6277 matches found
MGASA-2023-0342 Updated firefox packages fix security vulnerabilities
The updated packages fix security vulnerabilities. Out-of-bound memory access in WebGL2 blitFramebuffer. CVE-2023-6204 Use-after-free in MessagePort::Entangled. CVE-2023-6205 Clickjacking permission prompts using the fullscreen transition. CVE-2023-6206 Use-after-free in...
MGASA-2023-0343 Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities. Out-of-bound memory access in WebGL2 blitFramebuffer. CVE-2023-6204 Use-after-free in MessagePort::Entangled. CVE-2023-6205 Clickjacking permission prompts using the fullscreen transition. CVE-2023-6206 Use-after-free in...
MGASA-2023-0340 Updated samba packages fix security vulnerabilities
This update fixes the security issues below. A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call RPC services like...
MGASA-2023-0339 Updated libqb packages fix a security vulnerability
This update fixes a security issue. logblackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered CVE-2023-39976...
MGASA-2023-0335 Updated virtualbox packages fix security vulnerabilities and other bugs
This update fixes several security issues and other bugs, among them: Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.12. Easily exploitable vulnerability allows high privileged attacker with logon t...
MGASA-2023-0337 Updated galera package fixes a security vulnerability
new version: 26.4.16, fixes CVE-2023-22084 mga32574...
MGASA-2023-0336 Updated audiofile packages fix a security vulnerability
The updated packages fix a security vulnerability In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring...
MGASA-2023-0338 Updated libvpx packages fix a security vulnerability
The updated packages fix a security vulnerability VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488...
MGASA-2023-0333 Updated optipng packages fix a security vulnerability
Updated the optipng package to fix a security vulnerability CVE-2023-43907 and other bugs. The GIF handler was vulnerable to a global buffer overflow...
MGASA-2023-0334 Updated xrdp packages fix security vulnerability
The updated packages fix a security vulnerability Access to the font glyphs in xrdppainter.c is not bounds-checked. Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a...
MGASA-2023-0332 Updated roundcubemail packages fix XSS security vulnerabilities
Updated roundcubemail package fixes security vulnerabilities: Fix cross-site scripting XSS vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download CVE-2023-47272 Fix cross-site scripting XSS vulnerability in handling of SVG in HTML messages. CVE-2023-5631 Some...
MGASA-2023-0331 Updated kernel-linus packages fix security vulnerabilities
This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues: A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue ma...
MGASA-2023-0330 Updated python-django package fixes security vulnerability
It was discovered that python-django EmailValidator and URLValidator were subject to potential regular expression denial of service attack via a very large number of domain name labels of emails and URLs CVE-2023-36053...
MGASA-2023-0329 Updated docker packages fix security vulnerabilities and bugs
This update fixes several security issues and also solves some other issues - manage change of launch option earlier in post process - Automatically convert -g option to --data-root in installed /etc/sysconfig/docker-storage - Fix CVE-2023-26054 and CVE-2023-28840-2...
MGASA-2023-0328 Updated kernel packages fix security vulnerabilities and other bugs
This kernel update is based on upstream 6.5.11 and fixes or adds mitigations for at least the following security issues: A use-after-free vulnerability was found in drivers/nvme/target/tcp.c in nvmettcpfreecrypto due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue ma...
MGASA-2023-0327 Updated mariadb packages fix a security vulnerability
Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server. Additonally a whole bunch of fixes to InnoDB, Replication, Optimizer, Galera, Spider, Backup,... have been applied. See the official release not...
MGASA-2023-0326 Updated java openjdk packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Segmentation fault in ciMethodBlocks. CVE-2022-40433 Certificate path validation issue during client authentication. CVE-2023-22081 IOR deserialization issue in CORBA. CVE-2023-22067...
MGASA-2023-0325 Updated lilypond packages fix a security vulnerability
Updated lilypond packages fix a security vulnerability: LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated by dangerous Scheme code in a .ly file that causes arbitrary code execution during conversion to a...
MGASA-2023-0324 Updated postgresql packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Memory disclosure in aggregate function calls. CVE-2023-5868 Buffer overrun from integer overflow in array modification. CVE-2023-5869 Role pgsignalbackend can signal certain superuser processes. CVE-2023-5870...
MGASA-2023-0323 Fix u-boot reading file would overwrite reserved memory error
U-boot would not boot after upgrading to 2023.01 version on RPI 4/CM4 boards. Log would report: - Found EFI removable media binary efi/boot/bootaa64.efi - Reading file would overwrite reserved memory The updated package allows u-boot to load properly bootaa64.efi...
MGASA-2023-0322 Updated chromium-browser-stable packages fix bugs and vulnerabilities
The chromium-browser-stable package has been updated to the 119.0.6045.159 release, fixing bugs and 15 vulnerabilities, together with 119.0.6045.123 and 119.0.6045.105; some of them are listed below: High CVE-2023-5480: Inappropriate implementation in Payments. Reported by Vsevolod Kokorin Slonse...
MGASA-2023-0321 Updated tigervnc packages fix security vulnerabilities
The updated packages fix security vulnerabilities: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty. CVE-2023-5367 Use-after-free bug in DestroyWindow. CVE-2023-5380...
