8901 matches found
OESA-2022-1543 nodejs-getobject security update
Get and set deep objects easily. Security Fixes: Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.CVE-2020-28282...
OESA-2022-1549 perl-Encode security update
Character encodings in Perl. Security Fixes: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in the current working directory that preempts dynamic module loading. Exploitation requires an unusual configuration...
OESA-2022-1551 libtiff security update
TIFF Library and Utilities. Security Fixes: Null source pointer passed as an argument to memcpy function within TIFFReadDirectory in tifdirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is...
OESA-2022-1550 evince security update
Evince is a document viewer for multiple document formats. The goal of evince is to replace the multiple document viewers that exist on the GNOME Desktop with a single simple application. Evince is specifically designed to support the file following formats: PDF, Postscript, djvu, tiff, dvi, XPS,...
OESA-2022-1544 nodejs-grunt security update
Grunt is the JavaScript task runner. Why use a task runner? In one word: automation. The less work you have to do when performing repetitive tasks like minification, compilation, unit testing, linting, etc, the easier your job becomes. After you've configured it, a task runner can do most of that...
OESA-2022-1552 mysql5 security update
MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon mysqld and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files. Security Fixes:...
OESA-2022-1548 unzip security update
A utility for unpacking zip files. Security Fixes: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or cod...
OESA-2022-1545 xmlrpc security update
Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. Apache XML-RPC was previously known as Helma XML-RPC. If you have code using the Helma library, all you should have to do is change the import statements in your cod...
OESA-2022-1547 mysql-connector-java security update
MySQL Connector/J is a native Java driver that converts JDBC Java Database Connectivity calls into the network protocol used by the MySQL database. It lets developers working with the Java programming language easily build programs and applets that interact with MySQL and connect all corporate...
OESA-2022-1546 nodejs-jison security update
A parser generator with Bison's API. Security Fixes: Insufficient input validation in npm package jison = 0.4.18 may lead to OS command injection attacks.CVE-2020-8178...
OESA-2022-1542 rubygem-rubyzip security update
A ruby module for reading and writing zip files. Security Fixes: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service disk consumption.CVE-2019-16892...
OESA-2022-1541 A-Tune security update
atune is a service for atuned AI tuning system. Security Fixes: Log in as a local user and run the curl command to access the local atune url interface to escalate the local privilege or modify any file. Authentication is not forcibly enabled in the default configuration.CVE-2021-33658...
OESA-2022-1540 python-pillow security update
Python image processing library. Security Fixes: Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Improper Input Validation. When the path to the temporary directory on Linux or macOS contained a space, this would break removal of the temporary imag...
OESA-2022-1537 tomcat security update
The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open developmen...
OESA-2022-1538 systemd security update
systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the...
OESA-2022-1539 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In memory management driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...
OESA-2022-1536 util-linux security update
The util-linux package contains a random collection of files that implements some low-level basic linux utilities. Security Fixes: A logical error was found in util-linux's libmount library in a function that allows unprivileged users to unmount FUSE filesystems. Incorrect uid checking allows...
OESA-2022-1535 postgresql-jdbc security update
PostgreSQL JDBC Driver PgJDBC for short allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. Is an open source JDBC driver written in Pure Java Type 4, and communicates in the PostgreSQL native network protocol. Security Fixes: pgjdbc is the...
OESA-2022-1533 cfitsio security update
Library for manipulating FITS data files. Security Fixes: In the ffghtb function in NASA CFITSIO 3.42, specially crafted images parsed via the library can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and...
OESA-2022-1531 grafana security update
Metrics dashboard and graph editor. Security Fixes: Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token and no other user credentials will...
OESA-2022-1530 python-django security update
A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted...
OESA-2022-1532 cryptsetup security update
cryptsetup is a utility used to conveniently set up disk encryption based on the DMCrypt kernel module. Security Fixes: It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the...
OESA-2022-1529 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: Checks in Samba AD DC to prevent alias SPNs may be bypassed, enabling users who can write to the account's servicePrincipalName attribute to impersonate the service.CVE-2022-0336...
