3434 matches found
MGASA-2018-0334 Updated lftp packages fix security vulnerability
Updated lftp packages fix security vulnerability Lftp 4.8.4 bring a security fix for "file:" file names. From version 4.7.7 which was previous MGA6 lftp version, it brings also several new parameters like the -P option for parallel transfers...
MGASA-2018-0327 Updated libjpeg packages fix security vulnerabilities
Updated libjpeg package fixes security vulnerabilities: It was found that libjpeg is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image CVE-2018-1152. It was found that libjpeg had a defect where, due to a mishandled EOF, a specially...
MGASA-2018-0333 Updated godot packages fix security vulnerability
Updated godot packages fix security vulnerability Fabio Alessandrelli found and fixed several security vulnerabilities in the marshalling code of Godot Engine, which could be used by a remote Godot client to cause a Denial of Service for a Godot server. This update to Godot 2.1.5 fixes it, as wel...
MGASA-2018-0325 Updated wesnoth packages fix security vulnerability
The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and play...
MGASA-2018-0322 Updated microcode packages fix security vulnerability
This microcode update provides the first set of fixes for Speculative Store Bypass SSBD, Spectre v4, CVE-2018-3639 and Rogue System Register Read RSRE, Spectre v3a, CVE-2018-3640 for Intel Sandybridge server, Ivy Bridge server, Haswell server, Skylake server, Broadwell server, a few HEDT Core i7/...
MGASA-2018-0320 Updated wireshark packages fix security vulnerabilities
RPKI-Router infinite loop CVE-2018-7325. MMSE dissector infinite loop CVE-2018-14339. Multiple dissectors could crash CVE-2018-14340. DICOM dissector crash CVE-2018-14341. BGP dissector large loop CVE-2018-14342. ASN.1 BER dissector crash CVE-2018-14343. ISMP dissector crash CVE-2018-14344. Bazaa...
MGASA-2018-0321 Updated thunderbird packages fix security vulnerabilities
The updated packages fix several bugs and some security issues: Buffer overflow using computed size of canvas element. CVE-2018-12359 Use-after-free when using focus. CVE-2018-12360 S/MIME and PGP decryption oracles can be built with HTML emails. CVE-2018-12372 S/MIME plaintext can be leaked...
MGASA-2018-0316 Updated thunderbird packages fix security vulnerabilities
The updated packages fix several bugs and some security issues: Buffer overflow using computed size of canvas element. CVE-2018-12359 Use-after-free when using focus. CVE-2018-12360 S/MIME and PGP decryption oracles can be built with HTML emails. CVE-2018-12372 S/MIME plaintext can be leaked...
MGASA-2018-0315 Updated flash-player-plugin packages fix security vulnerabilities
Updated flash-player-plugin packages fix security vulnerabilities: A type confusion vulnerability that could lead to arbitrary code execution CVE-2018-5007. An out of bounds read that could lead to information disclosure CVE-2018-5008...
MGASA-2018-0312 Updated w3m packages fix security vulnerability
It was discovered that w3m incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service CVE-2018-6196, CVE-2018-6197. It was discovered that w3m incorrectly handled temporary files. An attacker could possibly use this to overwrite arbitrary files...
MGASA-2018-0313 Updated mailman packages fix security vulnerability
It was discovered that mailman version prior to 2.1.27 contained a vulnerability where malicious list owners could inject evil scripts into listinfo pages CVE-2018-0618...
MGASA-2018-0306 Updated libcrypt packages fix a security vulnerability
Updated libgcrypt packages fix security vulnerability: When libgcrypt uses the private key to create a signature, such as for a TLS or SSH connection, it inadvertently leaks information through memory caches. An unprivileged attacker running on the same machine can collect the information from a...
MGASA-2018-0305 Updated firefox packages fix security vulnerability
Mozilla: Memory safety bugs fixed in Firefox ESR 52.9 CVE-2018-5188. Mozilla: Buffer overflow using computed size of canvas element CVE-2018-12359. Mozilla: Use-after-free using focus CVE-2018-12360. Mozilla: Media recorder segmentation fault when track type is changed during capture CVE-2018-515...
MGASA-2018-0299 Updated ncurses packages fix security vulnerability
A flaw was found in ncurses before 6.1.20180414 where a NULL Pointer Dereference in the ncparseentry function of tinfo/parseentry.c could lead to a remote denial of service if the terminfo library code is used to process untrusted terminfo data in which a use-name is invalid syntax CVE-2018-10754...
