6277 matches found
MGASA-2014-0404 Updated fish package fixes multiple security vulnerabilities
Updated fish packages fix security vulnerability: fish, from at least version 1.16.0 to version 2.1.0 inclusive, does not check the credentials of processes communicating over the fishd universal variable server UNIX domain socket. This allows a local attacker to elevate their privileges to those...
MGASA-2014-0377 Updated mariadb packages fix CVE-2014-4274
Updated mariadb packages fix security vulnerability: MyISAM temporary files could be used to mount a code-execution attack CVE-2014-4274. The mariadb package has been updated to version 5.5.39, which fixes this and several other issues. Refer to the upstream Changelog for more details...
MGASA-2014-0327 Updated kdelibs4 packages fix security vulnerability and various bugs
This update fixes a security vulnerability in the polkit authentication backend of kdelibs CVE-2014-5033 mga13792, and fixes some additional issues: - duplicate targets in PythonMacros.cmake reviewboard kde 111371, - kded4 leak sockets in NetworkInterface::isWireless bko324954, - media type...
MGASA-2014-0306 Updated gcc packages fix security vulnerability and other bugs
Updated gcc packages fix the following security issue: Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code. CVE-2014-5044 They also fix...
MGASA-2014-0287 Updated freerdp packages fix two vulnerabilities
Updated freerdp packages fix security vulnerabilities: Integer overflows in memory allocations in client/X11/xfgraphics.c in FreeRDP through 1.0.2 allows remote RDP servers to have an unspecified impact through unspecified vectors CVE-2014-0250. Integer overflow in the licensereadscopelist functi...
MGASA-2014-0258 Updated php packages fix CVE-2014-0237-8
Updated php packages fix security vulnerabilities: A flaw was found in the way file's Composite Document Files CDF format parser handle CDF files with many summary info entries. The cdfunpacksummaryinfo function unnecessarily repeatedly read the info from the same offset. This led to many...
MGASA-2014-0216 Updated python3 packages fix security vulnerability
It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit fil...
MGASA-2014-0194 Updated otrs packages fix multiple vulnerabilities
Updated otrs package fixes security vulnerabilities: A logged in attacker could insert special content in dynamic fields, leading to JavaScript code being executed in OTRS CVE-2014-2553. An attacker could embed OTRS in a hidden iframe tag of another page, tricking the user into clicking links in...
MGASA-2014-0089 Updated python-numpy packages fix security vulnerabilities
f2py insecurely used a temporary file. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running f2py CVE-2014-1858, CVE-2014-1859...
MGASA-2014-0035 Updated flash-player-plugin packages fix CVE-2014-0497
Adobe Flash Player 11.2.202.336 contains a fix to a critical security vulnerability found in earlier versions that could cause a crash and potentially allow an attacker to remotely take control of the affected system. This update resolves an integer underflow vulnerability that could be exploited...
MGASA-2014-0020 Updated libxfont packages fix security vulnerability
Updated libxfont packages fix security vulnerability: It was discovered that a buffer overflow in the processing of Glyph Bitmap Distribution fonts BDF could result in the execution of arbitrary code CVE-2013-6462...
MGASA-2014-0007 Updated nodejs package fixes security vulnerabilities
A denial of service flaw was found in the way Node.js handled pipelined HTTP requests. A remote attacker could use this flaw to send an excessive amount of HTTP requests over a network connection, causing Node.js to use an excessive amount of memory and possibly exit when all available memory is...
MGASA-2013-0380 Updated wireshark packages fix two security vulnerabilities
Updated wireshark packages fix security vulnerabilities: The SIP dissector could go into an infinite loop CVE-2013-7112. The NTLMSSP v2 dissector could crash CVE-2013-7114...
MGASA-2013-0359 Updated drupal package fixes security vulnerabilities
Drupal's form API has built-in cross-site request forgery CSRF validation, and also allows any module to perform its own validation on the form. In certain common cases, form validation functions may execute unsafe operations CVE-2013-6385. Drupal core directly used the mtrand pseudorandom number...
MGASA-2013-0350 Updated graphicsmagick packages fix CVE-2013-4589
Updated graphicsmagick packages fix security vulnerability: GraphicsMagick before 1.3.18 is found to have a vulnerability which can be exploited by malicious people to cause a Denial of Service DoS. The vulnerability is caused due to an error within the "ExportAlphaQuantumType" function found in...
