17404 matches found
CLSA-2023-1698312626 glibc: Fix of CVE-2023-4911
CVE-2023-4911: Terminate if end of input is reached...
CLSA-2023-1698180079 zlib: Fix of CVE-2023-45853
CVE-2023-45853: Reject overflows of zip header fields in minizip...
CLSA-2023-1698179874 zlib: Fix of CVE-2023-45853
CVE-2023-45853: Reject overflows of zip header fields in minizip...
CLSA-2023-1698179235 Fix CVE(s): CVE-2023-45853
SECURITY UPDATE: Reject overflows of zip header fields in minizip - debian/patches/CVE-2023-45853.patch: Check length of comment, filename and extra field in zipOpenNewFileInZip464 - CVE-2023-45853...
CLSA-2023-1697741516 python2: Fix of CVE-2022-48560
CVE-2022-48560: Fix SIGSEGV in Python via heappushpop in heapq...
CLSA-2023-1697740469 python2: Fix of CVE-2022-48560
CVE-2022-48560: Fix SIGSEGV in Python via heappushpop in heapq...
CLSA-2023-1697739575 python3: Fix of 4 CVEs
CVE-2021-3737: Fix http client infinite line reading DoS after a HTTP 100 Continue - CVE-2021-28861: Fix an open redirection vulnerability in http.server - CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and tabs - CVE-2022-45061: Fix quadratic time idna decoding...
CLSA-2023-1697575950 Fix CVE(s): CVE-2023-4504
SECURITY UPDATE: heap-based buffer overflow - debian/patches/CVE-2023-4504.patch: check for end of buffer if there is an escaped character - CVE-2023-4504...
CLSA-2023-1697481196 exim: Fix of 2 CVEs
CVE-2023-42114: fix possible OOB read in SPA authenticator - CVE-2023-42116: fix possible OOB write in SPA authenticator...
CLSA-2023-1697463486 Fix CVE(s): CVE-2023-38546
SECURITY UPDATE: сookie injection with none file - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields in lib/cookie.c - CVE-2023-38546...
CLSA-2023-1697135570 bind: Fix of CVE-2023-3341
CVE-2023-3341: Limit iscccccfromwire recursion depth...
CLSA-2023-1696536930 httpd: Fix of 4 CVEs
CVE-2021-26690: Fix NULL pointer dereference in modsession - CVE-2022-22719: Fix possible process crash due to unnoticed failures in modlua - CVE-2022-29404: Fix possible DoS due to no default limit on possible input size in modlua - CVE-2022-26377: Fix possible HTTP request smuggling in...
CLSA-2023-1695901429 Fix of 7 CVEs
CVE-url: https://ubuntu.com/security/CVE-2023-42753 - netfilter: ipset: add the missing IPSETHASHWITHNET0 macro for ipsethashnetportnet.c CVE-2022-40982 // CVE-url: https://ubuntu.com/security/CVE-2022-40982 - init: Provide archcpufinalizeinit - x86/cpu: Switch to archcpufinalizeinit - init: Remo...
CLSA-2023-1695834945 openldap: Fix of 2 CVEs
CVE-2022-29155: fix a SQL injection vulnerability in the back-sql backend to slapd - CVE-2021-27212: fix denial of service daemon exit via a short timestamp if slapd is used...
CLSA-2023-1694537251 binutils: Fix of 3 CVEs
CVE-2022-47673: Fix multiple out of bound reads which may cause a DoS - CVE-2022-47695: Fix NULL pointer segmentation fault which may cause a DoS - CVE-2022-47696: Fix read of unitialized field which may cause a DoS...
CLSA-2023-1693904973 Fix CVE(s): CVE-2022-48174
SECURITY UPDATE: unlikely stack overflow vulnerability - debian/patches/CVE-2022-48174.patch: break if a number string containing invalid characters - CVE-2022-48174...
CLSA-2023-1692817120 php: Fix of 2 CVEs
CVE-2023-3823: Fix external entity loading in XML without enabling by1 sanitizing libxml2 globals before parsing - CVE-2023-3824: Fix buffer mismanagement in phardirread...
CLSA-2023-1692110840 Fix CVE(s): CVE-2018-7409
SECURITY UPDATE: Fix buffer overflow - debian/patch/CVE-2018-7409: fix unicodetoansicopy, don't include NUL-terminator in length in unicodetoansialloc, make sure that the error handling doesn't overrun the buffer - CVE-2018-7409...
