6288 matches found
MGASA-2022-0241 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 103.0.5060.53 branch, fixing many bugs and 14 CVE. Some of them are listed below: Use after free in Base. CVE-2022-2156 Use after free in Interest groups. CVE-2022-2157 Type Confusion in V8. CVE-2022-2158 Insufficient policy enforcement ...
MGASA-2022-0238 Updated exo packages fix security vulnerability
Changed to prevent executing possibly malicious .desktop files from online sources ftp://, http:// etc...
MGASA-2022-0240 Updated libtiff packages fix security vulnerability
Heap-buffer-overflow in TIFFReadRawDataStriped in tiffinfo.c. CVE-2022-1354 Stack-buffer-overflow in tiffcp.c in main. CVE-2022-1355 Out-of-bounds read in LZWDecode. CVE-2022-1622, CVE-2022-1623...
MGASA-2022-0235 Updated bluez packages fix security vulnerability
It was discovered that BlueZ incorrectly validated certain capabilities and lengths when handling the A2DP profile. A remote attacker could use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary code...
MGASA-2022-0233 Updated dnsmasq packages fix security vulnerability
A write after free has been discovered in DHCPv6 code. A special request could be crafted to modify already freed memory. CVE-2022-0934...
MGASA-2022-0236 Updated exempi packages fix security vulnerability
XMP Toolkit SDK versions 2020.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victi...
MGASA-2022-0237 Updated halibut packages fix security vulnerability
Use-after-free in cleanupindex in index.c CVE-2021-42612 Double free in cleanupindex in index.c CVE-2021-42613 Use-after-free in infowidthinternal in bkinfo.c CVE-2021-42614...
MGASA-2022-0234 Updated php packages fix security vulnerability
CLI -Fixed bug 8575 CLI closes standard streams too early. Core -Fixed Haiku ZTS builds. Date -Fixed bug 8471 Segmentation fault when converting immutable and mutable DateTime instances created using reflection. php-fpm - Fixed bug 72185 writes empty fcgi record causing nginx 502. Mysqlnd - Fixed...
MGASA-2022-0232 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 102.0.5005.115 version, fixing many bugs and 7 CVE. Some of them are listed below: Use after free in WebGPU. CVE-2022-2007 Out of bounds memory access in WebGL. CVE-2022-2008 Out of bounds read in compositing. CVE-2022-2010 Use after fre...
MGASA-2022-0231 Updated golang packages fix security vulnerability
crypto/tls: session tickets lack random ticketageadd. Session tickets generated by crypto/tls did not contain a randomly generated ticketageadd. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption...
MGASA-2022-0225 Updated nats-server packages fix security vulnerability
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. CVE-2022-24450...
MGASA-2022-0227 Updated docker-containerd packages fix security vulnerability
A bug was found in the containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the 'ExecSync' API. CVE-2022-31030...
MGASA-2022-0230 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.46 and fixes at least the following security issues: KVM: x86/mmu: fix NULL pointer dereference on guest INVPCID CVE-2022-1789. KVM: x86: avoid calling x86 emulator without a decoded instruction CVE-2022-1852. A use-after-free vulnerability was...
MGASA-2022-0228 Updated apache packages fix security vulnerability
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in modproxyajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions...
MGASA-2022-0229 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.46 and fixes at least the following security issues: KVM: x86: avoid calling x86 emulator without a decoded instruction CVE-2022-1852. A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nftablesapi.c. Th...
MGASA-2022-0226 Updated php-smarty packages fix security vulnerability
Template authors could inject php code by choosing a malicious block name or include file name. CVE-2022-29221...
MGASA-2022-0222 Updated python-ujson packages fix security vulnerability
Benchmark refactor - argparse CLI. Fix segmentation faults when errors occur while handling unserialisable objects. Fix segmentation fault when an exception is raised while converting a dict key to a string. Fix memory leak dumping on non-string dict keys - Fix ref counting on repeated default...
MGASA-2022-0224 Updated python-pypdf2 packages fix security vulnerability
Infinite loop with manipulated inline images CVE-2022-24859...
MGASA-2022-0223 Updated vim packages fix security vulnerability
out-of-bounds read in gcharcursor in misc1.c CVE-2022-1851 use-after-free in findpatterninpath in search.c CVE-2022-1898 out-of-bounds write in vimregsubboth in regexp.c CVE-2022-1897 buffer over-read in utfptr2char in mbyte.c CVE-2022-1927 out of bounds write in vimregsubboth CVE-2022-1942...
MGASA-2022-0221 Updated thunderbird packages fix security vulnerability
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...
MGASA-2022-0220 Updated firefox/nss/nspr packages fix security vulnerability
A malicious website could have learned the size of a cross-origin resource that supported Range requests CVE-2022-31736. A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash CVE-2022-31737. When exiting fullscreen...
MGASA-2022-0215 Updated mariadb packages fix security vulnerability
Some security vulenarbilities have been fixed. Some bigger bugs in optimizer and replication engine have been found and fixed. See release notes for details...
MGASA-2022-0214 Updated trojita packages fix security vulnerability
An attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted parts can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If...
MGASA-2022-0216 Updated webmin packages fix security vulnerability
Less privileged Webmin users excluding those created by Virtualmin and Cloudmin can modify arbitrary files with root privileges, and so run commands as root CVE-2022-30708...
