6288 matches found
MGASA-2022-0039 Updated roundcubemail packages fix security vulnerability
XSS in handling an attachment's filename extension when displaying a MIME type warning message CVE-2021-44025. Potential SQL injection via search or searchparams CVE-2021-44026...
MGASA-2022-0040 Updated aom packages fix security vulnerability
AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aomimage.c. CVE-2020-36129 AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1dxiface.c. CVE-2020-36130 AOM v2.0.1 was discovered to contain a stack buffer overflow via the...
MGASA-2022-0038 Updated virtualbox packages fix security vulnerability
Updated virtualbox packages fix security vulnerability: Vulnerability in the Oracle VM VirtualBoxp rior to 6.1.32 contains an easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox...
MGASA-2022-0037 Updated polkit packages fix security vulnerability
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...
MGASA-2022-0032 Updated python-numpy packages fix security vulnerability
Buffer overflow that could lead to DoS in PyArrayNewFromDescrint function of ctors.c bsc1193913. CVE-2021-33430 Buffer overflow that could lead to DoS in arrayfrompyobj function of fortranobject.c bsc1193907. CVE-2021-41496...
MGASA-2022-0035 Updated mysql-connector-c++ packages fix security vulnerability
Buffer overflow due to inccorect calculation in EVPPKEYdecrypt. CVE-2021-3711 Denial of Service attack due to possible non-zero terminated strings. CVE-2021-3712...
MGASA-2022-0030 Updated libreswan packages fix security vulnerability
Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. CVE-2022-23094...
MGASA-2022-0031 Updated expat packages fix security vulnerability
In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too few bytes, or only freeing memory. CVE-2021-45960 In doProlog in xmlparse.c in Expat aka libexpat before 2.4.3, an integer overflow...
MGASA-2022-0034 Updated webkit2 packages fix security vulnerability
Multiple security issues affecting webkit2. See references for details...
MGASA-2022-0033 Updated htmldoc packages fix security vulnerability
The updated packages fix a crash when clicking the button "Generate" and a security vulnerability: A stack-based buffer overflow in imageloadbmp in HTMLDOC = 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file. CVE-2021-43579...
MGASA-2022-0029 Updated python-celery packages fix security vulnerability
Stored Command Injection CVE-2021-23727 Also fixes unfulfilled python3.8distbilliard installing pythone-celery...
MGASA-2022-0036 Updated phpmyadmin packages fix security vulnerability
A flaw was identified in how phpMyAdmin processes two factor authentication; a user could potentially manipulate their account to bypass two factor authentication in subsequent authentication sessions PMASA-2022-1. A series of weaknesses was identified allowing a malicious user to submit maliciou...
MGASA-2022-0028 Updated glibc packages fix security vulnerabilities
Updated glibc packages fix security vulnerabilities: The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulti...
MGASA-2022-0027 Updated kernel-linus packages fix security vulnerability
This kernel-linus update is based on upstream 5.15.16 and fixes at least the following security issue: William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A loc...
MGASA-2022-0026 Updated kernel packages fix security vulnerability
This kernel update is based on upstream 5.15.16 and fixes at least the following security issue: William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local...
MGASA-2022-0023 Updated vim packages fix security vulnerability
vim is vulnerable to Out-of-bounds Read CVE-2022-0128 vim is vulnerable to Use After Free CVE-2022-0156 vim is vulnerable to Heap-based Buffer Overflow CVE-2022-0158 vim is vulnerable to Heap-based Buffer Overflow CVE-2022-0213...
MGASA-2022-0024 Updated clamav packages fix security vulnerability
A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that m...
MGASA-2022-0025 Updated wpa_supplicant packages fix security vulnerability
The implementations of SAE in hostapd before 2.10 and wpasupplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494...
MGASA-2022-0022 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.15 and fixes at least the following security issues: A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the...
MGASA-2022-0021 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.15 and fixes at least the following security issues: A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS...
MGASA-2022-0020 Updated openexr packages fix security vulnerability
OpenEXR 3.1.0 through 3.1.3 has a heap-based buffer overflow in Imf31::LineCompositeTask::execute called from IlmThread31::NullThreadPoolProvider::addTask and IlmThread31::ThreadPool::addGlobalTask. CVE-2021-45942...
MGASA-2022-0019 Updated thunderbird packages fix security vulnerability
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox CVE-2021-4140. Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable cra...
MGASA-2022-0018 Updated perl-CPAN packages fix security vulnerability
CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156...
MGASA-2022-0016 Updated systemd packages fix security vulnerability
A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. CVE-2021-3997...
