6291 matches found
MGASA-2021-0140 Updated microcode package fixes security vulnerabilities
This update adds new microcode updates to mitigate CVE-2020-8696 for Intel Skylake server 50654 and Cascade Lake Server 50656 & 50657 processors. The new microcode update mitigates an issue when using an active JTAG agent like In Target Probe ITP, Direct Connect Interface DCI or a Baseboard...
MGASA-2021-0138 Updated glibc packages fix a security vulnerability
Updated glibc packages fix a security vulnerability: The nameserver caching daemon nscd, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system CVE-2021-27645...
MGASA-2021-0136 Updated netty packages fix a security vulnerability
When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled CVE-2021-21290...
MGASA-2021-0133 Updated quartz packages fix a security vulnerability
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description CVE-2019-13990...
MGASA-2021-0134 Updated mediainfo packages a fix security vulnerability
In MediaInfoLib in MediaArea MediaInfo 20.03, there is a stack-based buffer over-read in StreamsFillPerStream in Multiple/FileMpegPs.cpp aka an off-by-one during MpegPs parsing CVE-2020-15395...
MGASA-2021-0135 Updated python-django package fixes a security vulnerability
Django contains a copy of urllib.parse.parseqsl which was added to backport some security fixes to prevent web cache poisoning. A further security fix has been issued recently such that parseqsl no longer allows using ; as a query parameter separator by default CVE-2021-23336...
MGASA-2021-0137 Updated git packages fix a security vulnerability
On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters such as Git LFS, Git could be fooled into running remote code during a clone CVE-2021-21300...
MGASA-2021-0125 Updated mumble packages fix a security vulnerability
Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text CVE-2021-27229...
MGASA-2021-0120 Updated firejail package fixes a security vulnerability
Roman Fiedler discovered a vulnerability in the OverlayFS code in firejail, which could result in root privilege escalation. This update disables OverlayFS support in firejail CVE-2021-26910...
MGASA-2021-0130 Updated roundcubemail package fixes security vulnerability
This update fixes cross-site scripting XSS via HTML messages with malicious CSS content CVE-2021-26925...
MGASA-2021-0126 Updated ceph packages fix security vulnerabilities
A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...
MGASA-2021-0132 Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. The bitbucketpipelinevariable module exposed secured values CVE-2021-20180. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been updated to version 2.9.18...
MGASA-2021-0123 Updated glib2.0 packages fix security vulnerabilities
Fix various instances within GLib where gmemdup was vulnerable to a silent integer truncation and heap overflow problem discovered by Kevin Backhouse, work by Philip Withnall 2319 Fix some issues with handling over-long invalid input when parsing for GDate !1824 Don't load GIO modules or parse...
MGASA-2021-0131 Updated ansible packages fix security vulnerability
User data leak in snmpfacts module CVE-2021-20178. Multiple collections exposed secured values CVE-2021-20191. In basic.py, nolog with fallback option CVE-2021-20228. The ansible package has been patched to fix these issues...
MGASA-2021-0121 Updated postgresql packages fix security vulnerabilities
A user having an UPDATE privilege on a partitioned table but lacking the SELECT privilege on some column may be able to acquire denied-column values from an error message CVE-2021-3393. A user having a SELECT privilege on an individual column can craft a special query that returns all columns of...
MGASA-2021-0118 Updated openssh packages fix a security vulnerability
The client side in OpenSSH 5.7 through 8.3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts where no host key for the server has been cached by the client CVE-2020-14145...
MGASA-2021-0128 Updated libcaca packages fix a security vulnerability
A buffer overflow issue in cacaresize function in libcaca/caca/canvas.c may lead to local execution of arbitrary code in the user context CVE-2021-3410...
MGASA-2021-0124 Updated ruby-mechanize packages fix a security vulnerability
In Mechanize, from v2.0.0 until v2.7.7, there is a command injection vulnerability. Affected versions of Mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernelopen method CVE-2021-21289...
MGASA-2021-0127 Updated gnuplot packages fix a security vulnerability
Double free when executing printsetoutput CVE-2020-25559. Additionally, a missing require for gnuplot has been added to gnuplot-qt package...
MGASA-2021-0122 Updated python-httplib2 packages fix a security vulnerability
A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service CPU burn while parsing header of the httplib2 client accessing said server CVE-2021-21240...
MGASA-2021-0129 Updated python-cryptography package fixes a security vulnerability
In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow CVE-2020-36242...
MGASA-2021-0119 Updated python-yaml packages fix security vulnerability
A vulnerability was discovered in the PyYAML library, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw...
MGASA-2021-0116 Updated cups packages fix a security vulnerability
The updated cups packages fix security vulnerability: Out-of-bounds read in the ippReadIO function CVE-2020-10001...
MGASA-2021-0117 Updated kernel packages fix security issues and possible filesystem corruption
This kernel update is based on upstream 5.10.20 and fixes at least the following security issues: A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRMIOCTLNOUVEAUCHANNELALLOC. This flaw...
MGASA-2021-0114 Updated python-pygments packages fix a security vulnerability
Infinite loop in SML lexer may lead to DoS. When the SMLLexer gets fed the string "exception" it seems to loop indefinitely rhbz1922136...
MGASA-2021-0115 Updated pngcheck packages fix security vulnerabilities
This update fixes a buffer-overrun bug related to the MNG LOOP chunk which gets noticed even in PNG files if the -s option is used. RHBZ1908559. It also fixes a buffer overrun for certain invalid MNG PPLT chunk contents. RHBZ1907428...
MGASA-2021-0109 Updated screen packages fix security vulnerability
Felix Weinmann reported a flaw in the handling of combining characters in screen, which can result in denial of service, or potentially the execution of arbitrary code via a specially crafted UTF-8 character sequence CVE-2021-26937...
MGASA-2021-0106 Updated chromium-browser-stable packages fix security vulnerabilities
The updated packages fix security vulnerabilities...
MGASA-2021-0107 Updated webkit2 packages fix security vulnerabilities
The webkit2 package has been updated to version 2.30.5, fixing several security issues and other bugs...
MGASA-2021-0113 Updated jasper packages fix security vulnerability
jp2decode in jp2/jp2dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components CVE-2021-3272. A flaw was found in jasper. An out of bounds read issue was found in jp2decode function...
MGASA-2021-0112 Updated xpdf packages fix security vulnerabilities
In Xpdf 4.02, SplashOutputDev::endType3CharGfxState state SplashOutputDev.cc:3079 is trying to use the freed t3GlyphStack-cache, which causes an heap-use-after-free problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to...
MGASA-2021-0111 Updated gnome-autoar packages fix security vulnerability
Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside of the intended directory. If a user were tricked into extracting a specially crafted archive, a remote attacker could create files in arbitrary locations, possibly leading to code execution CVE-2020-36241...
MGASA-2021-0108 Updated openssl and compat-openssl10 packages fix security vulnerabilities
Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service CVE-2021-23840. Tavis Ormandy discovered that OpenSSL incorrectly handled parsing issuer...
MGASA-2021-0105 Updated openldap packages fix security vulnerabilities
It was discovered that OpenLDAP incorrectly handled Certificate Exact Assertion processing. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service CVE-2020-36221. It was discovered that OpenLDAP incorrectly handled saslAuthzTo processing. A...
MGASA-2021-0110 Updated bind packages fix security vulnerability
A buffer overflow vulnerability was discovered in the SPNEGO implementation affecting the GSSAPI security policy negotiation in BIND, which could result in denial of service daemon crash, or potentially the execution of arbitrary code CVE-2020-8625. The default configuration is not vulnerable to...
MGASA-2021-0097 Updated firefox packages fix security vulnerabilities
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs CVE-2021-23968. As specified in the W3C...
MGASA-2021-0103 Updated nonfree firmware packages fix security vulnerability
Updated nonfree firmwares fixees various issues, adds new / improved hardware support and fixes at least the following security issue: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a...
MGASA-2021-0096 Updated thunderbird packages fix security vulnerabilities
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs CVE-2021-23968. As specified in the W3C...
MGASA-2021-0104 Updated nonfree firmware packages fix security vulnerability
Updated nonfree firmwares fixees various issues, adds new / improved hardware support and fixes at least the following security issue: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors related to state transitions in a...
MGASA-2021-0099 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.19 and fixes at least the following security issues: There is a vulnerability in the linux kernel versions higher than 5.2 if kernel compiled with config params CONFIGBPFSYSCALL=y, CONFIGBPF=y, CONFIGCGROUPS=y, CONFIGCGROUPBPF=y, CONFIGHARDENEDUSERCOPY...
MGASA-2021-0100 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues: There is a vulnerability in the linux kernel versions higher than 5.2 if kernel compiled with config params CONFIGBPFSYSCALL=y, CONFIGBPF=y, CONFIGCGROUPS=y, CONFIGCGROUPBPF=y,...
MGASA-2021-0102 Updated kernel-linus packages fix security vulnerabilities
This kernel-linus update is based on upstream 5.10.19 and fixes at least the following security issues: An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory...
MGASA-2021-0101 Updated kernel packages fix security vulnerabilities
This kernel update is based on upstream 5.10.19 and fixes at least the following security issues: An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel. A userland application can read the contents of the sigpage, which can leak kernel memory contents. An...
MGASA-2021-0098 Updated libtiff packages fix security vulnerabilities
The updated libtiff packages fix security vulnerabilities: - Integer overflow in tifgetimage.c CVE-2020-35523. - Heap-based buffer overflow in TIFF2PDF tool CVE-2020-35524. - Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the “TIFFVGetField” funtion in the...
MGASA-2021-0094 Updated xterm package fixes security vulnerability
xterm through Patch 365 allows remote attackers to cause a denial of service segmentation fault or possibly have unspecified other impact via a crafted UTF-8 character sequence. CVE-2021-27135...
MGASA-2021-0093 Updated openjpeg2 packages fix security vulnerability
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as...
MGASA-2021-0095 Updated wpa_supplicant packages fix security vulnerability
A vulnerability was discovered in how p2p/p2ppd.c in wpasupplicant before 2.10 processes P2P Wi-Fi Direct provision discovery requests. It could result in denial of service or other impact potentially execution of arbitrary code, for an attacker within radio range CVE-2021-27803...
MGASA-2021-0090 Updated pix packages fix a security vulnerability
A heap-based buffer overflow in cairoimagesurfacecreatefromjpeg in extensions/cairoio/cairo-image-surface-jpeg.c in Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file CVE-2019-20326...
MGASA-2021-0092 Updated nodejs packages fix security vulnerabilities
Two vulnerabilities were discovered in Node.js, which could result in denial of service or DNS rebinding attacks. Upgrade from Mageia 7 to 8 problem fixed...