MGASA-2022-0218 Updated webkit2 packages fix security vulnerability
Updated webkit2 packages fix several crashes and rendering issues. WSA-2022-0005...
MGASA-2022-0219 Updated gimp packages fix security vulnerability
GIMP 2.10 is vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a huge amount of memory, resulting in insufficient memory or program crash. CVE-2022-30067...
MGASA-2022-0217 Updated logrotate packages fix security vulnerability
A vulnerability was found in logrotate in how the state file is created. The state file is used to prevent parallel executions of multiple instances of logrotate by acquiring and releasing a file lock. When the state file does not exist, it is created with world-readable permission, allowing an...
MGASA-2022-0213 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.43 and fixes at least the following security issues: A race condition in the perf subsystem allows for a local privilege escalation. NOTE: Mageia kernels by default has disabled the perf usage for unprivileged users, effectively rendering this...
MGASA-2022-0212 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.43 and fixes at least the following security issues: A race condition in the perf subsystem allows for a local privilege escalation. NOTE: Mageia kernels by default has disabled the perf usage for unprivileged users, effectively rendering this...
MGASA-2022-0209 Updated admesh packages fix security vulnerability
ADMesh through 0.98.4 has a heap-based buffer over-read in stlupdateconnectsremove1 called from stlremovedegenerate in connect.c in libadmesh.a. CVE-2018-25033...
MGASA-2022-0208 Updated pidgin packages fix security vulnerability
MITM vulnerability when DNSSEC wasn't used CVE-2022-26491...
MGASA-2022-0211 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 102.0.5005.61 version, fixing many bugs and 32 CVE. Some of them are listed below: CVE-2022-1853: Use after free in Indexed DB. CVE-2022-1854: Use after free in ANGLE. CVE-2022-1855: Use after free in Messaging. CVE-2022-1856: Use after...
MGASA-2022-0210 Updated golang packages fix security vulnerability
The syscall.Faccessat function checks whether the calling process can access a file. Faccessat contains a bug where it checks a file’s group permission bits if the process’s user is a member of the process’s group rather than a member of the file’s group. CVE-2022-29526...
MGASA-2022-0202 Updated cockpit packages fix security vulnerability
authenticates with revoked certificates CVE-2021-3698...
MGASA-2022-0204 Updated supertux packages fix security vulnerability
squirrel: threadcall in sqbaselib.cpp lacks a certain sqreservestack call CVE-2022-30292...
MGASA-2022-0206 Updated unrar packages fix security vulnerability
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract aka unpack operation, as demonstrated by creating a /.ssh/authorizedkeys file. CVE-2022-30333...
MGASA-2022-0205 Updated openldap packages fix security vulnerability
SQL injection in back-sql CVE-2022-29155...
MGASA-2022-0207 Updated firefox/thunderbird packages fix security vulnerability
Prototype pollution in Top-Level Await implementation. CVE-2022-1802 Untrusted input used in JavaScript object indexing, leading to prototype pollution. CVE-2022-1529...
MGASA-2022-0203 Updated vim packages fix security vulnerability
vim is vulnerable to out of bounds read CVE-2022-0213 Heap-based Buffer Overflow in blockinsert in src/ops.c CVE-2022-0261 a heap-based OOB read of size 1 CVE-2022-0128 heap-based buffer overflow in utfheadoff in mbyte.c CVE-2022-0318 access of memory location before start of buffer CVE-2022-0351...
MGASA-2022-0201 Updated postgresql packages fix security vulnerability
The updated postgresql packages fix a security vulnerability: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox CVE-2022-1552...
MGASA-2022-0196 Updated netatalk packages fix security vulnerability
Remote arbitrary code execution related to dsistreamreceive. CVE-2021-31439 Remote arbitrary code execution related to parseentries. CVE-2022-23121 Remote arbitrary code execution related to copyapplfile. CVE-2022-23125...
MGASA-2022-0200 Updated ruby-nokogiri packages fix security vulnerability
Nokogiri did not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors segfault or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a...
MGASA-2022-0197 Updated nvidia390 packages fix security vulnerabilities
Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denial of...
MGASA-2022-0198 Updated nvidia-current packages fix security vulnerabilities
Updated nvidia-current packages fix security vulnerabilities: NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer, where an unprivileged regular user on the network can cause an out-of-bounds write through a specially crafted shader, which may lead to code execution, denia...
MGASA-2022-0199 Updated ffmpeg packages fix security vulnerability
This update provides ffmpeg version 4.3.4, which fixes several security vulnerabilities and other bugs which were corrected upstream...
MGASA-2022-0193 Updated microcode packages fix security vulnerabilities
Updated microcodes for Intel processors, fixing various functional issues, and at least the following security issues: Sensitive information accessible by physical probing of JTAG interface for some IntelR Processors with SGX may allow an unprivileged user to potentially enable information...
MGASA-2022-0194 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.41 and fixes at least the following security issues: A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel BPF subsystem due to the way a user loads BTF. This flaw allows a...
MGASA-2022-0195 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.41 and fixes at least the following security issues: A flaw was found in unrestricted eBPF usage by the BPFBTFLOAD, leading to a possible out-of-bounds memory write in the Linux kernel BPF subsystem due to the way a user loads BTF. This flaw allo...
MGASA-2022-0192 Updated opencontainers-runc packages fix security vulnerability
A bug was found in runc where runc exec --cap executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve2. This bug did n...