OESA-2022-1800 uboot-tools security update

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fixes: squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contain...

OESA-2022-1805 targetcli security update

Targetcli is an administration tool for managing storage targets using the kernel LIO core target and compatible target fabric modules. Security Fixes: Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target and for the backup directory and backup files.CVE-2020-13867...

OESA-2022-1799 shim security update

Initial UEFI bootloader that handles chaining to a trusted full bootloader under secure boot environments. Security Fixes: No description is available for this CVE.CVE-2022-28737...

OESA-2022-1796 raptor2 security update

Raptor is Redland's RDF parser toolkit, which provides a set of independent RDF parsers to generate triples from RDF / XML or N-Triples. Security Fixes: A malformed input file can lead to a segfault due to an out of bounds array access in raptorxmlwriterstartelementcommon.CVE-2020-25713...

OESA-2022-1797 golang security update

The Go Programming Language. Security Fixes: Calling Glob on a path which contains a large number of path separators can cause a panic due to stack exhaustion.CVE-2022-30630...

OESA-2022-1801 fwupd security update

aims to make updating firmware on Linux automatic, safe and reliable. Security Fixes: A PGP signature bypass flaw was found in fwupd all versions, which could lead to the installation of unsigned firmware. As per upstream, a signature bypass is theoretically possible, but not practical because th...

OESA-2022-1802 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: No description is available for this CVE.CVE-2022-1508 When sending malicous data to kernel by ioctl cmd FBIOPUTVSCREENINFO,kernel will write memory out of bounds.CVE-2021-33655...

OESA-2022-1792 python-ldap security update

python-ldap provides an object-oriented API for working with LDAP within Python programs. It allows access to LDAP directory servers by wrapping the OpenLDAP 2.x libraries, and contains modules for other LDAP-related tasks including processing LDIF, LDAPURLs, LDAPv3 schema, etc.. Security Fixes:...

OESA-2022-1794 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfbread function. The vulnerability could result in local attackers being able to crash the kernel.CVE-2022-2380 In USB...

OESA-2022-1795 libtirpc security update

Libtirpc is a Transport-Independent RPC library for Linux Security Fixes: In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svcrun infinite loop without...

OESA-2022-1791 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translatefail path, leading to an ioreadx or iowritex crash.CVE-2022-35414...

OESA-2022-1793 netcdf security update

NetCDF network Common Data Form is an interface for array-oriented data access and a freely-distributed collection of software libraries for C, Fortran, C++, and perl that provides an implementation of the interface. Security Fixes: An issue was discovered in libezxml.a in ezXML 0.8.6. The functi...

OESA-2022-1790 python-lxml security update

The lxml XML toolkit is a Pythonic binding for the C libraries libxml2 and libxslt. \ It is unique in that it combines the speed and XML feature completeness of these libraries with \ the simplicity of a native Python API, mostly compatible but superior to the well-known ElementTree API. \ The...

OESA-2022-1787 qt5-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.CVE-2022-25255...

OESA-2022-1784 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the modisapi module.CVE-2022-28330...

OESA-2022-1788 flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies finish-args last in the build. At this...

OESA-2022-1789 protobuf-c security update

This is protobuf-c, a C implementation of the Google Protocol Buffers data serialization format. Security Fixes: Protobuf-c v1.4.0 was discovered to contain an invalid arithmetic shift via the function parsetagandwiretype in protobuf-c/protobuf-c.c. This vulnerability allows attackers to cause a...

OESA-2022-1786 openjdk-1.8.0 security update

The OpenJDK runtime environment 8. Security Fixes: Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 7u321, 8u311; Oracle GraalVM Enterprise Edition: 20.3.4 and 21.3.0. Easily...

OESA-2022-1785 evolution-data-server security update

The evolution-data-server package provides a personal information management application that provides integrated mail, calendaring and address book functionality. The evolution-data-server package provides a single database for common, desktop-wide information, such as a user's address book or...

OESA-2022-1783 golang security update

The Go Programming Language Security Fixes: When httputil.ReverseProxy.ServeHTTP was called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy would set the client IP as the value of the X-Forwarded-For header, contrary to its documentation. In the more...

OESA-2022-1780 derby security update

Apache Derby, an Apache DB sub-project, is a relational database implemented entirely in Java. Some key advantages include a small footprint, conformance to Java, JDBC, and SQL standards and embedded JDBC driver. Security Fixes: In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network...

OESA-2022-1781 log4j12 security update

With log4j it is possible to enable logging at runtime without modifying the application binary. Security Fixes: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converte...

OESA-2022-1778 openvswitch security update

Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license. Security Fixes: A memory leak was found in Open vSwitch OVS during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by...

OESA-2022-1782 jackson-databind security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through...