MGASA-2018-0304 Updated phpmyadmin packages fix security vulnerability
A Cross-Site Scripting vulnerability was found in the Designer feature, where an attacker can deliver a payload to a user through a specially-crafted database name...
MGASA-2018-0298 Updated java-1.8.0-openjdk packages fix security vulnerability
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Stor...
MGASA-2018-0303 Updated ansible packages fix security vulnerability
Ansible prior to 2.4.5 does not honor the nolog task flag for failed tasks. When the nolog flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user...
MGASA-2018-0294 Updated libvorbis packages fix security vulnerabilities
The updated packages fix security vulnerabilities: The barknoisehybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service out-of-bounds access and application crash or possibly have unspecified other impact via a crafted mp4 file. CVE-2017-14160...
MGASA-2018-0291 Updated librsvg packages fix a security vulnerability
Updated librsvg package fixes security vulnerability: It was discovered that there was an input validation vulnerability in the librsvg renderer library that could result in data being leaked to remote attackers via a specially-crafted file CVE-2018-1000041...
MGASA-2018-0286 Updated flash-player-plugin packages fixes security issues
Updated flash-player-plugin packages fixes the following security issues A remote attacker could possibly execute arbitrary code with the privileges of the process or obtain sensitive information CVE-2018-4945, CVE-2018-5000, CVE-2018-5001, CVE-2018-5002. In response to a class of recently...
MGASA-2018-0280 Updated gifsicle package fixes security vulnerability
Updated gifsicle package fixes security vulnerability: A double-free bug in the readgif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because lastname is mishandled CVE-2017-18120...
MGASA-2018-0284 Updated qt3 packages fix security vulnerability
Updated qt3 packages fix security vulnerability: A stack overflow flaw was found in the way Qt parsed XML input with several nested opening tags. An application using Qt's QXmlSimpleReader to parse specially crafted XML input could crash CVE-2016-10040...
MGASA-2018-0279 Updated leptonica packages fix security vulnerabilities
This update fixes a security issue potential injection attack using gplot rootdir originally reported in CVE-2018-3836. This fix was incomplete and again reported in CVE-2018-7440 and CVE-2018-7442. The improved fix is included in leptonica-1.76.0...
MGASA-2018-0274 Updated qtpass packages fix security vulnerability
All passwords generated with QtPass' built-in password generator prior to 1.2.1 are possibly predictable and enumerable by hackers...
MGASA-2018-0271 Updated libreoffice packages fix security vulnerabilities
The updated packages fix security vulnerabilities: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function. CVE-2018-6871 sot/source/sdstor/stgstrms.cxx in LibreOffice before...
MGASA-2018-0270 Updated python3 packages fix security vulnerabilities
Updated python3 packages fix security vulnerabilities: A flaw was found in the way catastrophic backtracking was implemented in Python's pop3lib's apop method. An attacker could use this flaw to cause denial of service CVE-2018-1060. A flaw was found in the way catastrophic backtracking was...
MGASA-2018-0269 Updated mariadb packages fix security vulnerabilities
Updated mariadb packages fix security vulnerabilities: Vulnerability in the MariaDB Server component of MariaDB subcomponent: Server: Partition. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful...
MGASA-2018-0266 Updated wireshark packages fix security vulnerabilities
Updated wireshark packages fix security vulnerabilities: The DNS dissector could crash CVE-2018-11356. Multiple dissectors could consume excessive memory CVE-2018-11357. The Q.931 dissector could crash CVE-2018-11358. Multiple dissectors could crash CVE-2018-11359. The GSM A DTAP dissector could...
MGASA-2018-0263 Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.44 and fixes at least the following security issues: By mmaping a FUSE-backed file onto a process's memory containing command line arguments or environment strings, an attacker can cause utilities from psutils or procps such as ps, w or any other...
MGASA-2018-0262 Updated libvirt packages fix security vulnerability
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Stor...
MGASA-2018-0265 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on the upstream 4.14.44 and fixes at least the following security issues: The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial...
MGASA-2018-0261 Updated thunderbird packages fix security vulnerabilities
Updated thunderbird packages fix security vulnerabilities: Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 CVE-2018-5150. Mozilla: Use-after-free with SVG animations and clip paths CVE-2018-5154. Mozilla: Use-after-free with SVG animations and text paths CVE-2018-5155. Mozill...
MGASA-2018-0258 Updated webkit2 packages fix security vulnerabilities
Updated webkit2 packages fix security vulnerabilities: The webkit2 package has been updated to version 2.20.2, fixing several security issues and other bugs...
