MGASA-2021-0577 Updated apache packages fix security vulnerabilities

Updated apache packages fix security vulnerabilities: A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer dereference or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Uni...

MGASA-2021-0574 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.10 and fixes at least the following security issues: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close and fget simultaneously and can potentially trigger a...

MGASA-2021-0575 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.10 and fixes at least the following security issues: A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close and fget simultaneously and can potentially...

MGASA-2021-0572 Updated log4j packages fix security vulnerability

Updated log4j packages fix security vulnerability: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is...

MGASA-2021-0569 Updated watchdog packages fix security issue

Updated watchdog packages fixes an issue with a memory leak when verbose mode is on...

MGASA-2021-0571 Updated olm packages fix security vulnerability

Updated olm packages fix security vulnerability: The olmsessiondescribe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of t...

MGASA-2021-0570 Updated privoxy packages fix security vulnerabilities

Updated privoxy packages fix security vulnerabilities: A security issue has been found in Privoxy before version 3.0.33. geturlspecparam did not free memory of compiled pattern spec before bailing CVE-2021-44540. A security issue has been found in Privoxy before version 3.0.33...

MGASA-2021-0565 Updated chromium-browser-stable packages fix security vulnerabilities

Updated chromium-browser-stable packages fix security vulnerabilities. The chromium-browser-stable package has been updated to 96.0.4664.110 version that fixes multiples security vulnerabilities. One of these CVEs is known to be actively exploited. Insufficient data validation in Mojo...

MGASA-2021-0568 Updated mediawiki packages fix security vulnerabilities

Updated mediawiki packages fix security vulnerabilities: == Security fixes == T292763. CVE-2021-44854 REST API incorrectly publicly caches autocomplete search results from private wikis. T271037, CVE-2021-44856 Title blocked in AbuseFilter can be created via Special:ChangeContentModel. T297322,...

MGASA-2021-0558 Updated matio packages fix security vulnerability

Updated matio packages fix security vulnerability: A memory leak was discovered in MatVarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case CVE-2019-20052...

MGASA-2021-0557 Updated dovecot packages fix security vulnerabilities

Updated dovecot packages fix security vulnerabilities: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension CVE-2020-28200. Dovecot before 2.3.15 allows ../ Path Traversal. An...

MGASA-2021-0562 Updated hiredis packages fix security vulnerability

Updated hiredis packages fix security vulnerability: It was discovered that there was an integer-overflow vulnerability in hiredis, a C client library for communicating with Redis databases. This occurred within the handling and parsing of 'multi-bulk' replies CVE-2021-32765...

MGASA-2021-0563 Updated botan2 packages fix security vulnerability

Updated botan2 packages fix security vulnerability: The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the...

MGASA-2021-0559 Updated pjproject packages fix security vulnerability

Updated pjproject packages fix security vulnerability: In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due to the accepted socket having no group lock. Second, the SSL socket parent/ listener may get...

MGASA-2021-0567 Updated keepalived packages fix security vulnerability

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

MGASA-2021-0566 Updated log4j packages fix security vulnerability

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map MDC input data when the logging configuration uses a non-default Pattern Layout with either a Context...

MGASA-2021-0560 Updated bind packages fix security vulnerability

Updated bind packages fix security vulnerability: Kishore Kumar Kothapalli discovered that the lame server cache in BIND, a DNS server implementation, can be abused by an attacker to significantly degrade resolver performance, resulting in denial of service large delays for responses for client...

MGASA-2021-0564 Updated vim packages fix security vulnerability

Updated vim packages fix security vulnerability: vim is vulnerable to Use After Free CVE-2021-4069...

MGASA-2021-0561 Updated openssh packages fix security vulnerability

Updated openssh packages fix security vulnerability: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and...

MGASA-2021-0556 Updated log4j packages fix security vulnerability

Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when...

MGASA-2021-0548 Updated fetchmail packages fix security vulnerability

Update to fetchmail 6.4.24 fixes STARTTLS session encryption bypassing. CVE-2021-39272...

MGASA-2021-0549 Updated curaengine packages fix security vulnerability

Buffer overflow vulnerability in function stbiextendreceive in stbimage.h in stb 2.26 via a crafted JPEG file. CVE-2021-28021 An issue was discovered in stb stbimage.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines as an infinite sequence of zero-length runs. An...

MGASA-2021-0552 Updated python-django packages fix security vulnerability

Potential bypass of an upstream access control based on URL paths. CVE-2021-44420 HTTP requests for URLs with trailing newlines could bypass an upstream access control based on URL paths...

