6276 matches found
MGASA-2023-0241 Updated mediawiki packages fix security vulnerability
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many...
MGASA-2023-0239 Updated virtualbox packages fix security vulnerabilities
This update provides the upstream 7.0.10 maintenance release that fixes at least the following security vulnerabilities: Vulnerability in the Oracle VM VirtualBox prior to 7.0.10 contains an easily exploitable vulnerability that allows high privileged attacker with logon to the infrastructure whe...
MGASA-2023-0232 Updated mutt/neomutt packages fix security vulnerability
Out-of-bounds read in imap/util.c when an IMAP sequence set ends with a comma. CVE-2021-32055 Overflow in uudecoder in Mutt allows read past end of input line CVE-2022-1328...
MGASA-2023-0235 Updated firefox/nss packages fix security vulnerability
An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS CVE-2023-37201. Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free in...
MGASA-2023-0230 Updated maven packages fix security vulnerability
No longer use http non-SSL repository references by default...
MGASA-2023-0234 Updated php packages fix security vulnerability
Fixed SOAP bug GHSA-76gg-c692-v2mw Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP. CVE-2023-3247...
MGASA-2023-0236 Updated mingw-nsis packages fix security vulnerability
Mishandles access control for an uninstaller directory. CVE-2023-37378...
MGASA-2023-0231 Updated qt4/qtsvg5 packages fix security vulnerability
Out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend CVE-2021-45930 QtSvg QSvgFont munitsPerEm initialization is mishandled. CVE-2023-32573...
MGASA-2023-0237 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.120 and fixes atleast the following security issues: A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. This is fixed by removing DECnet support CVE-2023-3338...
MGASA-2023-0238 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.120 and fixes atleast the following security issues: A flaw null pointer dereference in the Linux kernel DECnet networking protocol was found. A remote user could use this flaw to crash the system. This is fixed by removing DECnet support...
MGASA-2023-0233 Updated texlive packages fix security vulnerability
Any document compiled with older versions of LuaTeX can execute arbitrary shell commands, even with shell escape disabled. CVE-2023-32700...
MGASA-2023-0216 Updated apache-ivy packages fix security vulnerability
Improper path allowed when extracting archive.CVE-2022-37865 Possible path traversal in download path CVE-2022-37866...
MGASA-2023-0227 Updated golang packages fix security vulnerability
Code injection via go command with cgo in cmd/go CVE-2023-29402 Ignoring setuid/setgid bits. CVE-2023-29403 Arbitrary code execution CVE-2023-29404 Arbitrary code execution CVE-2023-29405...
MGASA-2023-0214 Updated perl-DBD-SQLite packages fix security vulnerability
Possible unfixed security issues due to bundled sqlite3...
MGASA-2023-0226 Updated nodejs packages fix security vulnerability
Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates. This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs CVE-2023-30581: mainModule.proto Bypass Experimental Policy Mechanism High CVE-2023-30585: Privilege escalation via...
MGASA-2023-0219 Updated python-setuptools packages fix security vulnerability
Denial of service via crafted HTML CVE-2022-40897...
MGASA-2023-0224 Updated minidlna packages fix security vulnerability
Out-of-bounds read/write due to buffer overflow CVE-2023-33476...
MGASA-2023-0222 Updated opensc packages fix security vulnerability
Crash or info leak due to heap-based buffer out of bounds read CVE-2023-2977...
MGASA-2023-0217 Updated systemd packages fix security vulnerability
Local information leak due to systemd-coredump not respecting the fs.suiddumpable kernel setting CVE-2022-4415...
MGASA-2023-0221 Updated keepass packages fix security vulnerability
Allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. Disputed by vendor due to level of access required. CVE-2023-24055 Possible to recover the cleartext master password from a memory dump, even when a workspace is...
MGASA-2023-0213 Updated skopeo/buildah/podman packages fix security vulnerability
Information disclosure flaw was found in Buildah CVE-2021-3602 podman allows forwarding hosts ports to vm from within vm CVE-2021-4024 Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration CVE-2021-20206 github.com/containers/storag...
MGASA-2023-0220 Updated testng packages fix security vulnerability
Path traversal in zip files CVE-2022-4065...
MGASA-2023-0228 Updated curaengine packages fix security vulnerability
Denial of service due to integer overflow CVE-2022-28041...
MGASA-2023-0229 Updated webkit2 packages fix security vulnerability
Details not available at this time. CVE-2022-48503 Memory corruption issue may lead to arbitrary code execution CVE-2023-32435 Type confusion issue may lead to arbitrary code execution CVE-2023-32439...
