MGASA-2020-0326 Updated targetcli packages fix security vulnerability

An access flaw was found in targetcli, where the /etc/target and underneath backup directory/files were world-readable. This flaw allows a local attacker to access potentially sensitive information such as authentication credentials from the /etc/target/saveconfig.json and backup files. The highe...

MGASA-2020-0316 Updated znc packages fix security vulnerability

The znc package has been updated to version 1.8.1, containing several bugfixes and enhancements. See the upstream change logs for details...

MGASA-2020-0308 Updated botan2 packages fix security vulnerability

The CBC padding operations were not constant time and as a result would leak the length of the plaintext values which were being padded to an attacker running a side channel attack via shared resources such as cache or branch predictor. No information about the contents was leaked, but the length...

MGASA-2020-0294 Updated podofo packages fix security vulnerability

The updated packages fix security vulnerabilities: A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote attackers to cause a denial-of-service via a crafted pdf file. CVE-2018-12983 An issue was...

MGASA-2020-0279 Updated docker packages fix security vulnerability

Updated docker packages fix security vulnerability: A flaw was found in Docker when it creates network bridges that accept IPv6 router advertisements by default. This flaw allows an attacker who can execute code in a container to possibly spoof rogue IPv6 router advertisements to perform a...

MGASA-2020-0247 Updated nrpe packages fix security vulnerability

Updated nrpe packages fix security vulnerabilities: Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nastymetachars interprets \n as the character \ and the character n not as the \n newline sequence. This can cause command injection CVE-2020-6581. Nagios NRPE 3.2.1 has a...

MGASA-2020-0210 Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 81.0.4044.138 fixes security issues: Multiple flaws were found in the way Chromium 81.0.4044.129 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information...

MGASA-2020-0202 Updated matio packages fix security vulnerability

Updated matio packages fix a security vulnerability: Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvarstruct.c CVE-2019-13107. The matio package has been updated to version 1.5.16 to fix this issue. Also: - The scilab package has been...

MGASA-2020-0167 Updated mediawiki packages fix security vulnerability

Updated mediawiki packages fix security vulnerability: In MediaWiki before 1.31.7, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because...

MGASA-2020-0173 Updated golang packages fix security vulnerability

Updated golang packages fix security vulnerability: An integer overflow vulnerability was found in the Go crypto/x509 and golang.org/x/crypto/cryptobyte libraries on 32-bit architectures. A remote attacker could exploit this by supplying a crafted x.509 certificate, or other ASN.1 structure, as...

MGASA-2020-0114 Updated ilmbase packages fix security vulnerability

The updated packages fix a security vulnerability: OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/ IlmThreadPool.cpp, as demonstrated by exrmultiview. CVE-2018-18443...

MGASA-2020-0109 Updated hiredis packages fix security vulnerability

Updated hiredis packages fix security vulnerability: async.c and dict.c in libhiredis.a in hiredis through 0.14.0 allow a NULL pointer dereference because malloc return values are unchecked CVE-2020-7105...

MGASA-2020-0103 Updated opencontainers-runc packages fix security vulnerability

Updated opencontainers-runc package fixes security vulnerability: An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume CVE-2019-19921...

MGASA-2020-0082 Updated vim and neovim packages fix security vulnerability

Updated vim and neovim package fixes security vulnerability: It was discovered that Vim before 8.1.1365 and Neovim before 0.3.6 did not restrict the :source! command when executed in a sandbox. This allows remote attackers to take advantage of the modeline feature to inject arbitrary commands whe...

MGASA-2020-0057 Updated fontforge packages fix security vulnerabilities

FontForge 20190801 has a use-after-free in SFDGetFontMetaData in sfd.c CVE-2020-5395 FontForge 20190801 has a heap-based buffer overflow in the Type2NotDefSplines function in splinesave.c CVE-2020-5496...

MGASA-2020-0037 Updated graphicsmagick packages fix security vulnerabilities

GraphicsMagick has been updated to fix security issues...