MGASA-2021-0555 Updated chromium-browser-stable packages fix security vulnerability

CVE-2021-4052: Use after free in web apps. CVE-2021-4053: Use after free in UI. CVE-2021-4079: Out of bounds write in WebRTC. CVE-2021-4054: Incorrect security UI in autofill. CVE-2021-4078: Type confusion in V8. CVE-2021-4055: Heap buffer overflow in extensions. CVE-2021-4056: Type Confusion in...

MGASA-2021-0550 Updated speex packages fix security vulnerability

Fixed zero division error in readsamples bsc1192580. CVE-2020-23903...

MGASA-2021-0547 Updated libvirt packages fix security vulnerability

Fix deadlock on virStoragePoolLookupByTargetPath failure bz 1986113 CVE-2021-3667 More CAPSETPCAP warning fixes bz 1924218 Handle unknown firmware.json errors...

MGASA-2021-0551 Updated firefox packages fix security vulnerability

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL CVE-2021-43536. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash due to a heap...

MGASA-2021-0554 Updated thunderbird packages fix security vulnerability

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities CVE-2021-43528. Under certain...

MGASA-2021-0553 Updated opencontainers-runc packages fix security vulnerability

It was discovered that there was an overflow issue in runc, the runtime for the Open Container Project, often used with Docker. The Netlink 'bytemsg' length field could have allowed an attacker to override Netlink-based container configurations. This vulnerability required the attacker to have so...

MGASA-2021-0546 Updated libsndfile packages fix security vulnerability rhbz#2027690

Fix heap buffer overflow in flac...

MGASA-2021-0541 Updated sharpziplib/mono-tools packages fix security vulnerability

Update to sharpziplib 1.3.3 which contains a security fix, and rebuild of mono-tools to use the fixed version...

MGASA-2021-0544 Updated gmp packages fix security vulnerability

Integer overflow in mpz/inpraw.c and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms...

MGASA-2021-0543 Updated heimdal packages fix security vulnerability

A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request. An authenticated user could use this flaw to crash a samba server using heimdal...

MGASA-2021-0542 Updated java openjdk packages fix security vulnerability

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: OpenJDK: Loop in HttpsServer triggered during TLS session close JSSE, 8254967 CVE-2021-35565 OpenJDK: Incorrect principal selection when using Kerberos...

MGASA-2021-0545 Updated vim packages fix security vulnerability

heap-based buffer overflow in findhelptags in src/help.c...

MGASA-2021-0540 Updated nginx/vsftpd packages fix security vulnerability

ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating Cracks in TLS Authentication...

MGASA-2021-0538 Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 5.15.6 and fixes at least the following security issues: A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could happen if removing device that is not common to remove video card physically without power-off,...

MGASA-2021-0539 Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.6 and fixes at least the following security issues: A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could happen if removing device that is not common to remove video card physically without...

MGASA-2021-0536 Updated mariadb packages fix security vulnerability

Advisory text to describe the update. Wrap lines at 75 chars. Security issue in InnoDB component has been discovered and fixed CVE-2021-35604. Additional bugs fixes too...

MGASA-2021-0535 Updated vim packages fix security vulnerability

Multiple Heap-based Buffer Overflows Stack-based Buffer overflows and a use after free...

MGASA-2021-0537 Updated golang packages fix security vulnerability

ImportedSymbols in debug/macho for Open or OpenFat in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation. CVE-2021-41771 Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a...

MGASA-2021-0531 Updated docker-containerd packages fix security vulnerability

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents...

MGASA-2021-0532 Updated bluez packages fix security vulnerability

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdpcstateallocbuf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object...

MGASA-2021-0530 Updated gfbgraph packages fix security vulnerability

In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

MGASA-2021-0527 Updated perl/perl-Encode packages fix security vulnerability

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library in the current working directory that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm 3.05...

MGASA-2021-0528 Updated hivex packages fix security vulnerability

Fixes limit recursion in ri-records. CVE-2021-3622...

MGASA-2021-0533 Updated busybox packages fix security vulnerability

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. CVE-2021-42376 An attacker-controlled...

MGASA-2021-0529 Updated udisks2/libblockdev packages fix security vulnerability

A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to kernel panic. The highest threat from this vulnerability is to system availability...

MGASA-2021-0534 Updated nss packages fix security vulnerability

NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS 7, or PKCS 12 are likely to be impacted. Applications using NSS...

MGASA-2021-0526 Updated glibc packages fixes security related bugs

This update fixes a few security related bugs: - regex: fix buffer read overrun in search BZ 28470 - nptl: Do not set signal mask on second setjmp return BZ 28607...