6300 matches found
MGASA-2019-0416 Updated libidn2 packages fix security vulnerabilities
Updated libidn2 packages fix security vulnerabilities: It was discovered that Libidn2 incorrectly handled certain inputs. A attacker could possibly use this issue to impersonate domains CVE-2019-12290. It was discovered that Libidn2 incorrectly handled certain inputs. An attacker could possibly u...
MGASA-2019-0391 Updated libgit2 packages fix security vulnerabilities
libgit2 has been updated to version 0.28.4 to fix several security issues: A carefully constructed commit object with a very large number of parents may lead to potential out-of-bounds writes or potential denial of service. CVE-2019-1348: the fast-import stream command "feature export-marks=path"...
MGASA-2019-0362 Updated libcryptopp packages fix security vulnerability
The updated packages fix a security vulnerability: Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The iss...
MGASA-2019-0353 Updated icu packages fix security vulnerability
The updated packages fix a security vulnerability: International Components for Unicode ICU for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString in i18n/numberdecimalquantity.cpp. CVE-2018-18928...
MGASA-2019-0341 Updated zipios++ packages fix security vulnerability
Updated zipios++ packages fix security vulnerability: Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources CVE-2019-13453...
MGASA-2019-0352 Updated glib2.0 packages fix security vulnerability
The updated packages fix a security vulnerability: filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. CVE-2019-12450...
MGASA-2019-0350 Updated python-sqlalchemy packages fix security vulnerabilities
Updated python-sqlalchemy packages fix security vulnerabilities: SQL Injection via the orderby parameter CVE-2019-7164. SQL Injection via the groupby parameter CVE-2019-7548...
MGASA-2019-0344 Updated unbound packages fix security vulnerability
Updated unbound package to version 1.9.5 to fix a potential security vulnerability. In case users recompiled the Mageia package with --enable-ipsecmod, and ipsecmod is enabled and used in the configuration, shell code execution would end up being possible after receiving a specially crafted answe...
MGASA-2019-0329 Updated libjpeg packages fix security vulnerability
The updated packages fix a security vulnerability: Several integer overflow issues and subsequent segfaults occur in libjpeg-turbo when attempting to compress or decompress gigapixel images. CVE-2019-2201...
MGASA-2019-0321 Updated expat packages fix security vulnerability
It was discovered that Expat did not properly handle internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed CVE-2019-15903...
MGASA-2019-0315 Updated firefox packages fix security vulnerabilities
The updated packages fix several bugs and some security issues: Use-after-free when creating index updates in IndexedDB. CVE-2019-11757 Potentially exploitable crash due to 360 Total Security. CVE-2019-11758 Stack buffer overflow in HKDF output. CVE-2019-11759 Stack buffer overflow in WebRTC...
MGASA-2019-0320 Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser 78.0.3904.87 fixes security issues: Multiple flaws were found in the way Chromium 77.0.3865.120 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...
MGASA-2019-0301 Updated mediawiki packages fix security vulnerability
Updated mediawiki packages fix security vulnerability: In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup CVE-2019-16738...
MGASA-2019-0296 Updated e2fsprogs packages fix security vulnerability
Updated e2fsprogs packages fix security vulnerability: Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code CVE-2019-5094. The...
MGASA-2019-0292 Updated thunderbird packages fix security vulnerability
Updated thunderbird packages fix security vulnerability: Spoofing a message author via a crafted S/MIME message CVE-2019-11755 It also fixes various other bugs, as listed in the releasenotes...
MGASA-2019-0290 Updated libheif packages fix security vulnerability
libheif 1.4.0 has a use-after-free in heif::HeifContext::Image:: setalphachannel in heifcontext.h because heifcontext.cc mishandles references to non-existing alpha images CVE-2019-11471. Also, imagemagick has been updated to 7.0.8.62 to fix various bugs...