MGASA-2022-0017 Updated mbedtls packages fix security vulnerability
This update provides Mbed TLS 2.16.12, with a number of bug fixes and a security fix. Mbed TLS has a double free in certain out-of-memory conditions, as demonstrated by an mbedtlssslsetsession failure. CVE-2021-44732...
MGASA-2022-0014 Updated htmldoc packages fix security vulnerability
Buffer overflow vulnerability in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to imageloadbmp. CVE-2021-40985...
MGASA-2022-0015 Updated vim packages fix security vulnerability
CWE-122 Heap-based Buffer Overflow CVE-2021-4136 CWE-125 Out-of-bounds Read CVE-2021-4166 CWE-416 Use After Free CVE-2021-4173 CWE-416 Use After Free CVE-2021-4187...
MGASA-2022-0013 Updated nss and firefox packages fix security vulnerabilities
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox CVE-2021-4140. Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable cra...
MGASA-2022-0011 Updated python-django packages fix security vulnerability
UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack...
MGASA-2022-0009 Updated osgi-core/apache-commons-compress packages fix security vulnerability
When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. CVE-2021-35515 When reading a specially crafted 7...
MGASA-2022-0010 Updated squashfs-tools packages fix security vulnerability
squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations...
MGASA-2022-0008 Updated suricata packages fix security vulnerability
Critical evasion in suricata CVE-2021-35063...
MGASA-2022-0012 Updated ghostscript packages fix security vulnerability
Use-after-free in sampleddatasample called from sampleddatacontinue and interp. CVE-2021-45944 Heap-based buffer overflow in sampleddatafinish called from sampleddatacontinue and interp. CVE-2021-45949...
MGASA-2022-0007 Updated gnome-shell packages fix security vulnerability
Drop extra capabilities from gnome-shell. They're optional and they break shutdown from the login screen with new glibs. CVE-2021-3982...
MGASA-2022-0006 Updated singularity packages fix security vulnerability
A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...
MGASA-2022-0005 Updated libgda5.0 packages fix security vulnerability
Fix missing TLS certificate verification. CVE-2021-39359...
MGASA-2022-0003 Updated gegl packages fix security vulnerability
Fix shell expansion via crafted pathname in the ImageMagick convert fallback...
MGASA-2022-0002 Updated log4j packages fix security vulnerability
Apache Log4j2 is vulnerable to a remote code execution RCE attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed b...
MGASA-2022-0001 Updated ntfs-3g packages fix security vulnerability
Security vulnerabilities were identified in the open source NTFS-3G and NTFSPROGS software. These vulnerabilities may allow an attacker using a maliciously crafted NTFS-formatted image file or external storage to potentially execute arbitrary privileged code, if the attacker has either local acce...
MGASA-2022-0004 Updated wireshark packages fix security vulnerability
Several wireshark vulnerabilities have been fixed. See the release notes for details...
MGASA-2021-0594 Updated e2guardian packages fix security vulnerability
e2guardian did not validate TLS hostnames CVE-2021-44273...
MGASA-2021-0591 Updated eclipse packages fix security vulnerability
Authenticate active help requests to the local help web server CVE-2020-27225...
MGASA-2021-0596 Updated toxcore packages fix security vulnerability
stack-based buffer overflow in handlerequest in DHT.c CVE-2021-44847...
MGASA-2021-0590 Updated libtpms/swtpm packages fix security vulnerability
CryptSym: fix AES output IV CVE-2021-3505. Fixed a context save and suspend/resume problem when public keys are loaded. Reset too large size indicators in TPM2B to avoid access beyond buffer CVE-2021-3623 Restore original value in buffer if unmarshalled one was illegal Fixed out-of-bounds access...
MGASA-2021-0593 Updated calibre packages fix security vulnerability
ReDoS vulnerability in htmlpreprocessrules in ebooks/conversion/preprocess.py...
MGASA-2021-0595 Updated python-lxml packages fix security vulnerability
HTML Cleaner allows crafted and SVG embedded scripts to pass through CVE-2021-43818...
MGASA-2021-0592 Updated nodejs packages fix security vulnerability
HTTP Request Smuggling due to spaces in headers. The http parser accepts requests with a space SP right after the header name before the colon. This can lead to HTTP Request Smuggling HRS. CVE-2021-22959 HTTP Request Smuggling when parsing the body. The parse ignores chunk extensions when parsing...
MGASA-2021-0588 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.15.11 and fixes at least the following security issues: netdevsim: Zero-initialize memory for new map's value in function nsimbpfmapalloc CVE-2021-4135. Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the guests,...
MGASA-2021-0589 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.15.11 and fixes at least the following security issues: netdevsim: Zero-initialize memory for new map's value in function nsimbpfmapalloc CVE-2021-4135. Potentially malicious XEN PV backends can cause guest DoS due to unhardened frontends in the...