MGASA-2020-0022 Updated dia packages fix security vulnerability

Updated dia package fixes security vulnerability: An endless loop on filenames with invalid encoding CVE-2019-19451...

MGASA-2019-0401 Updated freerdp packages fix security vulnerabilities

Updated freerdp packages fix security vulnerabilities: Multiple memory leaks in libfreerdp/codec/region.c CVE-2019-17177. Memory leak in HuffmanTreemakeFromFrequencies CVE-2019-17178...

MGASA-2019-0382 Updated squid packages fix security vulnerabilities

Potential remote code execution during URN processing CVE-2019-12526. Multiple improper validations in URI processing CVE-2019-12523, CVE-2019-18676. Cross-Site Request Forgery in HTTP Request processing CVE-2019-18677. Incorrect message parsing which could have led to HTTP request splitting issu...

MGASA-2019-0375 Updated lz4 packages fix security vulnerability

Updated lz4 packages fix security vulnerability: Heap-based buffer overflow in LZ4write32 CVE-2019-17543...

MGASA-2019-0353 Updated icu packages fix security vulnerability

The updated packages fix a security vulnerability: International Components for Unicode ICU for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString in i18n/numberdecimalquantity.cpp. CVE-2018-18928...

MGASA-2019-0352 Updated glib2.0 packages fix security vulnerability

The updated packages fix a security vulnerability: filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used. CVE-2019-12450...

MGASA-2019-0338 Updated bzip2 packages fix security vulnerability

The updated packages fix a security vulnerability: BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors. CVE-2019-12900...

MGASA-2019-0344 Updated unbound packages fix security vulnerability

Updated unbound package to version 1.9.5 to fix a potential security vulnerability. In case users recompiled the Mageia package with --enable-ipsecmod, and ipsecmod is enabled and used in the configuration, shell code execution would end up being possible after receiving a specially crafted answe...

MGASA-2019-0341 Updated zipios++ packages fix security vulnerability

Updated zipios++ packages fix security vulnerability: Mike Salvatore discovered that Zipios mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources CVE-2019-13453...

MGASA-2019-0328 Updated clamav packages fix security vulnerabilities

The updated packages fix security vulnerabilities: ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause a denial of service condition by sending crafted messages to an affected system. CVE-2019-12625 BZ2decompress in decompress.c...

MGASA-2019-0317 Updated unbound packages fix security vulnerability

Updated unbound packages fix security vulnerability: Versions before 1.9.4 allow accesses to uninitialized memory, which would permit remote attackers to trigger a crash CVE-2019-16866...

MGASA-2019-0321 Updated expat packages fix security vulnerability

It was discovered that Expat did not properly handle internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed CVE-2019-15903...

MGASA-2019-0301 Updated mediawiki packages fix security vulnerability

Updated mediawiki packages fix security vulnerability: In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup CVE-2019-16738...

MGASA-2019-0294 Updated nmap packages fix security vulnerability

Updated nmap packages fix security vulnerability: Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service stack consumption and application crash via a crafted TCP-based service CVE-2018-15173...

MGASA-2019-0296 Updated e2fsprogs packages fix security vulnerability

Updated e2fsprogs packages fix security vulnerability: Lilith of Cisco Talos discovered a buffer overflow flaw in the quota code used by e2fsck from the ext2/ext3/ext4 file system utilities. Running e2fsck on a malformed file system can result in the execution of arbitrary code CVE-2019-5094. The...

MGASA-2019-0295 Updated kernel packages fix various issues

This kernel update is based on the upstream 5.3.6 and fixes several issues. a potential kernel crash by using suppress-prefix rule in ipv6 3rdparty rtl8723/rtl8821ce drivers have been fixed to work with kernel 5.3 series rtl8xxxu: Fix wifi low signal strength issue of RTL8723BU rtw88 and exfat...

MGASA-2019-0292 Updated thunderbird packages fix security vulnerability

Updated thunderbird packages fix security vulnerability: Spoofing a message author via a crafted S/MIME message CVE-2019-11755 It also fixes various other bugs, as listed in the releasenotes...

