6298 matches found
MGASA-2019-0413 Updated microcode packages fix security vulnerabilities
NOTE! This is a refresh of the 20191112 security update we released as MGASA-2019-0334. This update provides the Intel 20191115 microcode release that adds more microcode side fixes and mitigations for the Core Gen 6 to Core gen 10, some Xeon E series, adressing at least the following security...
MGASA-2019-0391 Updated libgit2 packages fix security vulnerabilities
libgit2 has been updated to version 0.28.4 to fix several security issues: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. CVE-2019-1348: the fast-import stream command "feature export-marks=path"...
MGASA-2019-0329 Updated libjpeg packages fix security vulnerability
The updated packages fix a security vulnerability: Several integer overflow issues and subsequent segfaults occur in libjpeg-turbo when attempting to compress or decompress gigapixel images. CVE-2019-2201...
MGASA-2019-0124 Updated ocaml packages fix security vulnerability
The camlbadeserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled data is accepted from an untrusted source, allows remote attackers to cause a denial of service memory corruption or possibly execute arbitrar...
MGASA-2019-0106 Updated openssl packages fix security vulnerability
If an application encounters a fatal protocol error and then calls SSLshutdown twice once to send a closenotify, and once to receive one then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received...
MGASA-2019-0083 Updated kauth packages fix security vulnerability
KAuth allows to pass parameters with arbitrary types to helpers running as root over DBus. Certain types can cause crashes and trigger decoding arbitrary images with dynamically loaded plugins...
MGASA-2019-0072 Updated dovecot packages fix security vulnerability
CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field sslcertusernamefield, under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing...
MGASA-2019-0058 Updated gitolite packages fixes security vulnerability
In commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P CVE-2018-20683...
MGASA-2019-0052 Updated bluez packages fix security vulnerability
A buffer overflow in pincodereplydump function CVE-2016-9800. A buffer overflow in setextctrl function CVE-2016-9801. A buffer overflow in commandsdump function CVE-2016-9804...
MGASA-2019-0056 Updated ghostscript packages fix a security vulnerability
Ghostscript could be made to crash, access files, or run programs if it opened a specially crafted file. CVE-2019-6116...
MGASA-2019-0020 Updated discount packages fix security vulnerabilities
The mkdtrimline function in mkdio.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted file CVE-2018-11468. DISCOUNT through version 2.2.3a is vulnerable to a Heap-based buffer-overflow in the markdown.c:isfootnote...
MGASA-2019-0010 Updated php-phpmailer package fixes security vulnerability
Potential object injection vulnerability CVE-2018-19296...
MGASA-2019-0009 Updated pdns-recursor packages fix security vulnerabilities
A vulnerability was in found in PowerDNS Recursor. The issue is a memory leak occurring while parsing some malformed records, due to the fact that some memory is allocated parsing a record and is not always properly released if the record is not valid. It allows a malicious auth server to cause a...
MGASA-2018-0480 Updated thunderbird packages fix security issues & bugs
Buffer overflow using computed size of canvas element. CVE-2018-12359 - Use-after-free when using focus. CVE-2018-12360 - Integer overflow in SwizzleData. CVE-2018-12361 - Integer overflow in SSSE3 scaler. CVE-2018-12362 - Media recorder segmentation fault when track type is changed during...
MGASA-2018-0472 Updated icecast packages fix security vulnerability
Buffer overflows in URL auth code if there is a "mount" definition that enables URL authentication. A malicious client could send long HTTP headers, leading to a buffer overflow and potential remote code execution CVE-2018-18820...
MGASA-2018-0465 Updated poppler packages fix security vulnerabilities
In Poppler 0.68.0, the Parser::getObj function in Parser.cc may cause infinite recursion via a crafted file. A remote attacker can leverage this for a DoS attack. CVE-2018-16646 An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service becau...
MGASA-2018-0458 Updated squid packages fix security vulnerabilities
Due to incorrect input handling, Squid is vulnerable to a Cross-Site Scripting vulnerability when generating HTTPS response messages about TLS errors CVE-2018-19131. Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack CVE-2018-19132...
MGASA-2018-0445 Updated python-dulwich packages fix security vulnerability
Dulwich, when an SSH subprocess is used, allowed remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname CVE-2017-16228...