MGASA-2023-0320 Updated haproxy packages fix security vulnerability
Haproxy has fixed security and other issues in last upstream version 2.8.3 of branch 2.8 Default user access are now commented out to prevent local action possible exploit and prevent further rpmnew on future updates. Use a check script to have config check result in error log on failure. Fix...
MGASA-2023-0318 Updated freerdp packages fix security vulnerabilities
This issue affects Clients only: Integer underflow leading to DOS e.g. abort due to WINPRASSERT with default compilation flags. When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service DOS vulnerability...
MGASA-2023-0319 Updated tomcat packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error cou...
MGASA-2023-0317 Updated quictls packages fix a security vulnerability
The updated packages fix a security vulnerability: Incorrect cipher key & IV length processing. CVE-2023-5363...
MGASA-2023-0316 Updated vorbis-tools packages fix a security vulnerability
The upstream patch to fix CVE-2023-43361 was added...
MGASA-2023-0315 Updated squid packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Request/Response smuggling in HTTP/1.1 and ICAP. CVE-2023-46846 Denial of Service in HTTP Digest Authentication. CVE-2023-46847 Denial of Service in FTP. CVE-2023-46848...
MGASA-2023-0314 Updated vim packages fix a security vulnerability
The updated packages fix a security vulnerability: Integer overflow in :history Ex-Command in Vim 9.0.2068...
MGASA-2023-0311 Updated gnome-shell packages fix a security vulnerability
The updated packages fix a security vulnerability: GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. CVE-2023-43090...
MGASA-2023-0313 Updated openssl packages fix a security vulnerability
The updated packages fix a security vulnerability: Incorrect cipher key & IV length processing. CVE-2023-5363...
MGASA-2023-0312 Updated zlib packages fix a security vulnerability
The updated packages fix a security vulnerability: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. CVE-2023-45853...
MGASA-2023-0308 Updated nss and firefox packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Queued up rendering could have allowed websites to clickjack. CVE-2023-5721 Address bar spoofing via bidirectional characters. CVE-2023-5732 Large WebGL draw could have led to a crash. CVE-2023-5724 WebExtensions could open arbitrary URLs...
MGASA-2023-0309 Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Queued up rendering could have allowed websites to clickjack. CVE-2023-5721 Address bar spoofing via bidirectional characters. CVE-2023-5732 Large WebGL draw could have led to a crash. CVE-2023-5724 WebExtensions could open arbitrary URLs...
MGASA-2023-0310 Updated libsndfile packages fix a security vulnerability
Add upstream patch to fix CVE-2022-33065...
MGASA-2023-0307 Updated x11-server packages fix security vulnerabilities
The updated packages fix security vulnerabilities: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty. CVE-2023-5367 Use-after-free bug in DestroyWindow. CVE-2023-5380 Use-after-free bug in DamageDestroy. CVE-2023-5574...
MGASA-2023-0306 Updated chromium-browser-stable packages fix bugs including security vulnerabilities
The chromium-browser-stable package has been updated to the 118.0.5993.117 release, fixing bugs and 3 vulnerabilities, together with 118.0.5993.88; some of them are listed below: High CVE-2023-5472: Use after free in Profiles...
MGASA-2023-0305 Updated vim packages fix security vulnerabilities
The updated packages fix security vulnerabilities: NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010. CVE-2023-5535...
MGASA-2023-0303 Updated bind packages fix security vulnerabilities
The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory,...
MGASA-2023-0304 Updated apache packages fix security vulnerabilities
Apache has been updated to version 2.4.58 to fix several security issues. CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST cve.mitre.org When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were n...
MGASA-2023-0302 Updated python-nltk package fixes a security vulnerability
python-nltk 3.6.6 update resolves ReDoS opportunity by fixing incorrectly specified regex...
MGASA-2023-0301 Updated redis package fixes a security vulnerability
Redis upstream published a fix for CVE-2023-45145. CVE-2023-45145: The wrong order of listen2 and chmod2 calls creates a race condition that can be used by another process to bypass desired Unix socket permissions on startup...
MGASA-2023-0300 Updated libcue packages fix a security vulnerability
Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by downloading a cue sheet from a malicious webpage. Because the file is saved to /Downloads, it is then automatically scanned by tracker-miners. And because it has a .c...
MGASA-2023-0294 Updated shadow-utils packages fix a security vulnerability
The updated packages fix a security vulnerability: Potential password leak. CVE-2023-4641...
MGASA-2023-0296 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 6.4.16 and fixes or adds mitigations for atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be...
MGASA-2023-0298 Updated libxml2 packages fix a security vulnerability
libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. CVE-2023-45322...
MGASA-2023-0295 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 6.4.16 and fixes or adds mitigations for atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often...
MGASA-2023-0297 Updated cadence packages fix security vulnerabilities
Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created by a local adversary before Cadence started. The adversary can then delete the file, disrupting Cadence. CVE-2023-43782 Cadence through 0.9.2 2023-08-21 uses...
MGASA-2023-0299 Updated nodejs packages fix security vulnerabilities
This is a security release. The following CVEs are fixed in this release: CVE-2023-44487: nghttp2 Security Release High CVE-2023-45143: undici Security Release High CVE-2023-38552: Integrity checks according to policies can be circumvented Medium CVE-2023-39333: Code injection via WebAssembly...
MGASA-2023-0292 Updated libxpm packages fix security vulnerabilities
A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system. CVE-2023-43788 Out of bounds read on XPM with corrupted colormap...