MGASA-2013-0327 Updated torque packages fix CVE-2013-4495
Updated torque packages fix security vulnerability: A user could submit executable shell commands on the tail of what is passed with the -M switch for qsub. This was later passed to a pipe, making it possible for these commands to be executed as root on the pbsserver CVE-2013-4495...
MGASA-2013-0324 Updated chromium-browser-stable packages fix multiple vulnerabilities
Updated chromium-browser-stable packages fix security vulnerabilities: Various fixes from internal audits, fuzzing and other initiatives CVE-2013-2931. Use after free related to speech input elements CVE-2013-6621. Use after free related to media elements CVE-2013-6622. Out of bounds read in SVG...
MGASA-2013-0312 Updated clutter packages fix CVE-2013-2190
Updated clutter packages fix security vulnerability: A security flaw was found in the way Clutter, an open source software library for creating rich graphical user interfaces, used to manage translation of hierarchy events in certain circumstances when underlying device disappeared, causing...
MGASA-2013-0297 Updated ruby-RubyGems package fixes security vulnerabilies
Updated ruby-RubyGems package fixes security vulnerability: RubyGems validates versions with a regular expression that is vulnerable to denial of service due to a backtracking regular expression. For specially crafted RubyGems versions attackers can cause denial of service through CPU consumption...
MGASA-2013-0293 Updated polkit package and the packages that call polkit fixes security vulnerability
A race condition was found in the way the PolicyKit pkcheck utility checked process authorization when the process was specified by its process ID via the --process option. A local user could use this flaw to bypass intended PolicyKit authorizations and escalate their privileges CVE-2013-4288...
MGASA-2013-0292 Updated openjpa packages fix CVE-2013-1768
Updated openjpa packages fix security vulnerability: The BrokerFactory functionality in Apache OpenJPA before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to...
MGASA-2013-0253 Updated rubygem-passenger package fixes CVE-2013-4136 & apache module
Updated rubygem-passenger package fixes security vulnerability: It was reported that Phusion Passenger would reuse existing server instance directories temporary directories which could cause Passenger to remove or overwrite files belonging to other instances CVE-2013-4136. Additionally, the...
MGASA-2013-0250 Updated python packages fix CVE-2013-4238 and pip
Updated python packages fix security vulnerability: Ryan Sleevi of the Google Chrome Security Team has discovered that Python's SSL module doesn't handle NULL bytes inside subjectAltNames general names. This could lead to a breach when an application uses ssl.matchhostname to match the hostname...
MGASA-2013-0238 Updated phpmyadmin packages fix security vulnerabilities
Using a crafted SQL query, it was possible to produce an XSS on the SQL query form PMASA-2013-8CVE-2013-4995. In the setup/index.php, using a crafted hash with a Javascript event, untrusted JS code could be executed. In the Display chart view, a chart title containing HTML code was rendered...
MGASA-2013-0233 Updated php packages fix CVE-2013-4113
Updated php packages fix security vulnerability: Fixed PHP bug 65236 heap corruption in xml parser CVE-2013-4113. Additionally the php-timezonedb packages have been upgraded to the latest version 2013.4...
MGASA-2013-0217 Updated moodle package fixes multiple security vulnerabilities
Flash files distributed with the YUI library in Moodle before 2.4.5 may have allowed for cross-site scripting attacks MSA-13-0025. Privacy settings for the IMS-LTI External tool module in Moodle before 2.4.5 were not able to be changed so personal information was always transferred MSA-13-0026...
MGASA-2013-0201 Updated python-pymongo packages fix CVE-2013-2132
PyMongo before 2.5.2 is prone to a denial-of-service vulnerability. An attacker can remotely trigger a NULL pointer dereference causing MongoDB to crash CVE-2013-2132...
MGASA-2013-0191 Updated tomcat7 packages fix CVE-2013-2071
java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other application...
MGASA-2026-0458 Updated php package fixes security vulnerabilities
FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...
