17011 matches found
CLSA-2024-1730226852 php: Fix of CVE-2024-8925
CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...
CLSA-2024-1728581726 linux-firmware: Fix of CVE-2023-31315
Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...
CLSA-2024-1728579854 microcode_ctl: Fix of CVE-2023-31315
Update Intel CPU microcode to 20240813: - Addition of cpuid:806F8/0x10 SPR-HBM B3 microcode in microcode.dat at revision 0x2c000390; - Addition of cpuid:806F8/0x87 SPR-SP E5/S3 microcode in microcode.dat at revision 0x2b0005c0; - Addition of cpuid:90672/0x07 ADL-HX/S 8+8 C0 microcode in...
CLSA-2024-1728479129 Fix CVE(s): CVE-2023-38709, CVE-2024-24795, CVE-2024-27316
SECURITY UPDATE: Memory exhaustion due to excessive HTTP/2 incoming headers buffering - debian/patches/CVE-2024-27316.patch: Fix to bail after too many failed reads, increment count on request headers failed to add - CVE-2024-27316 SECURITY UPDATE: Faulty input validation in the core of Apache...
CLSA-2024-1728403484 python2: Fix of CVE-2024-7592
CVE-2024-7592: fix quadratic complexity in parsing cookies with backslashes...
CLSA-2024-1728297353 kernel: Fix of 5 CVEs
drm/amd/pm: fix the Out-of-bounds read warning CVE-2024-46731 - hwmon: w83627ehf Fix underflows seen when writing limit attributes CVE-2024-46756 - hwmon: lm95234 Fix underflows seen when writing limit attributes CVE-2024-46758 - hwmon: nct6775-core Fix underflows seen when writing limit...
CLSA-2024-1727287647 emacs: Fix of CVE-2024-48337
CVE-2024-48337: fix etags local command injection vulnerability...
CLSA-2024-1726163188 Fix CVE(s): CVE-2024-45491, CVE-2024-45492
SECURITY UPDATE: integer overflow - debian/patches/CVE-2024-45491.patch: prevent integer overflow in dtdCopy - CVE-2024-45491 SECURITY UPDATE: integer overflow - debian/patches/CVE-2024-45492.patch: prevent integer overflow in nextScaffoldPart - CVE-2024-45492...
CLSA-2024-1725650114 expat: Fix of 3 CVEs
CVE-2024-45490: reject negative length in XMLParseBuffer - CVE-2024-45491: detect integer overflow in dtdCopy on 32-bit platforms - CVE-2024-45492: detect integer overflow in nextScaffoldPart on 32-bit platforms...
CLSA-2024-1724788546 Fix of 5 CVEs
SECURITY UPDATE: http server use exploitable/malicious backend application - debian/patches/CVE-2024-38476.patch: prevent server usage of exploitable/malicious backend application output to run local handlers via internal redirect - CVE-2024-38476 SECURITY UPDATE: modules regression introduced by...
CLSA-2024-1722535625 Update of alt-php
SECURITY UPDATE: New microcode data file 2024-05-14 - New microcodes: sig 0x000a06a4, pfmask 0xe6, 2024-01-03, rev 0x001c, size 136192 sig 0x000b06a8, pfmask 0xe0, 2023-12-07, rev 0x4121, size 220160 sig 0x000c06f1, pfmask 0x87, 2024-02-05, rev 0x21000230, size 552960 sig 0x000c06f2, pfmask 0x87,...
CLSA-2024-1720547899 Update of alt-php
Resolve multiple test failures - debian/rules: re-build test certificates before dhautotest, remove silencing of failing tests - debian/control: build-depend on libnsspem to be able to read PEM certificates in build-nss - debian/patches/update-test-certs-generation.patch: update keysize and diges...
CLSA-2024-1716272474 Fix CVE(s): CVE-2023-49288
SECURITY UPDATE: Denial of Service attack against HTTP header parsing - debian/patches/CVE-2023-49288.patch: fix unintentional freeing in TRACE request handler - CVE-2023-49288...
CLSA-2024-1714065005 Fix of 9 CVEs
CVE-url: https://ubuntu.com/security/CVE-2023-1998 - x86/speculation: Allow enabling STIBP with legacy IBRS CVE-url: https://ubuntu.com/security/CVE-2021-47193 - scsi: pm80xx: Tie the interrupt name to the module instance - scsi: pm80xx: Deal with kexec reboots - scsi: pm80xx: Increase number of...
CLSA-2024-1711564218 Update of alt-php
New upstream 2024a version: - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - zic no longer pretends to support indefinite-past DST. - localtime no longer mishandles Ciudad Juárez in 2422. New upstream 2023d version: - Ittoqqortoormiit,...
CLSA-2024-1711561513 Update of tzdata
Upgrade to tzdata-2024a - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - localtime no longer mishandles Ciudad Juárez in 2422. - zic no longer pretends to support indefinite-past DST. - Ittoqqortoormiit, Greenland changes time zones on...