MGASA-2018-0428 Updated perl-Dancer2 packages fix security vulnerabilities
Dancer2 0.206000 addresses several potential security issues. There is a potential RCE with regards to Storable. Dancer2 adds session ID validation to the session engine so that session backends based on Storable can reject malformed session IDs that may lead to exploitation of the RCE. Parsing...
MGASA-2018-0431 Updated axis packages fix security vulnerability
Updated axis packages fix security vulnerability: Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting XSS attack in the default servlet/services CVE-2018-8032...
MGASA-2018-0429 Updated python-cryptography packages fix security vulnerability
The python-cryptography and python-cryptography-vectors packages have been updated to version 2.3.1 and fixes the following security issue: The finalizewithtag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalizewithtag an attacker...
MGASA-2018-0418 Updated kernel-tmb packages fix security vulnerabilities
This kernel-tmb update is based on the upstream 4.14.78 and adds additional fixes for the L1TF security issues. It also fixes at least the following security issues: Linux kernel from versions 3.9 and up, is vulnerable to a denial of service attack with low rates of specially modified packets...
MGASA-2018-0417 Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.78 and fixes at least the following security issues: An issue was discovered in the fdlockedioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the...
MGASA-2018-0415 Updated bitcoin packages fix security vulnerability
Remote denial of service application crash exploitable by miners via duplicate input CVE-2018-17144...
MGASA-2018-0405 Updated glib2.0 packages fix security vulnerabilities
The updated glib2.0 packages fix security vulnerabilities: In GNOME GLib 2.56.1, gmarkupparsecontextendparse in gmarkup.c has a NULL pointer dereference CVE-2018-16428. GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in gmarkupparsecontextparse in gmarkup.c, related to utf8str...
MGASA-2018-0395 Updated git packages fix security vulnerability
joernchen of Phenoelit discovered that git is prone to an arbitrary code execution vulnerability due to insufficient validation of submodule url and path via a specially crafted .gitmodules file in a project cloned with --recurse-submodules CVE-2018-17456...
MGASA-2018-0384 Updated dropbear packages fix security vulnerability
Dropbear is prone to a user enumeration vulnerability CVE-2018-15599. An external user without credentials can determine whether a given username exists on a server...
MGASA-2018-0371 Updated ntp packages fix security vulnerability
Updated ntp packages fix security vulnerability: Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter CVE-2018-12327...
MGASA-2018-0356 Updated libraw packages fix security vulnerabilities
This update provides libraw 0.18.13 fixing at least the following security issues: LibRaw versions prior to 0.18.12 are vulnerable to an integer overflow in the internal/dcrawcommon.cpp:parseqt function. An attacker could exploit this to cause an infinite loop via a specially crafted Apple...
MGASA-2018-0347 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on the upstream 4.14.65 and adds fixes and mitigations for the now publically known security issue affecting Intel processors called L1 Terminal Fault L1TF: Systems with microprocessors utilizing speculative execution and Intel Software Guard Extensions Intel SGX...
MGASA-2018-0341 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on the upstream 4.14.62 and fixes at least the following security issues: kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled...
MGASA-2018-0335 Updated mariadb packages fix security vulnerabilities
Updated mariadb packages fix security vulnerabilities: Vulnerability in the MariaDB Server component of MariaDB subcomponent: MyISAM. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MariaDB Server. Successful attacks of this...
MGASA-2018-0337 Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.62 and fixes at least the following security issues: Security researchers from FICORA have identified a remote denial of service attack against the Linux kernel caused by inefficient implementation of TCP segment reassembly, named "SegmentSmack". A...
MGASA-2018-0319 Updated ffmpeg packages fix security vulnerabilities
This update provides ffmpeg version 3.3.8, which fixes several security vulnerabilities and other bugs which were corrected upstream...
MGASA-2018-0311 Updated perl-Archive-Zip packages fix security vulnerability
It was discovered that the Archive::Zip module incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information CVE-2018-10860...
MGASA-2018-0297 Updated librsvg packages fix a security vulnerability
Updated librsvg package fixes security vulnerability: It was discovered that there was an input validation vulnerability in the librsvg renderer library that could result in data being leaked to remote attackers via a specially-crafted file CVE-2018-1000041...