OESA-2022-1779 linux-firmware security update

This package contains firmware images required by some devices. Security Fixes: Improper buffer restriction in some IntelR Wireless BluetoothR products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.CVE-2020-12321...

OESA-2022-1776 virglrenderer security update

The virgil3d rendering library is a library used by qemu to implement 3D GPU support for the virtio GPU. Security Fixes: No description is available for this CVE.CVE-2022-0175...

OESA-2022-1777 harfbuzz security update

HarfBuzz is a text-shaping engine. If you give HarfBuzz a font and a string containing a sequence of Unicode codepoints, HarfBuzz selects and positions the corresponding glyphs from the font, applying all of the necessary layout rules and font features. HarfBuzz then returns the string to you in...

OESA-2022-1765 git security update

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.Git is easy to learn and has a tiny footprint with lightning fast performance. It outclasses SCM tools like Subversion, CVS, Perforce,and...

OESA-2022-1774 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: There are use-after-free vulnerabilities caused by timer handler in net/rose/rosetimer.c of linux that allow attackers to crash linux kernel without any privileges.CVE-2022-2318 An issue was discovered in the Linux kernel through...

OESA-2022-1762 gdk-pixbuf2 security update

gdk is written in C but has been designed from the ground up to support a wide range of languages. It provide a complete set of widgets,and suitable for projects ranging from small one-off tools to complete application suites. Security Fixes: A flaw was found in gdk-pixbuf in versions before...

OESA-2022-1763 bluez security update

This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdpcstateallocbuf which allocates memory which wil...

OESA-2022-1761 dnsmasq security update

Dnsmasq provides network infrastructure for small networks: DNS, DHCP, router advertisement and network boot. It is designed to be lightweight and have a small footprint, suitable for resource constrained routers and firewalls. It has also been widely used for tethering on smartphones and portabl...

OESA-2022-1767 bison security update

Bison is a general-purpose parser generator that converts an annotated context-free grammar into a deterministic LR or generalized LR GLR parser employing LALR1 parser tables. As an experimental feature, Bison can also generate IELR1 or canonical LR1 parser tables. Once you are proficient with...

OESA-2022-1773 microcode_ctl security update

This is a tool to transform and deploy microcode update for x86 CPUs. Security Fixes: Incomplete cleanup in some IntelR VT-d products may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2020-24489 Domain-bypass transient execution vulnerability in so...

OESA-2022-1770 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the...

OESA-2022-1768 gupnp security update

GUPnP is an elegant, object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. It provides the same set of features as libupnp,but shields the developer from most...

OESA-2022-1766 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

OESA-2022-1760 GraphicsMagick security update

GraphicsMagick is the swiss army knife of image processing. Comprised of 267K physical lines according to David A. Wheeler's SLOCCount of source code in the base package or 1,225K including 3rd party libraries it provides a robust and efficient collection of tools and libraries which support...

OESA-2022-1772 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in ...

OESA-2022-1775 OpenEXR security update

OpenEXR is a high dynamic-range HDR image file format originally developed by Industrial Light & Magic for use in computer imaging applications. Security Fixes: A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a...

OESA-2022-1771 mc security update

GNU Midnight Commander is a visual file manager, licensed under GNU General Public License and therefore qualifies as Free Software. It's a feature rich full-screen text mode application that allows you to copy, move and delete files and whole directory trees, search for files and run commands in...

OESA-2022-1764 lua security update

Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description. Security Fixes: An issue in the component luaGrunerror of Lua v5.4.4 and below leads to...

OESA-2022-1769 nodejs security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

OESA-2022-1758 mod_fcgid security update

Modfcgid is an Apache module providing a FastCGI interface. It's an alternative to modfastcgi that is specifically tuned for the dynamic FastCGI configuration used on DreamHost servers. Security Fixes: A security Bypass vulnerability exists in the FcgidPassHeader Proxy in modfcgid through...

OESA-2022-1756 libproxy security update

libproxy offers the following features: extremely small core footprint 35k. no external dependencies within libproxy core.libproxy plugins may have dependencies. only 3 functions in the stable external API. dynamic adjustment to changing network topology. a standard way of dealing with proxy...

OESA-2022-1757 Open-iSCSI security update

The Open-iSCSI project is a high-performance, transport independent, multi-platform implementation of RFC3720 iSCSI. Security Fixes: An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore th...

OESA-2022-1759 eclipse security update

The Eclipse platform is designed for building integrated development environments IDEs, server-side applications, desktop applications, and everything in between. Security Fixes: In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to...

OESA-2022-1755 nodejs-jsonpointer security update

Simple JSON Addressing. Security Fixes: This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.CVE-2021-23807...

OESA-2022-1751 uboot-tools security update

This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fixes: In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer...

OESA-2022-1754 ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format PDF files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fixes: A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large...