6277 matches found
MGASA-2022-0128 Updated libtiff packages fix security vulnerability
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. CVE-2022-0907...
MGASA-2022-0127 Updated php-smarty packages fix security vulnerability
Updated php-smarty packages to version 4 for php 8 compatibility and to fix security vulnerabilities...
MGASA-2022-0129 Updated openjpeg2 packages fix security vulnerability
A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free on an uninitialized pointer, leading to a segmentation fault and...
MGASA-2022-0126 Updated golang packages fix security vulnerability
On 64-bit platforms, an extremely deeply nested expression can cause regexp.Compile to cause goroutine stack exhaustion, forcing the program to exit. Note this applies to very large expressions, on the order of 2MB. CVE-2022-24921...
MGASA-2022-0125 Updated wavpack packages fix security vulnerability
An out of bounds read was found in Wavpack 5.4.0 in processing .WAV files. This issue triggered in function WavpackPackSamples of file src/packutils.c, tainted variable cnt is too large, that makes pointer sptr read beyond heap bound. CVE-2021-44269...
MGASA-2022-0124 Updated zlib packages fix security vulnerability
zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 Update to release 1.2.12 for additional bug fixes. See the changelog for details...
MGASA-2022-0123 Updated openvpn packages fix security vulnerability
Potential authentication by-pass with multiple deferred authentication plug-ins. CVE-2022-0547...
MGASA-2022-0122 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.32 and fixes at least the following security issues: An out-of-bounds OOB memory write flaw was found in the Linux kernel’s watchqueue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local...
MGASA-2022-0121 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.32 and fixes at least the following security issues: An out-of-bounds OOB memory write flaw was found in the Linux kernel’s watchqueue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to...
MGASA-2022-0118 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to 99.0.4844.84 that fixes one security vulnerability and many bugs together with 99.0.4844.82. Type Confusion in V8. Reported by anonymous on 2022-03-23 Google is aware that an exploit for CVE-2022-1096 exists in the wild. CVE-2022-1096...
MGASA-2022-0120 Updated graphicsmagick packages fix security vulnerability
The graphicsmagick package has been updated to version 1.3.38, fixing several security issues and other bugs. See the referenced NEWS link for details...
MGASA-2022-0119 Updated libtiff packages fix security vulnerability
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. CVE-2022-0865 A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory acces...
MGASA-2022-0117 Updated docker packages fix security vulnerability
Containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during 'execve2' CVE-2022-24769...
MGASA-2022-0115 Updated libpano13 packages fix security vulnerability
Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of-bounds read in the function panoParserFindOLine in parser.c. CVE-2021-33293...
MGASA-2022-0114 Updated pesign packages fix security vulnerability
Fix potential DoS in pesign daemon...
MGASA-2022-0116 Updated abcm2ps packages fix security vulnerability
abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculatebeam at draw.c. CVE-2021-32434 Stack-based buffer overflow in the function getkey in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service DoS via unspecified vectors. CVE-2021-324...
MGASA-2022-0110 Updated sphinx packages fix security vulnerability
It was found that sphinx could allow arbitrary files to be read by abusing a configuration option. CVE-2020-29050...
MGASA-2022-0111 Updated cyrus-sasl packages fix security vulnerability
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. CVE-2022-24407...
MGASA-2022-0112 Updated swtpm packages fix security vulnerability
swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an...
MGASA-2022-0113 Updated openssl packages fix security vulnerability
Infinite loop in BNmodsqrt reachable when parsing certificates. CVE-2022-0778...
MGASA-2022-0109 Updated stunnel packages fix security vulnerability
Update to 5.62 including new features and bugfixes: Security bugfixes - The "redirect" option was fixed to properly handle unauthenticated requests bsc1182529. - Fixed a double free with OpenSSL older than 1.1.0. - Added hardening to systemd service bsc1181400. New features - Added new "protocol ...
MGASA-2022-0105 Updated apache packages fix security vulnerability
SECURITY: CVE-2022-23943: modsed: Read/write beyond bounds. Out-of-bounds Write vulnerability in modsed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. Credits: Ronald Crane Zippenhop LLC SECURITY: CVE-2022-22721: core: Possible buffer...
MGASA-2022-0104 Updated python-django/python-asgiref packages fix security vulnerability
The % debug % template tag didn't properly encode the current context posing an XSS attack vector CVE-2022-22818. Passing certain inputs to multipart forms could result in an infinite loop when parsing files resulting in a denial of service CVE-2022-23833. The python-django update necessitated a...