MGASA-2023-0215 Updated glances packages fix security vulnerability
Regular Expression Denial of Service ReDoS in angular CVE-2022-25844...
MGASA-2023-0223 Updated cups packages fix security vulnerability
Use-after-free in cupsdAcceptClient. CVE-2023-34241...
MGASA-2023-0225 Updated libreoffice packages fix security vulnerability
Arbitrary File Write in hsqldb 1.8.0. CVE-2023-1183...
MGASA-2023-0218 Updated python-wheel packages fix security vulnerability
Denial of service via attacker controlled input to wheel cli CVE-2022-40898...
MGASA-2023-0210 Updated python-requests packages fix security vulnerability
Forwarding proxy credentials to the destination server unintentionally CVE-2023-32681...
MGASA-2023-0205 Updated libcap packages fix security vulnerability
A vulnerability was found in the pthreadcreate function in libcap. This issue may allow a malicious actor to use cause realpthreadcreate to return an error, which can exhaust the process memory. CVE-2023-2602 A vulnerability was found in libcap. This issue occurs in the libcapstrdup function and...
MGASA-2023-0212 Updated xonotic packages fix security vulnerability
A bug was discovered in versions older than 0.8.6 that is believed to be exploitable by malicious server admins to crash clients or, if they defeat mitigations, execute arbitrary code. No working exploit code is known to exist at this time, See referenced release notes for other changes...
MGASA-2023-0211 Updated python-tornado packages fix security vulnerability
Remote unauthenticated attacker may redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. CVE-2023-28370...
MGASA-2023-0204 Updated mediawiki packages fix security vulnerability
Bundled PapaParse copy in VisualEditor has known ReDos CVE-2020-36649. An issue was discovered in MediaWiki before 1.35.9. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These fil...
MGASA-2023-0209 Updated sofia-sip packages fix security vulnerability
The OOB read and integer-overflow made by attacker may lead to crash, high consumption of memory or even other more serious consequences. CVE-2023-32307...
MGASA-2023-0208 Updated sqlite packages fix security vulnerability
osunix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service application crash, or have unspecified other impact by leveraging use of the current working directory for...
MGASA-2023-0207 Updated docker-docker-registry packages fix security vulnerability
Denail of service through excessive use of memory. CVE-2023-2253...
MGASA-2023-0206 Updated libx11 packages fix security vulnerability
Buffer overflows in InitExt.c in libX11 prior to 1.8.6. CVE-2023-3138...
MGASA-2023-0202 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.117 and fixes atleast the following security issues: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs CVE-2022-48425. An out-of-bounds memory access flaw was fou...
MGASA-2023-0201 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.117 and fixes atleast the following security issues: In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs CVE-2022-48425. An out-of-bounds memory access flaw was found in...
MGASA-2023-0203 Updated sysstat packages fix security vulnerability
Multiplication integer overflow in checkoverflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. CVE-2023-33204...
MGASA-2023-0196 Updated httpie packages fix security vulnerability
Cookie exposure to third parties CVE-2022-24737...
MGASA-2023-0198 Updated cups packages fix security vulnerability
A heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function 'formatlogline' could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when...
MGASA-2023-0197 Updated webkit2 packages fix security vulnerability
Out-of-bounds read CVE-2023-28204 Use-after-free issue CVE-2023-32373...
MGASA-2023-0200 Updated thunderbird packages fix security vulnerability
Click-jacking certificate exceptions through rendering lag CVE-2023-34414 Memory safety bugs fixed in Thunderbird 102.12 CVE-2023-34416...
MGASA-2023-0199 Updated firefox/nss packages fix security vulnerability
Click-jacking certificate exceptions through rendering lag. CVE-2023-34414 Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12. CVE-2023-34416...
MGASA-2023-0195 Updated openssl packages fix security vulnerability
Possible DoS translating ASN.1 object identifiers. CVE-2023-2650...
MGASA-2023-0193 Updated python-flask packages fix security vulnerability
Client 'session' cookie sent to other clients CVE-2023-30861...
MGASA-2023-0194 Updated libreoffice packages fix security vulnerability
Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet...
MGASA-2023-0187 Updated postgresql packages fix security vulnerability
CREATE SCHEMA ... schemaelement defeats protective searchpath changes. CVE-2023-2454 Row security policies disregard user ID changes after inlining. CVE-2023-2455...