16770 matches found
CLSA-2024-1735300164 pam: Fix of CVE-2024-10963
CVE-2024-10963: pamaccess: rework resolving of tokens as hostname...
CLSA-2024-1735130624 php: Fix of CVE-2024-8929
CVE-2024-8929: Fix leak partial content of the heap through heap buffer over-read issue...
CLSA-2024-1735128985 Fix CVE(s): CVE-2024-50602
SECURITY UPDATE: Crash in XMLResumeParser due to XMLStopParser issue - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser due to XMLERRORNOTSTARTED - debian/patches/CVE-2024-50602-1.patch: Explicitly specify XMLPARSING in XMLStopParser to ensure correct parsing status...
CLSA-2024-1735127885 Fix CVE(s): CVE-2022-38076
CVE-2022-38076 - linux-firmware: Update for Intel Dual Band Wireless AC 3168 - linux-firmware: Upadte for Intel Wireless 7265 Rev D Family - linux-firmware: Update for Intel Dual Band Wireless AC 3165 - linux-firmware: Update for Intel Wireless AC 9560 - linux-firmware: Update for Intel Wireless ...
CLSA-2024-1735065830 Fix CVE(s): CVE-2024-11233
SECURITY UPDATE: Security vulnerability in package - debian/patches/CVE-2024-11233.patch: fix error in convert.quoted printable-decode filter certain data leading to buffer overread. Fix segfault with streams and invalid data. - CVE-2024-11233...
CLSA-2024-1734704732 Fix CVE(s): CVE-2024-11234
SECURITY UPDATE: improper sanitization of URIs leading to HTTP request smuggling - debian/patches/CVE-2024-11234.patch: Fix HTTP wrapper full URI path to disallow CR or LF characters - CVE-2024-11234...
CLSA-2024-1734643401 Fix CVE(s): CVE-2024-6923
SECURITY UPDATE: Improper quoting of newlines in email headers - debian/patches/CVE-2024-6923.patch: Fix serialization of display name in originator or destination address fields with both encoded words and special chars - CVE-2024-6923...
CLSA-2024-1734543983 php: Fix of CVE-2024-11233
CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode filter...
CLSA-2024-1734543883 python3: Fix of CVE-2024-9287
CVE-2024-9287: fix path names quoting to prevent command injection in virtual environment activation scripts...
CLSA-2024-1734531954 cups: Fix of CVE-2024-35235
CVE-2024-35235: Patch arbitrary chmod vulnerability in cupsd process when starting server with symbolic link Listen configuration item...
CLSA-2024-1734027856 nettle: Fix of CVE-2018-16869
Port side-channel silent functions from 3.4.1. Partially fix for CVE-2018-16869 - CVE-2018-16869: Add side-channel silent memory, math, PKCS1, RSA functions - Added tests for side-channel silent implementations...
CLSA-2024-1733428726 wget: Fix of CVE-2024-38428
CVE-2024-38428: properly re-implement userinfo parsing rfc2396...
CLSA-2024-1733142398 kernel: Fix of 6 CVEs
hwmon: ibmpex Fix possible UAF when ibmpexregisterbmc fails CVE-2022-49029 - ppp: fix pppasyncencode illegal access CVE-2024-50035 - ext4: no need to continue when the number of entries is 1 CVE-2024-49967 - net/packet: fix slab-out-of-bounds access in packetrecvmsg CVE-2022-20368 - packet: in...
CLSA-2024-1733141074 krb5: Fix of 2 CVEs
CVE-2024-26458: Fix memory leak vulnerability in src/lib/rpc/pmaprmt.c - CVE-2024-26461: Fix memory leak vulnerability in src/lib/gssapi/krb5/k5sealv3.c...
CLSA-2024-1732702046 squid: Fix of CVE-2024-45802
CVE-2024-45802: Fix DoS by a trusted server by disabling ESI...
CLSA-2024-1732267577 kernel: Fix of 2 CVEs
net: bridge: xmit: make sure we have at least eth header len bytes CVE-2024-38538 - SUNRPC: Fix UAF in svctcplistendataready CVE-2023-52885 - Fix: Revert "smb: client: fix use-after-free bug in cifsdebugdataprocshow" double lock...