OESA-2022-1528 ceph security update
User space components of the Ceph file system. Security Fixes: The key length for encrypted devices created using ceph-volume is incorrect. This is due to a bug in cephvolume/util/encryption.py, where upon writing a key using osddmcryptkeysize it does not pass the key size to the format and open...
OESA-2022-1534 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: A use-after-free vulnerability was found in rtsxusbmsdrvremove in drivers/memstick/host/rtsxusbms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This fla...
OESA-2022-1527 bluez security update
This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. Security Fixes: An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a...
OESA-2022-1526 python-pillow security update
Python image processing library. Security Fixes: pathgetbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.CVE-2022-22816 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec...
OESA-2022-1524 samba security update
A suite for Linux to interoperate with Windows. Security Fixes: This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfsfruit.CVE-2021-44142...
OESA-2022-1523 aide security update
AIDE Advanced Intrusion Detection Environment is a file and directory integrity checker. It creates a database from the regular expression rules that it finds from the config files. Once this database is initialized it can be used to verify the integrity of the files. Security Fixes: AIDE before...
OESA-2022-1522 numpy security update
A fast multidimensional array facility for Python. Security Fixes: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArrayDescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort...
OESA-2022-1525 strongswan security update
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fixes: In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually...
OESA-2022-1521 tinyxml security update
TinyXML parses an XML document, and builds from that a Document Object Model DOM that can be read, modified, and saved. XML is a very structured and convenient format. All those random file formats created to store application data can all be replaced with XML. One parser for everything. Security...
OESA-2022-1514 vim security update
Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...
OESA-2022-1515 edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as...
OESA-2022-1516 freetds security update
FreeTDS is an open source implementation of the TDS Tabular Data Stream protocol used by these databases for their own clients. It supports many different flavors of the protocol and three APIs to access it. FreeTDS includes call level interfaces for DB-Lib, CT-Lib, and ODBC. Security Fixes:...
OESA-2022-1512 xstream security update
Java XML serialization library. Security Fixes: XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload...
OESA-2022-1517 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: A double free bug in packetsetring in net/packet/afpacket.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding...
OESA-2022-1513 log4j12 security update
With log4j it is possible to enable logging at runtime without modifying the application binary. Security Fixes: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and...
OESA-2022-1511 expat security update
An XML parser library. Security Fixes: Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES.CVE-2022-23852 Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-23990...
OESA-2022-1518 golang security update
The Go Programming Language. Security Fixes: In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header Falsely designating that many files are present can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for...
OESA-2022-1519 mysql security update
MySQL client programs and shared libraries. Security Fixes: Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: Privileges. Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Easily exploitable vulnerability allows low privileged...
OESA-2022-1520 flatpak security update
Application deployment framework for desktop apps. Security Fixes: Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual...
OESA-2022-1509 transfig security update
The transfig utility creates a makefile which translates FIG created by xfig or PIC figures into a specified LaTeX graphics language for example, PostScriptTM. Transfig is used to create TeX documents which are portable i.e., they can be printed in a wide variety of environments. Security Fixes: ...
OESA-2022-1507 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share...
OESA-2022-1506 curl security update
Curl is used in command lines or scripts to transfer data. Security Fixes: When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from...
OESA-2022-1508 clamav security update
End-user tools for the Clam Antivirus scanner. Security Fixes: A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an...
OESA-2022-1510 wpa_supplicant security update
wpasupplicant is a WPA Supplicant for Linux, BSD, Mac OS X, and Windows with support for WPA and WPA2 IEEE 802.11i / RSN. It is suitable for both desktop/laptop computers and embedded systems. Supplicant is the IEEE 802.1X/WPA component that is used in the client stations. It implements key...
OESA-2022-1503 systemd security update
System and Service Manager. Security Fixes: A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.CVE-2021-3997...
OESA-2022-1504 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not...
OESA-2022-1505 uriparser security update
The package is a strictly RFC 3986 compliant URI parsing library written in C89"ANSI C". uriparser is cross-platform, fast, supports Unicode and is licensed under the New BSD license. There are a number of applications, libraries and hardware using uriparser, as well as bindings and 3rd-party...