37452, CVE-2022-32546, CVE-2023-34151

SECURITY UPDATE: undefined behaviors of casting double to sizet in svg, mvg and other coders recurring bugs of CVE-2022-32546 - debian/patches/CVE-2023-34151.patch: properly cast double to sizet - CVE-2022-37452...

CLSA-2023-1689258794 Fix CVE(s): CVE-2023-34241

SECURITY UPDATE: use after free - debian/patches/CVE-2023-34241.patch: call httpClose after logging. - CVE-2023-34241 Fix test/run-stp-tests.sh - debian/patches/waiting-limit.patch: limit the waiting for a server dunring tests...

CLSA-2023-1689258488 Fix CVE(s): CVE-2023-28486, CVE-2023-2848, CVE-2023-28487

SECURITY UPDATE: control characters are not escaped - debian/patches/CVE-2023-2848x.patch: escape control chars - CVE-2023-28486 - CVE-2023-28487...

CLSA-2023-1689258261 Fix CVE(s): CVE-2022-32546, CVE-2023-34151

SECURITY UPDATE: undefined behaviors of casting double to sizet in svg, mvg and other coders recurring bugs of CVE-2022-32546 - debian/patches/CVE-2023-34151.patch: properly cast double to sizet - CVE-2023-34151...

CLSA-2023-1689257904 openldap: Fix of CVE-2023-2953

CVE-2023-2953: added check for strdup failure, to avoid null pointer dereference...

CLSA-2023-1689257597 openldap: Fix of CVE-2023-2953

CVE-2023-2953: added check for strdup failure, to avoid null pointer dereference...

CLSA-2023-1689010064 Fix CVE(s): CVE-2022-29885

SECURITY UPDATE: EncryptInterceptor only provides partial protection on untrusted network - debian/patches/CVE-2022-29885.patch: Update the documentation to state that the EncryptInterceptor does not provide sufficient protection to run Tomcat clustering over an untrusted network. - CVE-2022-2988...

CLSA-2023-1689009963 Fix CVE(s): CVE-2022-29885

SECURITY UPDATE: EncryptInterceptor only provides partial protection on untrusted network - debian/patches/CVE-2022-29885.patch: Update the documentation to state that the EncryptInterceptor does not provide sufficient protection to run Tomcat clustering over an untrusted network. - CVE-2022-2988...

CLSA-2023-1689009763 Fix CVE(s): CVE-2021-40812

SECURITY UPDATE: Out of bounds read due to a lack of return value checks - debian/patches/CVE-2021-40812.patch: Added return value checks following calls to gdPutBuf in src/gdwebp.c and src/gdbmp.c - CVE-2021-40812...

CLSA-2023-1689009659 Update of alt-php

Backport the package from Ubuntu 18.04: New upstream version 2023c: - Egypt now uses DST again, from April through October. - This year Morocco springs forward April 23, not April 30. - Palestine delays the start of DST this year. - Much of Greenland still uses DST from 2024 on. The contents of...

CLSA-2023-1689009395 Fix of 9 CVEs

Backport upstream releases 8u372 to 16.04 LTS CVEs fixed in 8u372: - CVE-2023-21930: Improper connection handling during TLS handshake - CVE-2023-21937: Missing string checks for NULL characters - CVE-2023-21938: Incorrect handling of NULL characters in ProcessBuilder - CVE-2023-21939: Swing HTML...

CLSA-2023-1689009273 Fix CVE(s): CVE-2023-32324

SECURITY UPDATE: a heap buffer overflow vulnerability - debian/patches/CVE-2023-32324.patch: fix cupsstrlcpy to exit immideately if a length of the source string is zero - CVE-2023-32324...

CLSA-2023-1689009164 Fix CVE(s): CVE-2022-29404

SECURITY UPDATE: modlua may denial of service in r:parsebody0 - debian/patches/CVE-2022-29404.patch: use a liberal default limit for LimitRequestBody of 1GB to prevent a denial of service caused by a malicious lua script request - CVE-2022-29404...

CLSA-2023-1689008977 cups: Fix of CVE-2023-34241

CVE-2023-34241: Fix use-after-free for CupsAcceptClient...

CLSA-2023-1689008612 bind: Fix of CVE-2023-2828

CVE-2023-2828: fix possible DoS due to cache size limit exceed...

CLSA-2023-1689008452 cups: Fix of CVE-2023-34241

CVE-2023-34241: Fix use-after-free for CupsAcceptClient...

CLSA-2023-1689008238 bind: Fix of CVE-2023-2828

CVE-2023-2828: fix possible DoS due to cache size limit exceeded...

CLSA-2023-1688679628 java-1.8.0-openjdk: Fix of 7 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u372-b07. That fixes following CVEs: - CVE-2023-21930: Improper connection handling during TLS handshake 8294474 - CVE-2023-21937: Missing string checks for NULL characters 8296622 - CVE-2023-21938: Incorrect handling of NULL characters in...

CLSA-2023-1688679460 Update of tzdata

Upgrade to tzdata-2023c code and data are identical to 2023a - Egypt now uses DST again, from April through October. - This year Morocco springs forward April 23, not April 30. - Palestine delays the start of DST this year. - Much of Greenland still uses DST from 2024 on. - America/Yellowknife...

CLSA-2023-1688678794 Fix CVE(s): CVE-2023-26604

SECURITY UPDATE: local privilege escalation for some Sudo configurations - debian/patches/CVE-2023-26604.patch: set LESSSECURE to 1 - CVE-2023-26604 test issue: udev-test.pl is stopped by a timeout in a virtual environment - debian/patches/fix-udev-test.patch: skip this test in some cases...

CLSA-2023-1688678678 Fix CVE(s): CVE-2021-23240

SECURITY UPDATE: privilege escalation via symlinks - debian/patches/CVE-2021-23240.patch: fix opportunity for local unprivileged user to gain file ownership via symlinks. - CVE-2021-23240...

CLSA-2023-1688678532 Fix CVE(s): CVE-2021-41617

SECURITY UPDATE: Allows privilege escalation - debian/patches/CVE-2021-41617.patch: Added correct user group initialization. - CVE-2021-41617...

CLSA-2023-1688678407 Fix CVE(s): CVE-2023-2953

SECURITY UPDATE: null pointer dereference in bermemallocx - debian/patches/CVE-2023-2953.patch: added check for strdup failure in ldifopenurl, ldapurlparsehosts. - CVE-2023-2953...