MGASA-2019-0242 Updated icedtea-web packages fix security vulnerabilities

Updated icedtea-web packages fix security vulnerabilities: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The cod...

MGASA-2019-0243 Updated subversion packages fix security vulnerabilities

Updated subversion packages fix security vulnerabilities: Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer CVE-2018-11782. Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands...

MGASA-2019-0250 Updated mercurial packages fix security vulnerability

It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this vulnerability to write arbitrary files to the target’s filesystem CVE-2019-3902...

MGASA-2019-0231 Updated wavpack packages fix security vulnerabilities

Updated wavpack packages fixes security vulnerabilities: Rohan Padhye discovered that WavPack incorrectly handled certain WAV files. An attacker could possibly use this issue to cause a denial of service CVE-2019-1010315, CVE-2019-1010317, CVE-2019-1010318, CVE-2019-1010319...

MGASA-2019-0233 Updated vlc packages fixes security vulnerabilities

Updated vlc packages fixes security vulnerabilities: Multiple security issues were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed file/stream is processed CVE-2019-13602, CVE-2019-13962, CVE-2019-14437, CVE-2019-14438,...

MGASA-2019-0238 Updated mpg123 packages fix security vulnerability

The mpg123 package has been updated to version 1.25.12, fixing several issues which could cause it to crash or hang while parsing mp3 files...

MGASA-2019-0221 Updated kernel packages fix security vulnerabilities

This kernel update is based on the upstream 4.14.137 and fixes at least the following security issues: A Spectre SWAPGS gadget was found in the Linux kernel's implementation of system interrupts. An attacker with local access could use this information to reveal private data through a Spectre lik...

MGASA-2019-0210 Updated libreswan packages fix security vulnerability

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects...

MGASA-2019-0206 Updated irssi package fixes security vulnerability

Irssi before 1.0.8 and 1.2.x before 1.2.1, when SASL is enabled, has a use after free when sending SASL login to the server CVE-2019-13045...

MGASA-2019-0200 Updated phpmyadmin packages fix security vulnerabilities

Updated phpmyadmin packages fix security vulnerabilities: A vulnerability was reported where a specially crafted database name can be used to trigger an SQL injection attack through the designer feature. CVE-2019-11768, PMASA-2019-3 A vulnerability was found that allows an attacker to trigger a...

MGASA-2019-0197 Updated kernel-linus packages fix security vulnerability

This kernel-linus update is based on the upstream 4.14.127 and fixes at least the following security issues: Jonathan Looney discovered that it is possible to send a crafted sequence of SACKs which will fragment the RACK send map. An attacker may be able to further exploit the fragmented send map...

MGASA-2019-0170 Updated kernel packages fixes security vulnerabilities

This kernel update is based on the upstream 4.14.116 and fixes at least the following security issues: A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the...

MGASA-2019-0164 Updated tar packages fix security vulnerability

paxdecodeheader in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers CVE-2019-9923...

MGASA-2019-0159 Updated mxml packages fix security vulnerabilities

Updated mxml packages fix security vulnerabilities: An issue has been found in Mini-XML aka mxml 2.12. It is a stack-based buffer overflow in mxmlwritenode in mxml-file.c via vectors involving a double-precision floating point number and the '' substring, as demonstrated by testmxml CVE-2018-2000...

MGASA-2019-0166 Updated openexr packages fix security vulnerabilities

Updated openexr package fixes security vulnerabilities: It was discovered that makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact CVE-2018-18444...

MGASA-2019-0160 Updated svgsalamander packages fix security vulnerability

A vulnerability was found in the svgsalamander library. If the library is being used in a web application for processing user supplied SVG files then the app is vulnerable to SSRF CVE-2017-5617...

MGASA-2019-0167 Updated jasper packages fix security vulnerabilities

Updated jasper packages fix security vulnerabilities: The jpcfloorlog2 function in jpcmath.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service assertion failure via unspecified vectors CVE-2016-9398. A denial of service in jp2decode CVE-2018-19542. A denial of service...