MGASA-2019-0283 Updated chromium-browser-stable packages fix security vulnerabilities
Multiple flaws were found in the way Chromium 73.0.3683.103 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. CVE-2019-5805, CVE-2019-5806, CVE-2019-5807,...
MGASA-2019-0275 Updated thunderbird packages fix security vulnerabilities
Updated thunderbird packages fix security vulnerabilities: Covert Content Attack on S/MIME encryption using a crafted multipart/ alternative message CVE-2019-11739. Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, Firefox ESR 60.9, Thunderbird 68.1, and Thunderbird 60.9 CVE-2019-11740...
MGASA-2019-0243 Updated subversion packages fix security vulnerabilities
Updated subversion packages fix security vulnerabilities: Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer CVE-2018-11782. Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands...
MGASA-2019-0254 Updated SDL12 packages fix security vulnerability
Updated SDL12 packages fix security vulnerability: SDL Simple DirectMedia Layer through 1.2.15 has a heap-based buffer over-read in BlitNtoN in video/SDLblitN.c when called from SDLSoftBlit in video/SDLblit.c CVE-2019-13616...
MGASA-2019-0238 Updated mpg123 packages fix security vulnerability
The mpg123 package has been updated to version 1.25.12, fixing several issues which could cause it to crash or hang while parsing mp3 files...
MGASA-2019-0233 Updated vlc packages fixes security vulnerabilities
Updated vlc packages fixes security vulnerabilities: Multiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed CVE-2019-13602, CVE-2019-13962, CVE-2019-14437, CVE-2019-14438,...
MGASA-2019-0231 Updated wavpack packages fix security vulnerabilities
Updated wavpack packages fixes security vulnerabilities: Rohan Padhye discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319...
MGASA-2019-0235 Updated pango packages fix security vulnerability
Updated pango package fixes security vulnerability: It was discovered that pango was subject to a heap based buffer overflow vulnerability which could be used to get code execution CVE-2019-1010238...
MGASA-2019-0234 Updated ansible packages fix security vulnerability
Updated ansible package fixes security vulnerability: A flaw was discovered in the way Ansible templating was implemented before version 2.7.12, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the...
MGASA-2019-0210 Updated libreswan packages fix security vulnerability
The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects...
MGASA-2019-0206 Updated irssi package fixes security vulnerability
Irssi before 1.0.8 and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server CVE-2019-13045...
MGASA-2019-0200 Updated phpmyadmin packages fix security vulnerabilities
Updated phpmyadmin packages fix security vulnerabilities: A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. CVE-2019-11768, PMASA-2019-3 A vulnerability was found that allows an attacker to trigger a...
MGASA-2019-0196 Updated kernel-tmb packages fix security vulnerability
This kernel-tmb update is based on the upstream 4.14.127 and fixes at least the following security issues: Jonathan Looney discovered that it is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map t...
MGASA-2019-0197 Updated kernel-linus packages fix security vulnerability
This kernel-linus update is based on the upstream 4.14.127 and fixes at least the following security issues: Jonathan Looney discovered that it is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map...
MGASA-2019-0170 Updated kernel packages fixes security vulnerabilities
This kernel update is based on the upstream 4.14.116 and fixes at least the following security issues: A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the...
MGASA-2019-0159 Updated mxml packages fix security vulnerabilities
Updated mxml packages fix security vulnerabilities: An issue has been found in Mini-XML aka mxml 2.12. It is a stack-based buffer overflow in mxmlwritenode in mxml-file.c via vectors involving a double-precision floating point number and the '' substring, as demonstrated by testmxml CVE-2018-2000...
MGASA-2019-0166 Updated openexr packages fix security vulnerabilities
Updated openexr package fixes security vulnerabilities: It was discovered that makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact CVE-2018-18444...
MGASA-2019-0162 Updated clamav packages fix security vulnerabilities
The updated packages fix security vulnerabilities: A vulnerability in the Portable Document Format PDF scanning functionality of Clam AntiVirus ClamAV Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...
