1751 matches found
MGASA-2024-0334 Updated firefox packages fix security vulnerabilities
The updated package provides Firefox 128 for all mandatory arches of Mageia x8664, i586 and aarch64, fixing several bugs, including security vulnerabilities, for i586 and aarch64: Fullscreen notification dialog can be obscured by document content. CVE-2024-7518 Out of bounds memory access in...
MGASA-2024-0328 Updated php packages fix security vulnerabilities
HTTPREDIRECTSTATUS might be controlled via user request FPM log output might be modified by an attacker HTTP POST can be modified by an attacker For other bug fixes consult references...
MGASA-2024-0327 Updated cups & cups-filters packages fix security vulnerabilities
The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server. When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system. CVE-2024-47076 Th...
MGASA-2024-0323 Updated openjpeg2 packages fix security vulnerability
Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal. CVE-2023-39327...
MGASA-2024-0322 Updated hostapd & wpa_supplicant packages fix security vulnerability
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive th...
MGASA-2024-0320 Updated libreoffice package fixes security vulnerability
The Certificate Validation user interface in LibreOffice allows a potential vulnerability. Signed macros are scripts that have been digitally signed by the developer using a cryptographic signature. When a document with a signed macro is opened a warning is displayed by LibreOffice before the mac...
MGASA-2024-0317 Updated python3 packages fix security vulnerabilities
A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “certstorestats” and “getcacerts”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as durin...
MGASA-2024-0312 Updated gtk+2.0 and gtk+3.0 packages fix security vulnerability
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory. CVE-2024-6655...
MGASA-2024-0306 Updated suricata packages fix security vulnerabilities
CVE-2024-37151 Mishandling of multiple fragmented packets using the same IP ID value can lead to packet reassembly failure, which can lead to policy bypass. CVE-2024-38534 Crafted modbus traffic can lead to unlimited resource accumulation within a flow CVE-2024-38535, CVE-2024-38536 Suricata can...
MGASA-2024-0308 Updated python3-webob package fix security vulnerability
When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treats a // at the start of a string as a URI without a scheme, and then trea...
MGASA-2024-0302 Updated microcode packages fix security vulnerabilities
Observable discrepancy in RAPL interface for some Intel® Processors may allow a privileged user to potentially enable information disclosure via local access. CVE-2024-23984 Improper finite state machines FSMs in hardware logic in some Intel® Processors may allow an privileged user to potentially...
MGASA-2024-0304 Updated tgt packages fix security vulnerability
tgt aka Linux target framework before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical. CVE-2024-45751...
MGASA-2024-0303 Updated wireshark packages fix security vulnerability
NTLMSSP dissector crash in Wireshark 4.2.0 to 4.2.6 and 4.0.0 to 4.0.16 allows denial of service via packet injection or crafted capture file. CVE-2024-8250...
MGASA-2024-0297 Updated botan2 packages fix security vulnerability
An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be prime, causing excessive computation. This was patched in 2.19.4 and 3.3.0 to allow the prime parameter of the elliptic curve to be at mos...
MGASA-2024-0299 Updated python-tqdm package fixes security vulnerability
Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable...
MGASA-2024-0288 Updated orc packages fix security vulnerability
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of...
MGASA-2024-0286 Nginx has been updated to the latest stable release to fix CVE
CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and...
MGASA-2024-0287 Updated libtiff packages fix security vulnerability
A null pointer dereference flaw was found in Libtiff via tifdirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash,...
MGASA-2024-0284 Updated ntfs-3g packages fix security vulnerability
NTFS-3G before 75dcdc2 has a use-after-free in ntfsuppercasembs in libntfs-3g/unistr.c. CVE-2023-52890...
MGASA-2024-0283 Updated ffmpeg packages fix security vulnerabilities
A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...
MGASA-2024-0279 Updated roundcubemail packages fix security vulnerabilities
Fix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009 Fix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008 Fix information leak access to remote content via insufficient CSS filtering CVE-2024-42010...
MGASA-2024-0277 Updated kernel, kmod-xtables-addons & kmod-virtualbox packages fix security vulnerabilities
Upstream kernel version 6.6.43 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links...
MGASA-2024-0276 Updated emacs packages improve Wayland support and fix a security vulnerability
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %... link abbrev even when it specifies an unsafe function, such as shell-command-to-string. CVE-2024-39331...