MGASA-2018-0256 Updated python packages fix security vulnerabilities
Updated python packages fix security vulnerabilities: A flaw was found in the way catastrophic backtracking was implemented in Python's pop3lib's apop method. An attacker could use this flaw to cause denial of service CVE-2018-1060. A flaw was found in the way catastrophic backtracking was...
MGASA-2018-0257 Updated virtualbox packages fix security vulnerabilities
This update provides virtualbox 5.2.12 and fixes the following security issues: Unauthorized remote attacker may have caused a hang or frequently repeatable crash complete DOS CVE-2018-0739. Attacker with host login may have compromised Virtualbox or further system services after interaction with...
MGASA-2018-0253 Updated mbedtls packages fix security issues
CVE-2018-9988: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in sslparseserverkeyexchange that could cause a crash on invalid input. CVE-2018-9989: ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in sslparseserverpskhint that...
MGASA-2018-0249 Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.40 and fixes at least the following security issues: On x86, MOV SS and POP SS behave strangely if they encounter a data breakpoint. If this occurs in a KVM guest, KVM incorrectly thinks that a DB instruction was caused by the undocumented ICEBP...
MGASA-2018-0248 Updated firefox packages fix security vulnerabilities
Updated firefox packages fix security vulnerabilities: Mozilla: Memory safety bugs fixed in Firefox ESR 52.8 CVE-2018-5150. Mozilla: Backport critical security fixes in Skia CVE-2018-5183. Mozilla: Use-after-free with SVG animations and clip paths CVE-2018-5154. Mozilla: Use-after-free with SVG...
MGASA-2018-0234 Updated libpam4j package fixes security vulnerability
It was discovered that libpam4j, a Java library wrapper for the integration of PAM did not call pamacctmgmt during authentication. As such a user who has a valid password, but a deactivated or disabled account could still log in CVE-2017-12197...
MGASA-2018-0243 Updated quassel packages fix security vulnerabilities
A heap corruption exists in quassel version 0.12.4 in quasselcore that allows an attacker to execute code remotely CVE-2018-1000178. A NULL Pointer Dereference exists in quassel version 0.12.4 in the quasselcore that allows an atacker to denial of service by attempting a login when the database i...
MGASA-2018-0238 Updated golang packages fix security vulnerability
A flaw was found in Go Lang. The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path get/vcs.go only checks for "://" anywhere in the string, which allows remote attackers to execute arbitrary OS commands via a crafted web site...
MGASA-2018-0236 Updated libsndfile packages fix security vulnerabilities
An out of bounds read in the function d2alawarray in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure, related to mishandling of the NAN and INFINITY floating-point values CVE-2017-14245. An out of bounds read in the function d2ulawarray in ulaw.c of libsndfil...
MGASA-2018-0246 Updated libtiff packages fix security vulnerabilities
The TIFFWriteDirectorySec function in tifdirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service assertion failure and application crash via a crafted file, a different vulnerability than CVE-2017-13726. CVE-2018-10963 In LibTIFF 4.0.9, a heap-based buffer overflo...
MGASA-2018-0245 Updated 389-ds-base packages fix security vulnerability
389-ds-base did not properly handle characters needed to be escaped in its query filter. This could result in buffer overflows, from the heap or the stack, on larger filters. An unauthenticated attacker could send a specially crafted LDAP request and crash the server CVE-2018-1089...
MGASA-2018-0233 Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 29.0.0.171 addresses a critical type confusion vulnerability that could lead to arbitrary code execution CVE-2018-4944...
MGASA-2018-0232 Updated qpdf packages fix security vulnerability
A flaw was found in QPDF through 8.0.2. libqpdf.a mishandles certain 'expected dictionary key but found non-name object' cases, allowing remote attackers to cause a denial of service stack exhaustion, related to the QPDFObjectHandle and QPDFDictionary classes CVE-2018-9918...
MGASA-2018-0228 Updated graphicsmagick packages fix security vulnerabilities
GraphicsMagick 1.3.29 updated with fixes for several security issues...
MGASA-2018-0226 Updated nextcloud packages fix security vulnerabilities and update version
Mageia 6 brings Nextcloud 11, which is not supported anymore upstream. This update brings version 12 with several security fixes. The database system is now in a separate package, so you will have to choose manually the one you are using...
MGASA-2018-0227 Updated flac packages fix security vulnerability
Memory leak in readmetadatavorbiscomment function could lead to denial of service CVE-2017-6888...
MGASA-2018-0223 Updated libid3tag packages fix security vulnerabilities
id3utf16deserialize in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service DoS. CVE-2004-2779 field.c in the libid3tag 0.15.0b library...