MGASA-2019-0167 Updated jasper packages fix security vulnerabilities
Updated jasper packages fix security vulnerabilities: The jpcfloorlog2 function in jpcmath.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service assertion failure via unspecified vectors CVE-2016-9398. A denial of service in jp2decode CVE-2018-19542. A denial of service...
MGASA-2019-0160 Updated svgsalamander packages fix security vulnerability
A vulnerability was found in the svgsalamander library. If the library is being used in a web application for processing user supplied SVG files then the app is vulnerable to SSRF CVE-2017-5617...
MGASA-2019-0137 Updated ming packages fix security vulnerability
The printDefineFont2 function util/listfdb.c in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attackers to cause a denial of service or unspecified other impact via a crafted FDB file. CVE-2018-6358 There is a heap-based buffer overflow in the getString...
MGASA-2019-0130 Updated ghostscript packages fix security vulnerability
It was found that the superexec operator was available in the internal dictionary. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. CVE-2019-3835 It was found that the forceput operator...
MGASA-2019-0102 Updated libreoffice packages fix security vulnerability
Alex Infuehr discovered a directory traversal vulnerability which could result in the execution of Python script code when opening a malformed document CVE-2018-16858. The libreoffice package has been updated to version 6.1.5.2, fixing this issue, and including several other bug fixes and...
MGASA-2019-0100 Updated spice packages fix security vulnerability
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslotgetvirt. This may lead to a denial of service, or, in the worst case, code-execution by unauthenticated attackers. CVE-2019-3813 A vulnerability was discovered in SPICE before versio...
MGASA-2019-0085 Updated libwmf packages fix security vulnerability
The GD Graphics Library aka LibGD 2.2.5 has a double free in the gdImagePtr functions in gdgifout.c, gdjpeg.c, and gdwbmp.c. NOTE: PHP is unaffected. CVE-2019-6978...
MGASA-2019-0075 Updated libtiff packages fix security vulnerability
The TIFFFdOpen function in tifunix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. CVE-2019-6128...
MGASA-2019-0069 Updated thunderbird packages fix security vulnerability
Use-after-free parsing HTML5 stream. CVE-2018-18500 Privilege escalation through IPC channel messages. CVE-2018-18505 Memory safety bugs fixed in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. CVE-2018-18501...
MGASA-2019-0066 Updated golang packages fix security vulnerability
Remote code execution in go get, when executed with the -u flag CVE-2018-16873. An arbitrary filesystem write in go get, which could lead to code execution CVE-2018-16874. Denial of Service in the crypto/x509 package during certificate chain validation CVE-2018-16875. Go before 1.11.5 mishandles...
MGASA-2019-0058 Updated gitolite packages fixes security vulnerability
In commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by triggering use of an option other than -v, -n, -q, or -P CVE-2018-20683...
MGASA-2019-0052 Updated bluez packages fix security vulnerability
A buffer overflow in pincodereplydump function CVE-2016-9800. A buffer overflow in setextctrl function CVE-2016-9801. A buffer overflow in commandsdump function CVE-2016-9804...
MGASA-2019-0056 Updated ghostscript packages fix a security vulnerability
Ghostscript could be made to crash, access files, or run programs if it opened a specially crafted file. CVE-2019-6116...
MGASA-2019-0050 Updated libcaca packages fix security vulnerabilities
It was discovered that libcaca incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service CVE-2018-20544. It was discovered that libcaca incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code...
MGASA-2019-0022 Updated coreutils packages fix security vulnerabilities
A flaw was found in GNU Coreutils through 8.29 in chown-core.c. The functions chown and chgrp do not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition...
MGASA-2019-0021 Updated openafs packages fix security vulnerabilities
Jeffrey Altman reported that the backup tape controller butc process does accept incoming RPCs but does not require or allow for authentication of those RPCs, allowing an unauthenticated attacker to perform volume operations with administrator credentials CVE-2018-16947. Mark Vitale reported that...