6277 matches found
MGASA-2024-0189 Updated nss & firefox packages fix security vulnerabilities
Arbitrary JavaScript execution in PDF.js. CVE-2024-4367 IndexedDB files retained in private browsing mode. CVE-2024-4767 Potential permissions request bypass via clickjacking. CVE-2024-4768 Cross-origin responses could be distinguished between script and non-script content-types. CVE-2024-4769...
MGASA-2024-0185 Updated python-sqlparse packages fix security vulnerability
Passing a heavily nested list to sqlparse.parse leads to a Denial of Service due to RecursionError...
MGASA-2024-0188 Updated vim packages fix security vulnerability
Buffer overflow in xxd with colored output...
MGASA-2024-0184 Updated postgresql15 & postgresql13 packages fix security vulnerability
Restrict visibility of pgstatsext and pgstatsextexprs entries to the table owner. CVE-2024-4317...
MGASA-2024-0190 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 125.0.6422.60 release. It includes 9 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromium...
MGASA-2024-0182 Updated gdk-pixbuf2.0 packages fix security vulnerability
In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters heap memory corruption in aniloadchunk in io-ani.c when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or...
MGASA-2024-0181 Updated golang packages fix security vulnerability
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. CVE-2024-24788...
MGASA-2024-0179 Updated java-1.8.0, java-11, java-17, java-latest packages fix security vulnerabilities
Long Exception message leading to crash. CVE-2024-21011 HTTP/2 client improper reverse DNS lookup. CVE-2024-21012 Integer overflow in C1 compiler address generation. CVE-2024-21068 Pack200 excessive memory allocation. CVE-2024-21085 C2 compilation fails with "Exceeded noderegs array". CVE-2024-21...
MGASA-2024-0180 Updated ghostscript packages fix security vulnerability
An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. CVE-2023-52722...
MGASA-2024-0178 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 124.0.6367.207 release. It includes 4 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromiu...
MGASA-2024-0177 Updated tcpdump packages fix security vulnerability
Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLTPPPSERIAL .pcap savefile. CVE-2024-2397...
MGASA-2024-0176 Updated sssd packages fix security vulnerability
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately. CVE-2023-3758...
MGASA-2024-0175 Updated mutt packages fix security vulnerabilities
Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 2.2.12. CVE-2023-4875...
MGASA-2024-0174 Updated libnbd packages fix security vulnerability
A flaw was found in libnbd. A server can reply with a block size larger than 2^63 the NBD spec states the size is a 64-bit unsigned value. This issue could lead to an application crash or other unintended behavior for NBD clients that doesn't treat the return value of the nbdgetsize function...
MGASA-2024-0173 Updated glibc packages fix security vulnerabilities
Stack-based buffer overflow in netgroup cache: If the Name Service Cache Daemon's nscd fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. CVE-2024-33599 Null pointer crashes after notfound response: If t...
MGASA-2024-0163 Updated libvirt packages fix security vulnerability
A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of...
MGASA-2024-0169 Updated php-tcpdf packages fix security vulnerability
TCPDF version =6.6.5 is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted HTML page with a crafted color. CVE-2024-22640...
MGASA-2024-0166 Updated exfatprogs packages fix security vulnerability
exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in readfiledentryset. CVE-2023-45897...
MGASA-2024-0170 Updated tpm2-tools packages fixes security vulnerabilities
A flaw was found in the tpm2-tools package. This issue occurs due to a missing check whether the magic number in attest is equal to TPM2GENERATEDVALUE, which can allow an attacker to generate arbitrary quote data that may not be detected by tpm2checkquote CVE-2024-29038. The pcr selection which i...
MGASA-2024-0167 Updated zziplib packages fix security vulnerability
An issue was discovered in function zzipdiskentrytofileheader in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service. CVE-2020-18770...
MGASA-2024-0168 Updated traceroute packages fix security vulnerability
In Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. CVE-2023-46316...
MGASA-2024-0172 Updated libxml2 packages fix a security vulnerability
An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free. CVE-2024-25062...
MGASA-2024-0171 Updated tpm2-tss packages fix security vulnerabilities
A flaw was found in the tpm2-tss package, where there was no check that the magic number in the attest is equal to the TPM2GENERATEDVALUE. This flaw allows an attacker to generate arbitrary quote data, which may not be detected by FapiVerifyQuote...
MGASA-2024-0160 Updated ruby packages fix security vulnerabilities
Buffer overread vulnerability in StringIO. CVE-2024-27280 RCE vulnerability with .rdocoptions in RDoc. CVE-2024-27281 Arbitrary memory address read vulnerability with Regex search. CVE-2024-27282...
MGASA-2024-0162 Updated openpmix packages fix security vulnerability
This update fixes a race condition allowing attackers to obtain ownership of arbitrary files CVE-2023-41915...
MGASA-2024-0165 Updated freeglut packages fix security vulnerabilities
freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. CVE-2024-24258 freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. CVE-2024-24259...