MGASA-2026-0425 Updated libssh packages fix security vulnerabilities
Stack buffer overflow in SFTP server longname construction. CVE-2026-15370 Denial of service via zero advertised channel packet size. CVE-2026-59843 Denial of service via oversized SFTP read length. CVE-2026-59844 Denial of service via unchecked ProxyCommand fork failure. CVE-2026-59845 Informati...
MGASA-2026-0410 Updated aom packages fix security vulnerabilities
Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. CVE-2026-56208 Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. CVE-2026-56209 Heap-buffer-overflow read via missing bounds check in ctrlsetlayerid. CVE-2026-56210 Remote code executi...
MGASA-2026-0396 Updated xz packages fix security vulnerabilities
XZ Utils: Invalid write if a decoder is reinitialized after allocation failure...
MGASA-2026-0352 Updated expat & mingw-expat packages fix security vulnerabilities
Missing control flow integrity checks. CVE-2026-50219 Missing control flow integrity checks. CVE-2026-56131 Out-of-bounds write. CVE-2026-56132 Integer overflow. CVE-2026-56403 Integer overflow. CVE-2026-56404 Integer overflow. CVE-2026-56405 Integer overflow. CVE-2026-56406 Integer overflow...
MGASA-2026-0329 Updated php8.4 packages fix security vulnerabilities
The updated php 8.4 packages fix some security vulnerabilities. See the references for more information...
MGASA-2026-0300 Updated wget packages fix security vulnerabilities
Updated wget packages fix security vulnerabilities: -CVE-2026-58469 Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Mageia 9 and Mageia 10. -CVE-2026-58470 : Wget...
MGASA-2026-0255 Updated tmux packages fix a security vulnerability
The updated package fixes a security vulnerability: tmux image.c imagefree use after free. CVE-2026-11623...
MGASA-2026-0169 Updated sdl2_sound packages fix security vulnerability
Updated packages fix CVE-2025-14369 in bundled drflac...
MGASA-2026-0140 Updated perl-HTTP-Tiny packages fix security vulnerability
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. CVE-2026-7010...
MGASA-2026-0125 Updated thunderbird packages fix security vulnerabilities
Use-after-free in the DOM: Core & HTML component. CVE-2026-6746 Use-after-free in the WebRTC component. CVE-2026-6747 Uninitialized memory in the Audio/Video: Web Codecs component. CVE-2026-6748 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. CVE-2026-6749...
MGASA-2026-0095 Updated tomcat packages fix security vulnerabilities
Request smuggling via invalid chunk extension. CVE-2026-24880 Occasionally open redirect. CVE-2026-25854 TLS cipher order is not preserved. CVE-2026-29129 OCSP checks sometimes soft-fail even when soft-fail is disabled. CVE-2026-29145 EncryptInterceptor vulnerable to padding oracle attack by...
MGASA-2026-0090 Updated python-pygments packages fix security vulnerability
A security flaw in Pygments function AdlLexer in archetype.py stems from a regular expression having an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. CVE-2026-4539...
MGASA-2026-0061 Updated expat packages fix security vulnerabilities
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. CVE-2026-32776 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. CVE-2026-32777 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry...
MGASA-2026-0059 Updated openssh packages fix security vulnerabilities
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. CVE-2025-61984...
MGASA-2026-0057 Updated python-nltk packages fix security vulnerability
Path Traversal in nltk/nltk. CVE-2026-0847...
MGASA-2026-0054 Updated yt-dlp packages fix security vulnerability
When yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL...
MGASA-2026-0003 Updated curl packages fix security vulnerabilities
curl is susceptible to a number of low severity security vulnerabilities: CVE-2025-14524: bearer token leak on cross-protocol redirect CVE-2025-14819: OpenSSL partial chain store policy bypass CVE-2025-15079: libssh knownhosts file vulnerability CVE-2025-15224: libssh key passphrase bypass...
MGASA-2025-0296 Updated apache-commons-fileupload packages fix security vulnerability
Apache Commons FileUpload: FileUpload DoS via part headers. CVE-2025-48976...
MGASA-2025-0272 Updated strongswan packages fix security vulnerability
Buffer Overflow When Handling EAP-MSCHAPv2 Failure Requests. CVE-2025-62291...
MGASA-2025-0249 Updated icu packages fix security vulnerability
A stack buffer overflow was found in Internationl components for unicode ICU . While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution...