6298 matches found
MGASA-2014-0475 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream -longterm 3.10.60 and fixes the following security issues: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non- canonical address to a model-specific register, which allows...
MGASA-2014-0433 Updated zabbix package fixes security vulnerability
It was reported that the Zabbix frontend supported an XML data import feature, where on the server it used DOMDocument to parse the XML. By default, DOMDocument also parses the external DTD, which could allow a remote attacker to use a crafted XML file causing Zabbix to read an arbitrary local...
MGASA-2014-0428 Updated chromium-browser-stable packages fix security vulnerabilities
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash or, potentially, execute arbitrary code with the privileges of the user running Chromium CVE-2014-3188, CVE-2014-3189, CVE-2014-3190, CVE-2014-3191,...
MGASA-2014-0424 Updated mariadb packages fix security vulnerabilities
This update provides MariaDB 5.5.40, which fixes several security issues and other bugs...
MGASA-2014-0397 Updated libvncserver & remmina packages fix security vulnerabilities
Updated libvncserver and remmina packages fix security vulnerabilities: A malicious VNC server can trigger incorrect memory management handling by advertising a large screen size parameter to the VNC client. This would result in multiple memory corruptions and could allow remote code execution on...
MGASA-2014-0391 Updated nss packages fix CVE-2014-1568
Updated nss packages fix security vulnerability: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services NSS libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack...
MGASA-2014-0380 Updated zarafa packages fix multiple vulnerabilities
Updated zarafa packages fix security vulnerabilities: Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server CVE-2014-0103. Rober...
MGASA-2014-0366 Updated python-django packages fix multiple vulnerabilities
Updated python-django and python-django14 packages fix security vulnerabilities: These releases address an issue with reverse generating external URLs CVE-2014-0480; a denial of service involving file uploads CVE-2014-0481; a potential session hijacking issue in the remote-user middleware...
MGASA-2014-0350 Updated ansible package fixes multiple security issues
Updated ansible package fixes security vulnerabilities: The Ansible platform before version 1.6.7 suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control certain playbook variables CVE-2014-4678, CVE-2014-4966,...
MGASA-2014-0347 Updated jakarta-commons-httpclient and httpcomponents-client packages fix security vulnerability
Updated jakarta-commons-httpclient and httpcomponents-client packages fix security vulnerability: The Jakarta Commons HttpClient and Apache httpcomponents HttpClient components may be susceptible to a 'Man in the Middle Attack' due to a flaw in the default hostname verification during SSL/TLS whe...
MGASA-2014-0341 Updated catfish package fixes CVE-2014-2093
Updated catfish package fixes security vulnerability: Untrusted search path vulnerability in Catfish allows local users to gain privileges via a Trojan horse catfish.py in the current working directory CVE-2014-2093. Additionally, the update fixes the application icon symlink and a crash when som...
MGASA-2014-0302 Updated cacti package fixes security vulnerabilities
Multiple security issues cross-site scripting, cross-site request forgery, SQL injections, missing input sanitising have been found in Cacti CVE-2014-2326, CVE-2014-2328, CVE-2014-2708, CVE-2014-2709, CVE-2014-4002...
MGASA-2014-0295 Updated pidgin packages fix CVE-2014-3775
Updated pidgin packages fix security vulnerability: It was discovered that libgadu incorrectly handled certain messages from file relay servers. A malicious remote server or a man in the middle could use this issue to cause applications using libgadu to crash, resulting in a denial of service, or...
MGASA-2014-0265 Updated kernel packages fixes security vulnerabilities.
Updated kernel packages fixes security vulnerabilities. The kernel has been updated to the upstream 3.12.21 longterm kernel, and fixes the following security issues: media-device: fix infoleak in ioctl mediaenumentities CVE-2014-1739 The futexrequeue function in kernel/futex.c in the Linux kernel...
MGASA-2014-0263 Updated qt3 packages fix security vulnerabilities
Updated qt3 packages fix security vulnerabilities: QXmlSimpleReader in Qt versions prior to 5.2 supports expansion of internal entities in XML documents without placing restrictions to ensure the document does not cause excessive memory usage. If an application using this API processes untrusted...
MGASA-2014-0235 Updated kernel-linus packages fix multiple security vulnerabilities
Updated kernel-linus provides upstream 3.10.40 kernel and fixes the following security issues: The microcode on AMD 16h 00h through 0Fh processors does not properly handle the interaction between locked instructions and write-combined memory types, which allows local users to cause a denial of...
MGASA-2014-0201 Updated firefox & thunderbird packages fix multiple vulnerabilities
Updated firefox and thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user...
MGASA-2014-0193 Updated cups packages fix CVE-2014-2856
Updated cups packages fix security vulnerability: Cross-site scripting XSS vulnerability in scheduler/client.c in Common Unix Printing System CUPS before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the ispathabsolute function CVE-2014-2856...
MGASA-2014-0191 Updated ruby-rails and associated packages fix multiple vulnerabilities
Updated ruby-activerecord and ruby-actionpack packages fix security vulnerabilities: There is a data injection vulnerability in Active Record. Specially crafted strings can be used to save data in PostgreSQL array columns that may not be intended CVE-2014-0080. There is an XSS vulnerability in th...
MGASA-2014-0184 Updated virtualbox packages fixes security vulnerabilities
Multiple vulnerabilities in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect integrity and availability via unknown vectors related to Core CVE-2013-5892, CVE-2014-0404, CVE-2014-0405,...
MGASA-2014-0146 Updated iceape packages fix multiple vulnerabilities
Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to cause a denial of service memory corruption and...
MGASA-2014-0129 Updated udisks and udisks2 packages fixes security vulnerability
A flaw was found in the way udisks and udisks2 handled long path names. A malicious, local user could use this flaw to create a specially-crafted directory structure that could lead to arbitrary code execution with the privileges of the udisks daemon root CVE-2014-0004...
MGASA-2014-0100 Updated xstream packages fix CVE-2013-7285
Updated xstream packages fix security vulnerability: It was found that XStream would deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code executio...
MGASA-2014-0097 Updated openswan packages fix CVE-2013-6466
Updated openswan packages fix security vulnerability: A NULL pointer dereference flaw was discovered in the way Openswan's IKE daemon processed IKEv2 payloads. A remote attacker could send specially crafted IKEv2 payloads that, when processed, would lead to a denial of service daemon crash,...
MGASA-2014-0088 Updated freeradius package fixes security vulnerability
SSHA processing in freeradius before 2.2.3 runs into a stack-based buffer overflow in the freeradius rlmpap module if the password source uses an unusually long hashed password CVE-2014-2015...
MGASA-2014-0072 Updated tntnet packages fix security vulnerability
A flaw in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests CVE-2013-7299...
MGASA-2014-0063 Updated kernel-rt packages fix security vulnerability
This kernel update provides an update to 3.12.9 and fixes the following critical security issue: Pageexec reported a bug in the Linux kernel's recvmmsg syscall when called from code using the x32 ABI. An unprivileged local user could exploit this flaw to cause a denial of service system crash or...
MGASA-2014-0042 Updated springframework packages fix CVE-2013-4152
Updated springframework packages fix security vulnerability: Alvaro Munoz discovered a XML External Entity XXE injection in the Spring Framework which can be used for conducting CSRF and DoS attacks on other sites CVE-2013-4152...
MGASA-2014-0036 Updated Firefox & Thunderbird packages fix multiple security vulnerabilities
Updated firefox and thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user...
MGASA-2014-0026 Updated lightdm-gtk-greeter fixes CVE-2014-0979
Updated lightdm-gtk-greeter package fixes security vulnerability: lightdm-gtk-greeter uses the lightdm-gobject API incorrectly and does not handle lightdmgreetergetauthenticationuser returning NULL when the username of the previous authentication is invalid resulting in a NULL pointer dereference...
MGASA-2013-0377 Updated fcron package fixes security vulnerability and init script
fcrontab in fcron before 3.0.5 allows local users to read arbitrary files via a symlink attack on an unspecified file CVE-2010-0792. An error in the init script as also been corrected...
MGASA-2013-0365 Updated gimp package fixes security vulnerabilities
An integer overflow flaw and a heap-based buffer overflow were found in the way GIMP loaded certain X Window System XWD image dump files. A remote attacker could provide a specially crafted XWD image file that, when processed, would cause the XWD plug-in to crash or, potentially, execute arbitrar...
MGASA-2013-0330 Updated python-scipy packages fix a security vulnerability and missing deps
Updated python-scipy package fixes security vulnerability: scipy.weave will use /tmp/username as persistent storage cache, but it does not check whether or not this directory already exists, does not check whether it is a directory or a symlink, and also does not verify permissions or ownership,...