MGASA-2024-0161 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 124.0.6367.128 release. It includes 2 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromiu...
MGASA-2024-0164 Updated libtiff packages fix security vulnerability
An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. CVE-2023-6228...
MGASA-2024-0156 Updated cjson packages fix security vulnerabilities
cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONInsertItemInArray at cJSON.c. CVE-2023-50471 cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSONSetValuestring at cJSON.c. CVE-2023-50472...
MGASA-2024-0159 Updated guava packages fix security vulnerabilities
A bug that could allow an attacker with access to the machine to potentially access data in a temporary directory created by the Guava. CVE-2020-8908 Predictable temporary files and directories used in FileBackedOutputStream. CVE-2023-2976...
MGASA-2024-0154 Updated libarchive packages fix security vulnerability
Remote Code Execution Vulnerability. CVE-2024-26256...
MGASA-2024-0155 Updated mediawiki packages fix security vulnerabilities
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator...
MGASA-2024-0158 Updated krb5 packages fix security vulnerabilities
Kerberos 5 aka krb5 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmaprmt.c. CVE-2024-26458 Kerberos 5 aka krb5 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVE-2024-26461...
MGASA-2024-0157 Updated freerdp packages fix security vulnerabilities
This release is a security release and addresses multiple issues: Low OutOfBound Read in zgfxdecompresssegment. Moderate Integer overflow & OutOfBound Write in cleardecompressresidualdata. Low integer underflow in nscrledecode. Low OutOfBound Read in planarskipplanerle. Low OutOfBound Read in...
MGASA-2024-0153 Updated firefox packages fix security vulnerabilities
CVE-2024-3852: GetBoundName in the JIT returned the wrong object CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection CVE-2024-2609: Permission prompt input delay could expire when not ...
MGASA-2024-0152 Updated opencryptoki packages fix security vulnerability
A timing side-channel vulnerability has been discovered in the opencryptoki package while processing RSA PKCS1 v1.5 padded ciphertexts. This flaw could potentially enable unauthorized RSA ciphertext decryption or signing, even without access to the corresponding private key. CVE-2024-0914...
MGASA-2024-0151 Updated thunderbird packages fix security vulnerabilities
CVE-2024-3852: GetBoundName in the JIT returned the wrong object CVE-2024-3854: Out-of-bounds-read after mis-optimized switch statement CVE-2024-3857: Incorrect JITting of arguments led to use-after-free during garbage collection CVE-2024-2609: Permission prompt input delay could expire when not ...
MGASA-2024-0150 Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 124.0.6367.60 release. It includes 23 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromiu...
MGASA-2024-0148 Updated webkit2 packages fix security vulnerabilities
Due to issues in our build system this package is very outdated, now that the issues are fixed we are publishing the current upstream version. Lot of CVEs are fixed and a lot of changes were made by upstream, see the links...
MGASA-2024-0149 Updated wireshark packages fix security vulnerability
T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file. CVE-2024-2955...
MGASA-2024-0147 Updated glibc packages fix security vulnerability
The iconv function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. CVE-2024-2961...
MGASA-2024-0144 Updated jasper packages fix security vulnerability
CVE-2024-31744: Fixed denial of service through assertion failure in jpcstreamlistremove...
MGASA-2024-0145 Updated editorconfig-core-c packages fix security vulnerability
pointer overflow in STRINGCAT and a few more stack buffer overflows...
MGASA-2024-0146 Updated mbedtls packages fix security vulnerability
An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto API mishandles shared memory. CVE-2024-28960...
MGASA-2024-0143 Updated perl-Clipboard package fix security vulnerability
Version 0.29 fixes 'clipbrowse command execution with multi-line clipboard text including "| sh"'...
MGASA-2024-0141 Updated kernel, kmod-xtables-addons, kmod-virtualbox packages fix security vulnerabilities
Upstream kernel version 6.6.28 fix bugs and vulnerabilities. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. dwarves is a new requirement to build the kernel. For information about the vulnerabilities see the links...
MGASA-2024-0142 Updated kernel-linus packages fix security vulnerabilities
Upstream kernel version 6.6.28 fix bugs and vulnerabilities. For information about the vulnerabilities see the links...
MGASA-2024-0140 Updated putty & filezilla packages fix security vulnerability
The PuTTY client and all related components generate heavily biased ECDSA nonces in the case of NIST P-521. To be more precise, the first 9 bits of each ECDSA nonce are zero. This allows for full secret key recovery in roughly 60 signatures by using state-of-the-art techniques. These signatures c...
MGASA-2024-0137 Updated x11-server, x11-server-xwayland & tigervnc packages fix security vulnerability
The fix we provided for CVE-2024-31083 introduced a double-free in some circumstances, which led to X server crashes...
MGASA-2024-0138 Updated libreswan packages fix security vulnerability
CVE-2024-3652: The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affect...