CLSA-2024-1710786990 Fix CVE(s): CVE-2024-0727
SECURITY UPDATE: Potential Denial of Service via processing maliciously formatted PKCS12 file - debian/patches/CVE-2024-0727.patch: Fix decode error causing NULL pointer in PKCS12unpackp7data, PKCS12unpackp7encdata, PKCS12unpackauthsafes, SMIMEwritePKCS7, pkcs12genmac and newpassp12 functions -...
CLSA-2024-1708094049 Fix of 8 CVEs
CVE-url: https://ubuntu.com/security/CVE-2024-23851 - dm: limit the number of targets and parameter size area CVE-url: https://ubuntu.com/security/CVE-2024-1086 - netfilter: nftables: reject QUEUE/DROP verdict parameters CVE-url: https://ubuntu.com/security/CVE-2023-35827 - ravb: Fix use-after-fr...
CLSA-2024-1705941381 Update of ca-certificates
Update to CKBI 2.64 from NSS 3.95 - Updated: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Removed: - Certificate "E-Tugra Certification Authority" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification Authority - G6" -...
CLSA-2023-1693432495 Fix of 8 CVEs
CVE-url: https://ubuntu.com/security/CVE-2023-4128 - net/sched: clsu32: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsfw: No longer copy tcfresult on update to avoid use-after- free - net/sched: clsroute: No longer copy tcfresult on update to avoid use- after-free...
CLSA-2023-1692296362 Update of alt-php
SECURITY UPDATE: New microcode data file 2023-05-12 - New microcodes: sig 0x000906a4, pfmask 0x40, 2022-10-12, rev 0x0004, size 115712 sig 0x000b06e0, pfmask 0x01, 2022-12-19, rev 0x0010, size 134144 - Updated microcodes: sig 0x00050653, pfmask 0x97, 2022-12-21, rev 0x1000171, size 36864 sig...
CLSA-2023-1689701258 Fix CVE(s): CVE-2021-20230
SECURITY UPDATE: Attacker bypasses redirection using unauthorized CA-signed certificate. - debian/patches/CVE-2021-20230.patch: Patch enhancing certificate verification process to prevent unauthorized redirection with CA-signed certificates by refining session data checks. - CVE-2021-20230 Fix...
CLSA-2023-1688070599 Fix CVE(s): CVE-2023-28322, CVE-2023-28321
SECURITY UPDATE: More POST-after-PUT confusion - debian/patches/CVE-2023-28322.patch: fix mess in upload/method handling - CVE-2023-28322 SECURITY UPDATE: incorrect IDN wildcard match - debian/patches/CVE-2023-28321.patch: fix erroneous logic in wildcard handling, drop support for wildcards in th...
CLSA-2023-1685971623 Fix CVE(s): CVE-2022-45141
SECURITY UPDATE: Samba AD DC using Heimdal can be forced to issue rc4-hmac encrypted Kerberos tickets - debian/patches/CVE-2022-45141.patch: fix TGS ticket enc-part key selection and check-des - CVE-2022-45141...
CLSA-2023-1682348435 curl: Fix of CVE-2023-27534
CVE-2023-27534: fix SFTP path '' resolving discrepancy - fix resolving SCP relative path...
CLSA-2023-1678136944 python: Fix of CVE-2023-24329
CVE-2023-24329: Prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character...
CLSA-2023-1675986440 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09. That fixes following CVEs: - CVE-2023-21830: Improper restrictions in CORBA deserialization Serialization, 8285021 - CVE-2023-21843: Soundbank URL remote loading Sound, 8293742 - Update tzdata requirement to 2022g to match JDK-8297804 -...
CLSA-2023-1675111450 httpd: Fix of CVE-2022-36760
CVE-2022-36760: modproxyajp: fix possible HTTP request smuggling...
CLSA-2022-1671656460 Update of ca-certificates
update to CKBI 2.58 from NSS 3.67 - removed old certificates: - Certificate "Camerfirma Global Chambersign Root" - Certificate "Cybertrust Global Root" - Certificate "Equifax Secure eBusiness CA 1" - Certificate "Equifax Secure Global eBusiness CA" - Certificate "Explicitly Distrusted DigiNotar...
CLSA-2022-1671123782 curl: Fix of CVE-2022-32221
CVE-2022-32221: fix issue when POST following PUT confusion - fix the contents of some test suites: replace the unsupported variable TESTNUMBER with a real value...
CLSA-2022-1670521677 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CLSA-2022-1669241475 Fix CVE(s): CVE-2022-45061
SECURITY UPDATE: Uncontrolled resource consumption - debian/patches/CVE-2022-45061.patch: Fix quadratic time idna decoding - CVE-2022-45061 Fix the tests: Certificates were expired - debian/patches/update-test-certs-and-keys.patch: Update test certs and keys...
