6277 matches found
MGASA-2024-0288 Updated orc packages fix security vulnerability
Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of...
MGASA-2024-0287 Updated libtiff packages fix security vulnerability
A null pointer dereference flaw was found in Libtiff via tifdirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash,...
MGASA-2024-0285 Updated vim packages fix security vulnerabilities
Use-after-free in tagstackclearentry in Vim v9.1.0647. CVE-2024-41957 Use-after-free in alistadd in Vim v9.1.0678. CVE-2024-43374...
MGASA-2024-0283 Updated ffmpeg packages fix security vulnerabilities
A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnmdecodeframe in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t...
MGASA-2024-0284 Updated ntfs-3g packages fix security vulnerability
NTFS-3G before 75dcdc2 has a use-after-free in ntfsuppercasembs in libntfs-3g/unistr.c. CVE-2023-52890...
MGASA-2024-0282 Updated nodejs & yarnpkg packages fix security vulnerabilities
Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 High CVE-2024-22020 - Bypass network import restriction via data URL Medium CVE-2024-22018 - fs.lstat bypasses permission model Low CVE-2024-36137 - fs.fchown/fchmod bypasses...
MGASA-2024-0281 Updated quictls packages fix security vulnerabilities
The updated packages fix security vulnerabilities...
MGASA-2024-0280 Updated packages fix security vulnerabilities
CVE-2024-23184: A large number of address headers in email resulted in excessive CPU usage. CVE-2024-23185: Abnormally large email headers are now truncated or discarded, with a limit of 10MB on a single header and 50MB for all the headers of all the parts of an email...
MGASA-2024-0279 Updated roundcubemail packages fix security vulnerabilities
Fix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009 Fix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008 Fix information leak access to remote content via insufficient CSS filtering CVE-2024-42010...
MGASA-2024-0277 Updated kernel, kmod-xtables-addons & kmod-virtualbox packages fix security vulnerabilities
Upstream kernel version 6.6.43 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links...
MGASA-2024-0278 Updated kernel-linus packages fix security vulnerabilities
Vanilla upstream kernel version 6.6.43 fix bugs and vulnerabilities. For information about the vulnerabilities see the links...
MGASA-2024-0276 Updated emacs packages improve Wayland support and fix a security vulnerability
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %... link abbrev even when it specifies an unsafe function, such as shell-command-to-string. CVE-2024-39331...
MGASA-2024-0275 Updated virtualbox & kmod-virtualbox packages fix security vulnerabilities
Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products scope change. Successf...
MGASA-2024-0274 Updated thunderbird packages fix security vulnerabilities
Memory corruption in WebGL API. CVE-2024-6600 Race condition in permission assignment. CVE-2024-6601 Memory corruption in thread creation. CVE-2024-6603 Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13. CVE-2024-6604...
MGASA-2024-0272 Updated apache packages fix security vulnerabilities
CVE-2024-40898: Apache HTTP Server: SSRF with modrewrite in server/vhost context on Windows cve.mitre.org SSRF in Apache HTTP Server on Windows with modrewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. CVE-2024-40725:...
MGASA-2024-0273 Updated chromium-browser-stable packages fix security vulnerabilities
Inappropriate implementation in V8. CVE-2024-6772 Type Confusion in V8. CVE-2024-6773 Use after free in Screen Capture. CVE-2024-6774 Use after free in Media Stream. CVE-2024-6775 Use after free in Audio. CVE-2024-6776 Use after free in Navigation. CVE-2024-6777 Race in DevTools. CVE-2024-6778 Ou...
MGASA-2024-0271 Updated libfm & libfm-qt packages fix security vulnerability
Fixed a vulnerability about trusted locations...
MGASA-2024-0270 Updated sendmail packages fix security vulnerability
sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports . but some other...
MGASA-2024-0269 Updated nss & firefox packages fix security vulnerabilities
Memory corruption in WebGL API. CVE-2024-6600 Race condition in permission assignment. CVE-2024-6601 Memory corruption in NSS. CVE-2024-6602 Memory corruption in thread creation. CVE-2024-6603 Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13. CVE-2024-6604...
MGASA-2024-0267 Updated tomcat packages fix security vulnerability
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of...
MGASA-2024-0268 Updated libreoffice packages fix security vulnerability
TLS certificates are not properly verified when utilizing LibreOfficeKit. CVE-2024-5261...
MGASA-2024-0265 Updated squid packages fix security vulnerability
Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack. CVE-2024-37894...
MGASA-2024-0264 Updated freeradius packages fix security vulnerability
This vulnerability allows an attacker performing a meddler-in-the-middle attack between Palo Alto Networks PAN-OS firewall and a RADIUS server to bypass authentication and escalate privileges to ‘superuser’ when RADIUS authentication is in use and either CHAP or PAP is selected in the RADIUS serv...