MGASA-2018-0294 Updated libvorbis packages fix security vulnerabilities
The updated packages fix security vulnerabilities: The barknoisehybridmp function in psy.c in Xiph.Org libvorbis 1.3.5 allows remote attackers to cause a denial of service out-of-bounds access and application crash or possibly have unspecified other impact via a crafted mp4 file. CVE-2017-14160...
MGASA-2018-0275 Updated corosync packages fix security vulnerability
An integer overflow leading to an out-of-bound read was found in authenticatenss23 in Corosync. An attacker could craft a malicious packet that would lead to a denial of service CVE-2018-1084...
MGASA-2018-0260 Updated microcode packages fix security vulnerability
This update adds microcode fixes and mitigations for Spectre CVE-2017-5715 for the following: Intel Pentium Silver N/J5xxx, Celeron N/J4xxx Intel Xeon E5/E7 v4; Core i7-69xx/68xx Amd has also released their updated microcode for Fam15 and Fam17 cpus...
MGASA-2018-0256 Updated python packages fix security vulnerabilities
Updated python packages fix security vulnerabilities: A flaw was found in the way catastrophic backtracking was implemented in Python's pop3lib's apop method. An attacker could use this flaw to cause denial of service CVE-2018-1060. A flaw was found in the way catastrophic backtracking was...
MGASA-2018-0252 Updated pdns-recursor package fixes security vulnerability
An issue has been found in the DNSSEC validation component of PowerDNS Recursor, allowing an ancestor delegation NSEC or NSEC3 record to be used to wrongfully prove the non-existence of a RR below the owner name of that record. This would allow an attacker in position of man-in-the-middle to send...
MGASA-2018-0246 Updated libtiff packages fix security vulnerabilities
The TIFFWriteDirectorySec function in tifdirwrite.c in LibTIFF through 4.0.9 allows remote attackers to cause a denial of service assertion failure and application crash via a crafted file, a different vulnerability than CVE-2017-13726. CVE-2018-10963 In LibTIFF 4.0.9, a heap-based buffer overflo...
MGASA-2018-0223 Updated libid3tag packages fix security vulnerabilities
id3utf16deserialize in utf16.c in libid3tag through 0.15.1b misparses ID3v2 tags encoded in UTF-16 with an odd number of bytes, triggering an endless loop allocating memory until an OOM condition is reached, leading to denial-of-service DoS. CVE-2004-2779 field.c in the libid3tag 0.15.0b library...
MGASA-2018-0219 Updated ghostscript packages fix security vulnerability
The settextdistance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning calculation, which allows remote attackers to cause a denial of service application crash or possibly have unspecified other impac...
MGASA-2018-0217 Updated links packages fix security vulnerability
Buffer over-read vulnerability in case of corrupted UTF-8 data CVE-2017-11114...
MGASA-2018-0212 Updated ming packages fix security vulnerabilities
The readString function in util/read.c and util/old/read.c in libming 0.4.8 allows remote attackers to cause a denial of service via a large file that is mishandled by listswf, listaction, etc. This occurs because of an integer overflow that leads to a memory allocation error. CVE-2017-8782 The...
MGASA-2018-0211 Updated sox packages fix security vulnerabilities
This update for sox fixes the following security issues: CVE-2017-11332: Fixed the startread function in wav.c, which allowed remote attackers to cause a DoS divide-by-zero via a crafted wav file. CVE-2017-11358: Fixed the readsamples function in hcom.c, which allowed remote attackers to cause a...
MGASA-2018-0209 Updated libcdio packages fix security vulnerabilities
A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS CVE-2017-18198. A NULL pointer dereference flaw was...
MGASA-2018-0199 Updated puppet packages fix security vulnerability
It was discovered that Puppet incorrectly handled permissions when unpacking certain tarballs. A local user could possibly use this issue to execute arbitrary code CVE-2017-10689...
MGASA-2018-0172 Updated kernel packages fix security vulnerabilities
This kernel update is based on the upstream 4.14.25 and updates the KPTI mitigation for Meltdown CVE-2017-5754 on 32bit x86. It also adds ome optimizations and improvements to mitigate some of the slowdons caused by the Meltdown CVE-2017-5754 and Spectre, variant 2 CVE-2017-5715. Other security...