CLSA-2024-1732196985 Fix CVE(s): CVE-2020-27765
SECURITY UPDATE: Division by zero vulnerability in segment.c - debian/patches/CVE-2020-27765.patch: Fix averagetau calculation by multiplying instead of dividing by numbernodes in OptimalTau function to prevent incorrect segmentation output - CVE-2020-27765...
CLSA-2024-1731432257 Fix CVE(s): CVE-2024-32020
SECURITY UPDATE: When performing a local clone of a repository we end up either copying or hardlinking the source repository into the target repository. - debian/patches/CVE-2024-32020.patch: builtin/clone: refuse local clones of unsafe repositories - CVE-2024-32020...
CLSA-2024-1731341386 bzip2: Fix of CVE-2019-12900
CVE-2019-12900: accept as many selectors as the file format allows but ignore any larger than the theoretical maximum, BZMAXSELECTORS...
CLSA-2024-1731001050 Update of nss
update to CKBI 2.70 from NSS 3.104 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "certSIGN ROOT CA" - Certificate "ACCVRAIZ1" - Certificate "OISTE WISeKey Global Root GC CA" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma...
CLSA-2024-1730919636 Fix CVE(s): CVE-2024-32021
SECURITY UPDATE: Race condition when hardlinking file from the source repository into the destination file in the target repository. - debian/patches/CVE-2024-32021.patch: builtin/clone: abort when hardlinked source and target file differ - CVE-2024-32021...
CLSA-2024-1730916930 Update of alt-php
Update ca-certificates database to 20240909: - mozilla\certdata.txt,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.70. - The following certificates were updated: Certificate "certSIGN ROOT CA" Certificate "ACCVRAIZ1" Certificate "OISTE WISeKey Global Root GC CA" - The...
CLSA-2024-1730910767 Update of ca-certificates
update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "GLOBALTRUST 2020" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Baltimore CyberTrust Root" - Certificate "Entrust Root...
CLSA-2024-1730910356 Update of nss
update to CKBI 2.69 from NSS 3.103 - updated certificates: - Certificate "OISTE WISeKey Global Root GC CA" - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed certificates: - Certificate "Security Communication Root CA" - Certificate "Camerfirma Chambers of...
CLSA-2024-1730801286 openssl: Fix of CVE-2024-5535
CVE-2024-5535: Validate provided client list in ssl/ssllib.c. Clarify SSLselectnextproto documentation...
CLSA-2024-1730296987 Update of krb5
Modify the spec file not to skip the %check section during the build...
CLSA-2024-1730226852 php: Fix of CVE-2024-8925
CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data boundaries larger than the read buffer...
CLSA-2024-1729870301 kernel: Fix of 12 CVEs
ftrace: Fix possible use-after-free issue in ftracelocation CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs CVE-2024-38588 - ftrace: Store the order of pages allocated in ftracepage CVE-2024-38588 - ftrace: Check if pages were allocated before calling...
CLSA-2024-1729869774 kernel: Fix of 12 CVEs
ftrace: Fix possible use-after-free issue in ftracelocation CVE-2024-38588 - ftrace: Fix possible warning on checking all pages used in ftraceprocesslocs CVE-2024-38588 - ftrace: Store the order of pages allocated in ftracepage CVE-2024-38588 - ftrace: Check if pages were allocated before calling...
CLSA-2024-1729627812 Fix CVE(s): CVE-2024-8927
SECURITY UPDATE: insecure configuration vulnerability - debian/patches/CVE-2024-8927.patch: fix bypass of cgi.forceredirect configuration - CVE-2024-8927...
CLSA-2024-1729627400 Fix CVE(s): CVE-2023-27043
SECURITY UPDATE: Incorrect parsing of email addresses containing special characters - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses and parseaddr functions - debian/patches/fix-urllib2-test.patch: Fix error in...
CLSA-2024-1729193618 Fix CVE(s): CVE-2024-43802
SECURITY UPDATE: prevent heap-buffer overflow in typeahead buffer flushing - debian/patches/CVE-2024-43802.patch: fix heap-buffer-overflow in instypebuf by validating enough space left when flushing typeahead buffer - CVE-2024-43802...