MGASA-2022-0106 Updated 389-ds-base packages fix security vulnerability
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash. CVE-2021-4091...
MGASA-2022-0107 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 99.0.4844.74 version that fixes multiples security vulnerabilities. 1299422 Critical CVE-2022-0971: Use after free in Blink Layout. 1301320 High CVE-2022-0972: Use after free in Extensions. 1297498 High CVE-2022-0973: Use after free in...
MGASA-2022-0103 Updated nodejs-tar packages fix security vulnerability
Untrusted tar file to symlink into an arbitrary location allowing file overwrites. CVE-2021-37712 Arbitrary file creation/overwrite and arbitrary code execution. CVE-2021-37701 Arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. CVE-2021-32803 Arbitrary File...
MGASA-2022-0108 Updated bind packages fix security vulnerability
DNS forwarders - cache poisoning vulnerability. CVE-2021-25220...
MGASA-2022-0099 Updated chromium-browser-stable packages fix security vulnerability
The chromium-browser-stable package has been updated to the 99.0.4844.51 version that fixes multiples security vulnerabilities...
MGASA-2022-0102 Updated ruby packages fix security vulnerability
Command injection in ruby bundler. CVE-2021-43809...
MGASA-2022-0101 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.28 and fixes at least the following security issues: Non-transparent sharing of branch predictor selectors between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
MGASA-2022-0100 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.28 and fixes at least the following security issues: Non-transparent sharing of branch predictor selectors between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...
MGASA-2022-0098 Updated gnutls packages fix security vulnerability
Null pointer dereference in MDUPDATE. CVE-2021-4209...
MGASA-2022-0096 Updated shapelib packages fix security vulnerability
Double-free vulnerability in contrib/shpsort.c. CVE-2022-0699...
MGASA-2022-0097 Updated thunderbird packages fix security vulnerabilities
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash CVE-2022-26381. When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification CVE-2022-26383. If an attacker coul...
MGASA-2022-0095 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.26 and fixes at least the following security issues: A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is ORDONLY, immutable or on...
MGASA-2022-0094 Updated thunderbird packages fix security vulnerabilities
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free CVE-2022-26485. An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape CVE-2022-26486...
MGASA-2022-0093 Updated firefox packages fix security vulnerabilities
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash CVE-2022-26381. When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification CVE-2022-26383. If an attacker coul...
MGASA-2022-0090 Updated webmin packages fix security vulnerability
Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default Authentic theme CVE-2022-0824, CVE-2022-0829...
MGASA-2022-0092 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.25 and fixes at least the following security issues: A vulnerability in the Linux kernel since version 5.8 due to uninitialized variables. It enables anybody to write arbitrary data to arbitrary files, even if the file is ORDONLY, immutable or on a...
MGASA-2022-0091 Updated golang packages fix security vulnerability
Overflow in Rat.SetString in math/big can lead to uncontrolled memory consumption CVE-2022-23772 Incorrect access control in cmd/go CVE-2022-23773 Incorrect returned value in crypto/elliptic IsOnCurve CVE-2022-23806 The following non-security bugs were fixed: - go50978 crypto/elliptic: IsOnCurve...
MGASA-2022-0087 Updated libtiff packages fix security vulnerability
Null source pointer passed as an argument to memcpy function within TIFFFetchStripThing in tifdirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. CVE-2022-0561 Null source pointer passed as an argument to memcpy function within TIFFReadDirector...
MGASA-2022-0088 Updated docker-containerd packages fix security vulnerability
A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup...
MGASA-2022-0086 Updated mc packages fix security vulnerability
An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity. CVE-2021-36370...
MGASA-2022-0089 Updated firefox packages fix security vulnerabilities
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free CVE-2022-26485. An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape CVE-2022-26486...
MGASA-2022-0085 Updated flac packages fix security vulnerability
In appendtoverifyfifointerleaved of streamencoder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. CVE-2021-0561...
MGASA-2022-0084 Updated libxml2 packages fix security vulnerability
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. CVE-2022-23308...
MGASA-2022-0083 Updated php packages fix security vulnerability
Security update for php. See changelog for details...
MGASA-2022-0082 Updated htmldoc packages fix security vulnerability
A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gifgetcode and occurs when opening a malicious GIF file, which can result in a crash segmentation fault. CVE-2022-0534...
MGASA-2022-0080 Updated polkit packages fix security vulnerability
There is a file descriptor leak in polkit, which can enable an unprivileged user to cause polkit to crash, due to file descriptor exhaustion. CVE-2021-4115...