CLSA-2022-1669241224 Fix CVE(s): CVE-2022-42012, CVE-2022-42011, CVE-2022-42010, CVE-2020-35512
SECURITY UPDATE: Use-after-free in access control-related hash tables - debian/patches/CVE-2020-35512.patch: use reference counting for DBusUserInfo and DBusGroupInfo structures. - CVE-2020-35512 SECURITY UPDATE: Crash or incorrect parsing a signature with wrongly nested '' and '' -...
CLSA-2022-1663184687 Fixed CVE-2022-28614 in httpd
CVE-2022-28614: fix out-of-bounds read via aprwrite...
CLSA-2022-1663184017 Fixed CVEs in curl: CVE-2022-32208, CVE-2022-32206
CVE-2022-32208: krb5: fix returning error on decode errors - CVE-2022-32206: contentencoding: return error on too many compression steps - fix a curl.spec's comment about applying TuxCare ELS patches - improve the test system by repeating failed tests several times...
CLSA-2022-1660761947 Fixed CVE-2022-29154 in rsync
CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server MITM attack - Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests...
CLSA-2022-1660758476 Fixed 15 CVEs in expat
CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs - CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution - CVE-2022-25315: Fix integer overflow in storeRawNames - CVE-2022-22822: Fix integer overflow in addBinding -...
CLSA-2022-1659636455 Fix CVE(s): CVE-2022-21127, CVE-2021-0127, CVE-2022-21151, CVE-2022-21166, CVE-2021-33120, CVE-2021-33117, CVE-2022-21125, CVE-2021-0146, CVE-2021-0145, CVE-2022-21123
SECURITY UPDATE: New microcode data file 2022-05-10 - New microcodes: sig 0x00090672, pfmask 0x03, 2022-03-03, rev 0x001f, size 212992 sig 0x00090675, pfmask 0x03, 2022-03-03, rev 0x001f, size 212992 sig 0x000906a3, pfmask 0x80, 2022-03-24, rev 0x041c, size 212992 sig 0x000906a4, pfmask 0x80,...
CLSA-2022-1655822512 Fixed 6 CVEs in kernel
net: qrtr: fix another OOB Read in qrtrendpointpost CVE-2021-3743 - vt: keyboard: avoid signed integer overflow in kascii CVE-2020-13974 - pNFS/flexfiles: fix incorrect size check in decodenfsfh CVE-2021-4157 - esp: Fix possible buffer overflow in ESP transformation CVE-2022-27666 - sock: remove...
CLSA-2022-1654526233 Fixed CVE-2021-21705 in php-4.module_el8.4.0+2054+2eb69d76.tuxcare.els4
CVE-2021-21705: Fix SSRF bypass in FILTERVALIDATEURL adding additional check ups...
CLSA-2022-1654175590 Fixed CVE-2022-24070 in subversion-4.module_el8.5.0+2053+ac338b6d.tuxcare.els1
CVE-2022-24070: fix use-after-free of object-pools when used as httpd module...
CLSA-2022-1653005178 Fixed CVE-2022-1271 in gzip
CVE-2022-1271: Fix arbitrary file override with crafted file names...
CLSA-2022-1650377152 Fix CVE(s): CVE-2020-11724
SECURITY UPDATE: HTTP request smuggling in Lua module - debian/modules/nginx-lua: Fix parsing HTTP headers in the ngx.location.capture API porting an upstream patch 9ab38e8ee35fc08a57636b1b6190dca70b0076fa from https://github.com/openresty/lua-nginx-module - CVE-2020-11724...
CLSA-2022-1648048535 Fix CVE(s): CVE-2021-3737
SECURITY UPDATE: Denial of service - debian/patches/CVE-2021-3737.patch: Fix http client infinite line reading DoS after a HTTP 100 continue in Lib/httplib.py, Lib/test/testhttplib.py. - CVE-2021-3737...
CLSA-2022-1641904053 Fix of 14 CVEs
CVE-2018-9138: Fix stack exhaustion - CVE-2018-12641: Fix stack exhaustion - CVE-2018-12697: Fix NULL pointer dereference - CVE-2018-12698: Fix memory consumption - CVE-2018-12699: Fix heap-based buffer overflow - CVE-2018-12700: Fix infinite recursion - CVE-2018-17794: Fix NULL pointer...
CLSA-2021-1632261912 Fix of CVE: CVE-2021-22555
ELS-130: CVE-2021-22555: netfilter: xtables: fix compat match/target pad out-of-bound write...
CLSA-2021-1617285762 Fix of CVE-2021-22876
back-port urlapi from v7.75.0 used by CVE-2021-22876 - strip credentials from the auto-referer header CVE-2021-22876...
CLSA-2026-1791806459 TuxCare security update for nodemailer (11 CVEs)
TuxCare rebuilt nodemailer to address 11 CVEs. Fixed in 9.0.6-tuxcare.1...