MGASA-2013-0296 Updated ssmtp package fixes security vulnerability
It was reported that ssmtp, an extremely simple MTA to get mail off the system to a mail hub, did not perform x509 certificate validation when initiating a TLS connection to server. A rogue server could use this flaw to conduct man-in- the-middle attack, possibly leading to user credentials leak...
MGASA-2013-0294 Updated libvirt package fixes security vulnerabilities
It was discovered that libvirt incorrectly handled certain memory stats requests. A remote attacker could use this issue to cause libvirt to crash, resulting in a denial of service CVE-2013-4296. It was discovered that libvirt incorrectly handled certain bitmap operations. A remote attacker could...
MGASA-2013-0288 Updated glpi package fixes security vulnerabilities
Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 CVE-2013-2226, 0.83.91 CVE-2013-2225, and 0.84.2 CVE-2013-5696. This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues...
MGASA-2013-0274 Updated python-setuptools and python-virtualenv packages fix security vulnerability
easyinstall in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product CVE-2013-1633...
MGASA-2013-0270 Updated roundcubemail package fixes security vulnerability
XSS vulnerabilities when saving HTML signatures and when editing a message "as new" or draft in roundcubemail before 0.9.3 CVE-2013-5645...
MGASA-2013-0259 Updated puppet and puppet3 package fix security vulnerabilities
It was discovered that Puppet incorrectly handled the resourcetype service. A local attacker on the master could use this issue to execute arbitrary Ruby files CVE-2013-4761. It was discovered that Puppet incorrectly handled permissions on the modules it installed. Modules could be installed with...
MGASA-2013-0258 Updated libtiff packagess fix multiple security vulnerabilities
Updated libtiff packages fix security vulnerabilities: Pedro Ribeiro discovered a buffer overflow flaw in rgb2ycbcr, a tool to convert RGB color, greyscale, or bi-level TIFF images to YCbCr images, and multiple buffer overflow flaws in gif2tiff, a tool to convert GIF images to TIFF. A remote...
MGASA-2013-0210 Updated kernel-linus package fixes security issues
This kernel update provides the upstream 3.4.52 kernel and fixes the follwing security issues: The pcibackenablemsi function in the PCI backend driver drivers/xen/pciback/confspacecapabilitymsi.c in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a...
MGASA-2026-0485 Updated polkit package fixes a security vulnerability
Regression in CVE-2026-4897 fix polkit readcookie - stack buffer underflow. CVE-2026-85498...
MGASA-2026-0476 Updated tomcat-native package fixes security vulnerabilities
DoS via TLS handshake. CVE-2026-86243 Insecure OpenSSL options enabled. CVE-2026-86246 Client certificate requirements can be down-graded. CVE-2026-86247...
MGASA-2026-0470 Updated tesseract packages fix security vulnerabilities
This is a security update. It fixes nine vulnerabilities in tesseract, the OCR text recognition engine. All nine can be triggered only by feeding tesseract a maliciously crafted input file: either a specially crafted recognition/language data file .traineddata or a crafted word-list file. Dependi...
MGASA-2026-0469 Updated srt package fixes security vulnerabilities
Encryption State Machine Downgrade. CVE-2026-55868 KMREQ/KMRSP Stack-Based Buffer Overflow. CVE-2026-55869...
MGASA-2026-0467 Updated python-tornado packages fix security vulnerabilities
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient Tornado has out-of-bounds memory access via C extension tornado AsyncHTTPClient accumulates decompressed chunks without size limit gzip bomb...
MGASA-2026-0442 Updated libwebsockets packages fix a security vulnerability
warmcat libwebsockets SSH Protocol sshd.c lwssshparseplaintext resource consumption. CVE-2026-10650...
MGASA-2026-0422 Updated bind package fixes security vulnerabilities
Unauthenticated IXFR deltas are applied to the live zone before TSIG verification CVE-2026-19033. qpcache NOQNAME proof use-after-free crashes recursive resolver CVE-2026-19662. Use-after-free in queryaddnoqnameproof via the DNS64 filter64 path CVE-2026-19666. Remote assertion failure via 16-bit...
MGASA-2026-0421 Updated python-configargparse packages fix security vulnerabilities
Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values...
MGASA-2026-0404 Updated perl-HTML-FormFu packages fix a security vulnerability
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. CVE-2026-19873...