CLSA-2023-1691576572 Fix CVE(s): CVE-2023-34966
SECURITY UPDATE: infinite loop vulnerability in mdssvc RPC service for Spotlight - debian/patches/CVE-2023-34966.patch: prevents an infinite loop by preventing subcount less than 1. Add test for addressed CVE. - CVE-2023-34966...
CLSA-2023-1691083477 Fix CVE(s): CVE-2021-25329, CVE-2022-23181, CVE-2020-9484
SECURITY UPDATE: Remote Code Execution via session persistence - debian/patches/CVE-2020-9484.patch: Improve validation of storage location when using FileStore. - CVE-2020-9484 SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete - debian/patches/CVE-2021-25329-pre1.patch: Fix some edge cases...
CLSA-2023-1691083341 Update of alt-php
Update ca-certificates database to 20230629: - mozilla/certdata.txt,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.62. - The following certificate authorities were added: Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS" Certificate "ANF Secure Server Root CA" Certificate...
CLSA-2023-1689008452 cups: Fix of CVE-2023-34241
CVE-2023-34241: Fix use-after-free for CupsAcceptClient...
CLSA-2023-1688677355 java-1.8.0-openjdk: Fix of 7 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u372-b07. That fixes following CVEs: - CVE-2023-21930: Improper connection handling during TLS handshake 8294474 - CVE-2023-21937: Missing string checks for NULL characters 8296622 - CVE-2023-21938: Incorrect handling of NULL characters in...
CLSA-2023-1686586528 Fix CVE(s): CVE-2020-1938, CVE-2022-42252
SECURITY UPDATE: Apache Tomcat request smuggling - debian/patches/CVE-2022-42252.patch: Requests with invalid content-length should always be rejected. - CVE-2022-42252 SECURITY UPDATE: AJP Request Injection and potential Remote Code Execution - debian/patches/CVE-2020-1938.patch: Add new AJP...
CLSA-2023-1685631968 samba: Fix of CVE-2022-1615
CVE-2022-1615: util/genrand: don't ignore errors in random number generation...
CLSA-2023-1685629885 git: Fix of 2 CVEs
CVE-2022-24765: fix safe.directory key not being checked in setup.c - CVE-2022-29178: avoid failing dir ownership check - some unstable tests were disabled...
CLSA-2023-1685377319 vim: Fix of CVE-2023-2610
CVE-2023-2610: limit the text length to MAXCOL...
CLSA-2023-1685023501 libssh: Fix of CVE-2021-3634
CVE-2021-3634: create a separate length for sessionid...
CLSA-2023-1684174025 Update of spamassassin
Rebuilt with rebrand to TuxCare ELS...
CLSA-2023-1683815086 Fix CVE(s): CVE-2023-25652, CVE-2023-29007
SECURITY UPDATE: By feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents corresponding to the rejected hunks from the given patch - debian/patches/CVE-2023-25652.patch: removing a link instead of writing into ...
CLSA-2023-1683235231 openssl: Fix of 3 CVEs
CVE-2023-0464: Fix excessive resource use verifying X.509 policy constraints - CVE-2023-0466: Fix documentation of X509VERIFYPARAMadd0policy - CVE-2022-3996: Drop redundant flag setting in policycachesetmapping...
CLSA-2023-1682593947 Fix CVE(s): CVE-2023-29469, CVE-2023-28484
SECURITY UPDATE: Null dereference - debian/patches/CVE-2023-28484.patch: Fix null-pointer-deref in xmlSchemaFixupComplexType - CVE-2023-28484 SECURITY UPDATE: Fix a null pointer dereference - debian/patches/fix-null-ptr-deref.patch: use XMLSCHEMASANYTYPE instead of a null pointer - CVE-2023-28484...
CLSA-2023-1681490707 curl: Fix of 3 CVEs
CVE-2023-27533: prevent TELNET option from IAC injection - CVE-2023-27535: fix behavior when FTP too eager connection reuse - CVE-2023-27536: do not reuse connections with different GSS delegations...
CLSA-2023-1681236252 Update of microcode_ctl
Update Intel CPU microcode to microcode-20230214 release: - Addition of 06-6c-01/0x10 microcode at revision 0x1000211; - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170; - Addition of 06-8f-04/0x87 microcode at revision 0x2b000181; - Addition of 06-8f-05/0x10 microcode in...
CLSA-2023-1681162921 Update of microcode_ctl
Update Intel CPU microcode to microcode-20230214 release: - Addition of 06-6c-01/0x10 microcode in microcode.dat at revision 0x1000211; - Addition of 06-8f-04/0x10 microcode in microcode.dat at revision 0x2c000170; - Addition of 06-8f-04/0x87 microcode in microcode.dat at revision 0x2b000181; -...