MGASA-2024-0275 Updated virtualbox & kmod-virtualbox packages fix security vulnerabilities
Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products scope change. Successf...
MGASA-2024-0260 Updated poppler packages fix security vulnerability
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. CVE-2024-6239...
MGASA-2024-0259 Updated netatalk packages fix security vulnerabilities
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibufPASSWDLEN to '\0' in FPLoginExt in login in etc/uams/uamspam.c. CVE-2024-38439 Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation...
MGASA-2024-0258 Updated apache packages fix security vulnerabilities
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encodin...
MGASA-2024-0255 Updated openvpn packages fix security vulnerability
Control channel: refuse control channel messages with nonprintable characters in them. CVE-2024-5594...
MGASA-2024-0250 Updated openssh packages fix security vulnerability
regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems. CVE-2024-6387...
MGASA-2024-0245 Updated python-idna packages fix security vulnerability
mingw-python-idna: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode...
MGASA-2024-0239 Updated python-ansible-core packages fix security vulnerability
ansible-core: possible information leak in tasks that ignore ANSIBLENOLOG configuration CVE-2024-0690...
MGASA-2024-0234 Updated python-werkzeug packages fix security vulnerability
Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...
MGASA-2024-0230 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 126.0.6478.61 release. It includes 21 security fixes. Some of them are: High CVE-2024-5830: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2024-05-24 High CVE-2024-5831: Use after free in Dawn. Reported by wgslfuz...
MGASA-2024-0229 Updated flatpak packages fix security vulnerability
A malicious or compromised Flatpak app could execute arbitrary code outside its sandbox...
MGASA-2024-0228 Updated python-scikit-learn packages fix security vulnerability
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...
MGASA-2024-0222 Updated nss & firefox packages fix security vulnerabilities
Use-after-free in networking. CVE-2024-5702 Use-after-free in JavaScript object transplant. CVE-2024-5688 External protocol handlers leaked by timing attack. CVE-2024-5690 Sandboxed iframes were able to bypass sandbox restrictions to open a new window. CVE-2024-5691 Cross-Origin Image leak via...
MGASA-2024-0215 Updated 0-plugins-base packages fix security vulnerability
GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...
MGASA-2024-0214 Updated plasma-workspace packages fix security vulnerability
KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE based purely on the host, allowing all local connections. This allows another user on the same machine to gain access to the session manager. A well crafted client could use the session restore feature to execute arbitrary code...
MGASA-2024-0209 Updated libreoffice packages fix security vulnerability
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic. Such scripts were previously deemed trusted but are now deemed untrusted...
MGASA-2024-0210 Updated python-requests packages fix security vulnerability
CVE-2024-35195: Fixed cert verification regardless of changes to the value of verify bsc1224788...
MGASA-2024-0202 Updated gifsicle packages fix security vulnerability
gifsicle-1.94 was found to have a floating point exception FPE vulnerability via resizestream at src/xform.c. CVE-2023-46009...
MGASA-2024-0201 Updated netatalk packages fix security vulnerability
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code...
MGASA-2024-0199 Updated python-jinja2 packages fix security vulnerabilities
It was discovered that Jinja2 incorrectly handled certain HTML attributes that were accepted by the xmlattr filter. An attacker could use this issue to inject arbitrary HTML attribute keys and values to potentially execute a cross-site scripting XSS attack...
MGASA-2024-0200 Updated openssl packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Excessive time spent checking DSA keys and parameters. CVE-2024-4603 Use After Free with SSLfreebuffers. CVE-2024-4741...
MGASA-2024-0189 Updated nss & firefox packages fix security vulnerabilities
Arbitrary JavaScript execution in PDF.js. CVE-2024-4367 IndexedDB files retained in private browsing mode. CVE-2024-4767 Potential permissions request bypass via clickjacking. CVE-2024-4768 Cross-origin responses could be distinguished between script and non-script content-types. CVE-2024-4769...
MGASA-2024-0185 Updated python-sqlparse packages fix security vulnerability
Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...
MGASA-2024-0187 Updated python-pymongo packages fix security vulnerability
Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...
MGASA-2024-0182 Updated gdk-pixbuf2.0 packages fix security vulnerability
In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters heap memory corruption in aniloadchunk in io-ani.c when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or...
MGASA-2024-0188 Updated vim packages fix security vulnerability
Buffer overflow in xxd with colored output...
MGASA-2024-0178 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 124.0.6367.207 release. It includes 4 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromiu...