6291 matches found
MGASA-2021-0242 Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Out of bounds-read when parsing a WMCOPYDATA message. CVE-2021-29964 Memory safety bugs fixed in Thunderbird 78.11. CVE-2021-29967...
MGASA-2021-0239 Updated cgal packages fix security vulnerabilities
Updated cgal packages fix security vulnerabilities: An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex Faceof OOB read. An attacker can provide malicious input to trigger this vulnerability CVE-2020-28601. An oob read vulnerability exists in NefS2/SNCioparser.h...
MGASA-2021-0240 Updated exiv2 packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Heap-based buffer overflow in Jp2Image::readMetadata. CVE-2021-3482 Heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata. CVE-2021-29457 Out-of-bounds read in Exiv2::Internal::CrwMap::encode. CVE-2021-29458 Exiv2 incorrectly handled...
MGASA-2021-0228 Updated graphviz packages fix a security vulnerability
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service application crash by loading a crafted file into the "lib/common/shapes.c" component. CVE-2020-18032...
MGASA-2021-0235 Updated mpv packages fix a security vulnerability
Fixed format string vulnerability allows user-assisted remote attackers to achieve code execution via a crafted m3u playlist file CVE-2021-30145...
MGASA-2021-0230 Updated libpano13 packages fix a security vulnerability
Format string vulnerability in panoFileOutputNamesCreate in libpano13 2.9.20.rc2 and earlier can lead to read and write arbitrary memory values CVE-2021-20307...
MGASA-2021-0227 Updated vlc packages fix security vulnerabilities
A remote user could create a specifically crafted file that could trigger some various issues. It is possible to trigger a remote code execution through a specifically crafted playlist, and tricking the user into interacting with that playlist elements. It is also possible to trigger read or writ...
MGASA-2021-0231 Updated dnsmasq packages fix a security vulnerability
A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fixed port while forwarding queries. An attacker on the network, able to find the outgoing port used by dnsmasq, only needs to guess the random transmission ...
MGASA-2021-0233 Updated tar package fix a security vulnerability
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability CVE-2021-20193...
MGASA-2021-0234 Updated librsvg packages fix a security vulnerability
This update patches the vendored smallvec Rust crate in librsvg to fix a security vulnerability: The Iterator implementation mishandles destructors, leading to a double free CVE-2021-25900...
MGASA-2021-0229 Updated lz4 packages fix a security vulnerability
An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential...
MGASA-2021-0226 Updated libebml packages fix security vulnerabilities
Updated libebml packages fix security vulnerabilities: Heap use-after-free when parsing malformed file. A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and EbmlUnicodeString::ReadData in libebml CVE-2021-3405. The mkvtoolnix,...
MGASA-2021-0236 Updated firefox packages fix a security vulnerability
Updated firefox packages fix a security vulnerability: Mozilla developers Gabriele Svelto, Anny Gakhokidze, Alexandru Michis, Christian Holler reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with...
MGASA-2021-0232 Updated libxml2 packages fix a security vulnerability
Exponential entity expansion attack bypasses all existing protection mechanisms. CVE-2021-3541...
MGASA-2021-0225 Updated kernel-linus packages fix security vulnerability
This kernel-linus update is based on upstream 5.10.41 and fixes at least the following security issue: kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations. This can be abused to perform out-of-bounds reads and writes in kernel memor...
MGASA-2021-0224 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.41 and fixes at least the following security issues: A double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash...
MGASA-2021-0223 Updated ceph packages fix a security vulnerability
Updated ceph packages fix security vulnerability on rgw CVE-2021-3524 as well as CVE-2021-3509 and CVE-2021-3531 from which Mageia was not affected...
MGASA-2021-0222 Updated wireshark packages fix a security vulnerability
The MS-WSP dissector could consume excessive amounts of memory CVE-2021-22207...
MGASA-2021-0220 Updated bind packages fix security vulnerabilities
A broken inbound incremental zone update IXFR can cause named to terminate unexpectedlyCVE-2021-25214. Mageia 7 version not affected. An assertion check can fail while answering queries for DNAME records that require the DNAME to be processed to resolve itself CVE-2021-25215. This affects both...
MGASA-2021-0221 Updated postgresql packages fix security vulnerabilities
Buffer overrun from integer overflow in array subscripting calculations CVE-2021-32027. Memory disclosure in INSERT ... ON CONFLICT ... DO UPDATE. CVE-2021-32028. Memory disclosure in partitioned-table UPDATE ... RETURNING. CVE-2021-32029...
MGASA-2021-0218 Updated mediawiki packages fix security vulnerabilities
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML SML source file, as demonstrated by input that only contains the "exception" keyword CVE-2021-20270. A deadlock vulnerability was found in...
MGASA-2021-0219 Updated libx11 packages fix a security vulnerability
XLookupColor and other X libraries function lack proper validation of the length of their string parameters. If those parameters can be controlled by an external application for instance a color name that can be emitted via a terminal control sequence it can lead to the emission of extra X protoc...
MGASA-2021-0216 Updated openjpeg2 packages fix a security vulnerability
There is a flaw in the opj2compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The...
MGASA-2021-0217 Updated thunderbird packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Thunderbird stored OpenPGP secret keys without master password protection CVE-2021-29956. Partial protection of inline OpenPGP message not indicated CVE-2021-29957...
MGASA-2021-0213 Updated libxml2 packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Use-after-free in xmlEncodeEntitiesInternal in entities.c. CVE-2021-3516 Heap-based buffer overflow in xmlEncodeEntitiesInternal in entities.c. CVE-2021-3517 Use-after-free in xmlXIncludeDoProcess in xinclude.c. CVE-2021-3518 NULL pointer...
MGASA-2021-0214 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.37 and fixes at least the following security issues: It was discovered that the iouring implementation of the Linux kernel did not properly enforce the MAXRWCOUNT limit in some situations. A local attacker could use this to cause a denial of service...
MGASA-2021-0215 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.10.37 and fixes at least the following security issues: It was discovered that the iouring implementation of the Linux kernel did not properly enforce the MAXRWCOUNT limit in some situations. A local attacker could use this to cause a denial of...
MGASA-2021-0212 Updated avahi packages fix a security vulnerability
Avoid infinite loop by handling HUP event in clientwork. CVE-2021-3468...
MGASA-2021-0210 Updated pngcheck packages fix a security vulnerability
This update fixes a divide-by-zero crash bug and probable vulnerability in interlaced images with extra compressed data beyond the nominal end of the image data. found by "chiba of topsec alpha lab" rhbz1949800...
MGASA-2021-0209 Updated nagios packages fix a security vulnerability
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files CVE-2020-13977...
MGASA-2021-0211 Updated mariadb packages fix security vulnerabilities
Some severe exploitable vulnerabilities were discovered and fixed CVE-2021-2154 and CVE-2021-2166. This is a regular update, which brings the usual improvements in innodb, galera. See upstream advisory...
MGASA-2021-0206 Updated pagure packages fix a security vulnerability
Pagure before 5.6 allows XSS via the templates/blame.html blame view...
MGASA-2021-0207 Updated ceph packages fix a security vulnerability
An authentication flaw was found in ceph. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated with another user, as ceph...
MGASA-2021-0208 Updated messagelib packages fix security vulnerability
Deleting an attachment of a decrypted encrypted message stored on a remote server e.g. an IMAP server causes KMail to upload the decrypted content of the message to the remote server. This is not easily noticeable by the user because KMail does not display the decrypted content. With a specially...
MGASA-2021-0205 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.10.33 and fixes at least the following security issues: A race condition in Linux kernel SCTP sockets net/sctp/socket.c before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If...
MGASA-2021-0204 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.33 and fixes at least the following security issues: A race condition in Linux kernel SCTP sockets net/sctp/socket.c before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If...
MGASA-2021-0203 Updated nvidia-current packages fix security vulnerabilities
Updated nvidia-current packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. NVIDIA GPU Display...
MGASA-2021-0202 Updated nvidia390 packages fix security vulnerabilities
Updated nvidia390 packages fix security vulnerabilities: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer nvidia.ko where improper access control may lead to denial of service, information disclosure, or data corruption CVE-2021-1076. It also fixes a bug where...
MGASA-2021-0201 Updated sdl2 packages fix security vulnerabilities
This update fixes two security vulnerabilities which could result in heap corruption or over-read with crafted .BMP files CVE-2020-14409, CVE-2020-14410...
MGASA-2021-0200 Updated qtbase5 packages fix security vulnerability
QSslSocket incorrectly calls SSLshutdown in OpenSSL mid-handshake causing denial of service in TLS applications CVE-2020-13962 This update provides additionals fixes: - Check that the sizes are even representable when checking if clipping is necessary P300 - Multiply instead of shifting, The shif...
MGASA-2021-0198 Updated thunderbird packages fix security vulnerabilities
More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine CVE-2021-23961. Out of...
MGASA-2021-0199 Updated firefox packages fix security vulnerabilities
More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine CVE-2021-23961. Out of...
MGASA-2021-0196 Updated krb5-appl packages fix security vulnerabilities
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned only directory traversa...
MGASA-2021-0195 Updated connman packages fix security vulnerabilities
A remote information leak vulnerability and a remote buffer overflow vulnerability were discovered in ConnMan, which could result in denial of service or the execution of arbitrary code CVE-2021-26675, CVE-2021-26676...
MGASA-2021-0197 Updated virtualbox packages fix security vulnerabilities
This update provides the upstream 6.1.20 maintenance release that fixes at least the following security vulnerabilities: A difficult to exploit vulnerability in the Oracle VM VirtualBox component: Core prior to 6.1.20 allows high privileged attacker with logon to the infrastructure where Oracle V...
MGASA-2021-0193 Updated python3 packages fix security vulnerability
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to...
MGASA-2021-0194 Updated clamav packages fix security vulnerability
The updated packages fix a security vulnerability: A vulnerability in the email parsing module in Clam AntiVirus ClamAV Software version 0.103.1 and all prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability i...
MGASA-2021-0191 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.10.30 and fixes at least the following security issues: nfc: fix refcount leak in llcpsockbind CVE-2020-25670 nfc: fix refcount leak in llcpsockconnect CVE-2020-25671 nfc: fix memory leak in llcpsockconnect CVE-2020-25672 firewire: nosy: Fix a...
MGASA-2021-0192 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.30 and fixes at least the following security issues: nfc: fix refcount leak in llcpsockbind CVE-2020-25670 nfc: fix refcount leak in llcpsockconnect CVE-2020-25671 nfc: fix memory leak in llcpsockconnect CVE-2020-25672 firewire: nosy: Fix a...
MGASA-2021-0188 Updated chromium-browser-stable package fixes security vulnerabilities
The updated packages fix security vulnerabilities and a crash when a device does some cast traffic in the local network. See upstream release notes...