CLSA-2024-1728580597 python3: Fix of 2 CVEs
CVE-2024-6232: remove backtracking when parsing tarfile headers - CVE-2024-7592: fix quadratic complexity in parsing '-quoted' cookie values with backslashes...
CLSA-2024-1728478342 Fix of 5 CVEs
New microcode update packages from upstream up to 2024-08-13: - Updated microcodes: sig 0x00050657, pfmask 0xbf, 2024-03-01, rev 0x5003707, size 39936 sig 0x0005065b, pfmask 0xbf, 2024-04-01, rev 0x7002904, size 30720 sig 0x000606a6, pfmask 0x87, 2024-04-01, rev 0xd0003e7, size 308224 sig...
CLSA-2024-1728404213 python2: Fix of CVE-2024-7592
CVE-2024-7592: fix quadratic complexity in parsing cookies with backslashes...
CLSA-2024-1728071284 python: Fix of 2 CVEs
CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value - CVE-2024-6232: fix regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing and was vulnerable to ReDoS via specifically-crafted tar...
CLSA-2024-1728071268 python2: Fix of CVE-2024-7592
CVE-2024-7592: fix quadratic complexity in parsing cookies with backslashes...
CLSA-2024-1727980155 python: Fix of CVE-2024-7592
CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess CPU resources while parsing the cookie value...
CLSA-2024-1727895152 php: Fix of 3 CVEs
CVE-2020-7071: fix URL validation with functions like filtervar$url, FILTERVALIDATEURL - CVE-2021-21705: fix URL validation functionality via filtervar function with FILTERVALIDATEURL parameter when an URL with invalid password field can be accepted as valid - CVE-2024-5458: fix early-out for...
CLSA-2024-1727374287 python3.9: Fix of CVE-2024-4032
CVE-2024-4032: fix missing and incorrect ip address ranges in privatenetwork variables...
CLSA-2024-1727287657 Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371
SECURITY UPDATE: fix GSS vulnerabilities - debian/patches/CVE-2021-37370.patch: prevent modification of Extra Count field in GSS krb5 wrap CFX wrap token to avoid appearing truncated to application header - debian/patches/CVE-2021-37371.patch: fix invalid memory reads during GSS message token...
CLSA-2024-1726773445 Fix CVE(s): CVE-2024-7264
SECURITY UPDATE: Heap Buffer Overflow in ASN.1 Parser - debian/patches/CVE-2024-7264.patch: Clean up GTime2str function to handle optional fractional seconds properly. Fix GTime2str issues and add unit tests to verify correct behaviour - CVE-2024-7264...
CLSA-2024-1726769396 krb5: Fix of 2 CVEs
CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...
CLSA-2024-1726769233 krb5: Fix of 2 CVEs
CVE-2024-37370: prevent modification of Extra Count field in GSS krb5 wrap token to avoid appearing truncated to application - CVE-2024-37371: fix invalid memory reads during GSS message token handling...
CLSA-2024-1725882897 kernel: Fix of 4 CVEs
media: dvb-core: Fix use-after-free due on race condition at dvbnet CVE-2022-45886 - media: dvb-core: Fix use-after-free due to race condition at dvbcaen50221 CVE-2022-45919 - bonding: Fix out-of-bounds read in bondoptionarpiptargetsset CVE-2024-39487 - net: fix dstnegativeadvice race...
CLSA-2024-1725471399 bind: Fix of CVE-2024-1975
CVE-2024-1975: Remove support for SIG0 message verification...
CLSA-2024-1725471321 bind: Fix of CVE-2024-1975
CVE-2024-1975: Remove support for SIG0 message verification...
CLSA-2024-1725012440 git: Fix of 2 CVEs
CVE-2024-32004: fetch/clone: detect dubious ownership of local repositories - CVE-2024-32465: upload-pack: disable lazy-fetching by default...
CLSA-2024-1725012269 Fix CVE(s): CVE-2024-37894
SECURITY UPDATE: Memory Corruption via Out-of-bounds Write in ESI variable assignment - debian/patches/CVE-2024-37894.patch: fix incorrect type declaration in TrieNode.cc to prevent potential type conversion issues - CVE-2024-37894...