MGASA-2024-0266 Updated kernel-linus packages fix security vulnerabilities
Vanilla upstream kernel version 6.6.37 fix bugs and vulnerabilities. For information about the vulnerabilities see the links...
MGASA-2024-0263 Updated kernel kmod-xtables-addons kmod-virtualbox dwarves packages fix security vulnerabilities
Upstream kernel version 6.6.37 fix bugs and vulnerabilities. The dwarves, kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the vulnerabilities see the links...
MGASA-2024-0261 Updated golang packages fix security vulnerability
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail...
MGASA-2024-0262 Updated php packages fix security vulnerability
This update ships the latest version of php 8.2. It brings fixed security issues and the usual bug fixes. Vulnerability: A code logic error, filtering functions such as filtervar when validating URLs FILTERVALIDATEURL for certain types of URLs the function will result in invalid user information...
MGASA-2024-0259 Updated netatalk packages fix security vulnerabilities
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibufPASSWDLEN to '\0' in FPLoginExt in login in etc/uams/uamspam.c. CVE-2024-38439 Netatalk before 3.2.1 has an off-by-one error, and resultant heap-based buffer overflow and segmentation...
MGASA-2024-0260 Updated poppler packages fix security vulnerability
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service. CVE-2024-6239...
MGASA-2024-0258 Updated apache packages fix security vulnerabilities
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encodin...
MGASA-2024-0257 Updated znc packages fix security vulnerability
In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. CVE-2024-39844...
MGASA-2024-0256 Updated python-js2py packages fix security vulnerability
CVE-2024-28397: Fixed a potential sandbox escape via untrusted JavaScript code...
MGASA-2024-0255 Updated openvpn packages fix security vulnerability
Control channel: refuse control channel messages with nonprintable characters in them. CVE-2024-5594...
MGASA-2024-0254 Updated chromium-browser-stable packages fix security vulnerabilities
Use after free in Dawn. CVE-2024-6290, CVE-2024-6292, CVE-2024-6293 Use after free in Swiftshader. CVE-2024-6291...
MGASA-2024-0252 Updated libcdio packages fix security vulnerability
Buffer Overflow Vulnerability in libcdio v2.1.0 allows an attacker to execute arbitrary code via a crafted ISO 9660 image file. CVE-2024-36600...
MGASA-2024-0253 Updated krb5 packages fix security vulnerabilities
Before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application. CVE-2024-37370 Before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending...
MGASA-2024-0251 Updated dcmtk packages fix security vulnerabilities
Multiple vulnerabilities have been fixed in DCMTK, a collection of libraries and applications implementing large parts the DICOM standard for medical images. CVE-2024-28130 Segmentation faults due to incorrect typecast CVE-2024-34508 Segmentation fault via invalid DIMSE message CVE-2024-34509...
MGASA-2024-0250 Updated openssh packages fix security vulnerability
regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems. CVE-2024-6387...
MGASA-2024-0249 Updated espeak-ng packages fix security vulnerabilities
It was discovered that eSpeak NG did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code...
MGASA-2024-0246 Updated gdb packages fix security vulnerabilities
An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. CVE-2022-4285 A potential heap based buffer overflow was found in...
MGASA-2024-0244 Updated python-imageio packages fix security vulnerability
imageio can attempt to download shared freeimage libraries from https://github.com/imageio/imageio-binaries/tree/master/freeimage. The code fetches straight from master and provides no way of verifying whether the correct file was fetched. As a result, if the repository is attacked in the future,...
MGASA-2024-0245 Updated python-idna packages fix security vulnerability
mingw-python-idna: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode...
MGASA-2024-0247 Updated openssl packages fix security vulnerability
SSLselectnextproto buffer overread. CVE-2024-5535...
MGASA-2024-0248 Updated ffmpeg packages fix security vulnerabilities
Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the setencoderid function in /fftools/ffmpegenc.c component. CVE-2023-50010 Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary...
MGASA-2024-0241 Updated erofs-utils packages fix security vulnerabilities
Heap Buffer Overflow in the erofsfsckdirentiter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted erofs filesystem image...
MGASA-2024-0243 Updated libheif packages fix security vulnerabilities
Yuchuan Meng discovered that libheif incorrectly handled certain image data. An attacker could possibly use this issue to crash the program, resulting in a denial of service. CVE-2023-49460, CVE-2023-49462, CVE-2023-49463, CVE-2023-49464...
MGASA-2024-0242 Updated libopenmpt packages fix security vulnerabilities
Possible out-of-bounds read or write when reading malformed MED files. r19389. Null-pointer write 32bit platforms or excessive memory allocation 64bit platforms when reading close to 4GiB of data from unseekable files r20336, r20338. Write buffer overflow when reading unseekable files close to 4G...
MGASA-2024-0240 Updated wget packages fix security vulnerability
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. CVE-2024-38428...