CLSA-2023-1680210210 Fix CVE(s): CVE-2022-47024
SECURITY UPDATE: No check if the return value of XCreateGC is NULL - debian/patches/CVE-2022-47024: Only use the return value when it is not NULL. - CVE-2022-47024...
CLSA-2023-1677096181 git: Fix of 4 CVEs
CVE-2022-41903: fix out-of-bounds write caused by integer overflow - CVE-2021-40330: forbid newlines in host and path - CVE-2022-39260: reject too long command line strings - CVE-2023-23946: prevent git-apply from writing behind newly created symbolic links...
CLSA-2023-1676571280 Update of ca-certificates
Update to CKBI 2.60 from NSS 3.86 - Removed: - Certificate "Camerfirma Global Chambersign Root" - Certificate "Cybertrust Global Root" - Certificate "DST Root CA X3" - Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" - Certificate "GlobalSign Root CA - R2" - Certificate "Staat der...
CLSA-2023-1676570255 Update of nss
Update to CKBI 2.60 from NSS 3.86 - Added: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Certificate "Certainly Root E1" - Certificate "Certainly Root R1" - Certificate "DigiCert SMIME ECC P384 Root G5" - Certificate "DigiCert SMIME RSA4096 Root G5" - Certificate...
CLSA-2023-1676026276 openssl: Fix of 2 CVEs
CVE-2023-0215: Fix a UAF resulting from a bug in BIOnewNDEF - CVE-2023-0286: Fix GENERALNAMEcmp for x400Address...
CLSA-2023-1676025915 openssl: Fix of 2 CVEs
CVE-2023-0215: Fix a UAF resulting from a bug in BIOnewNDEF - CVE-2023-0286: Fix GENERALNAMEcmp for x400Address...
CLSA-2023-1675985852 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09. That fixes following CVEs: - CVE-2023-21830: Improper restrictions in CORBA deserialization Serialization, 8285021 - CVE-2023-21843: Soundbank URL remote loading Sound, 8293742 - Update tzdata requirement to 2022g to match JDK-8297804 -...
CLSA-2023-1675984832 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09. That fixes following CVEs: - CVE-2023-21830: Improper restrictions in CORBA deserialization Serialization, 8285021 - CVE-2023-21843: Soundbank URL remote loading Sound, 8293742 - Update tzdata requirement to 2022g to match JDK-8297804 -...
CLSA-2023-1675984774 Update of tzdata
Upgrade to tzdata-2022g - The northern edge of the Mexican state of Chihuahua will change time zone to agree with nearby US locations on 2022-11-30. - Added a new Zone America/CiudadJuarez that splits from America/Ojinaga. - Mexico will stop observing DST except near the US border. - Chihuahua...
CLSA-2023-1675984558 java-1.8.0-openjdk: Fix of 2 CVEs
Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b09. That fixes following CVEs: - CVE-2023-21830: Improper restrictions in CORBA deserialization Serialization, 8285021 - CVE-2023-21843: Soundbank URL remote loading Sound, 8293742 - Update tzdata requirement to 2022g to match JDK-8297804 -...
CLSA-2023-1675372649 Fix CVE(s): CVE-2018-20217
SECURITY UPDATE: Possible KDC crash processing malformed S4U2Self request - debian/patches/CVE-2018-20217.patch: ignore password attributes for S4U2Self requests - CVE-2018-20217...
CLSA-2022-1671656169 Update of ca-certificates
update to CKBI 2.58 from NSS 3.67 - removed old certificates: - Certificate "Camerfirma Global Chambersign Root" - Certificate "Cybertrust Global Root" - Certificate "Equifax Secure eBusiness CA 1" - Certificate "Equifax Secure Global eBusiness CA" - Certificate "Explicitly Distrusted DigiNotar...
CLSA-2022-1670523403 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CLSA-2022-1670522857 libxml2: Fix of 2 CVEs
CVE-2022-40303: fix integer overflows with XMLPARSEHUGE - CVE-2022-40304: fix dict corruption caused by entity reference cycles...
CLSA-2022-1670518262 Fix CVE(s): CVE-2022-40303, CVE-2022-40304
SECURITY UPDATE: Integer overflows with XMLPARSEHUGE - debian/patches/CVE-2022-40303.patch: Impose size limits when XMLPARSEHUGE is set and add length checks to core parser functions - CVE-2022-40303 SECURITY UPDATE: Dict corruption caused by entity reference cycles -...