Mcafee, Llc Security Vulnerabilities

openSUSE Security Update : libcomps (openSUSE-2019-323)

This update for libcomps fixes the following issue: Security issue fixed : CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function where could allow to application crash or code execution ...

CVE-2021-47572

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: fix null pointer dereference when IPv6 is not enabled When we try to add an IPv6 nexthop and IPv6 is not enabled (!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the error path of nh_create_ipv6() due to...

openSUSE Security Update : git-annex (openSUSE-2019-497)

This update for git-annex to version 6.20180626 fixes the following issues : CVE-2018-10857: Prevent file content disclosure by refusing to download content that cannot be verified with a hash, from encrypted special remotes and glacier (bsc#1098062). CVE-2018-10859: Prevent local...

openSUSE Security Update : ovmf (openSUSE-2019-563)

This update for ovmf fixes the following issues : Security issues fixed : CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094289). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : rubygem-loofah (openSUSE-2019-963)

This update for rubygem-loofah fixes the following issues : Security issue fixed : CVE-2018-16468: Fixed XXS by removing the svg animate attribute from from the allowlist (bsc#1113969). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : sddm (openSUSE-2019-594)

This update for sddm fixes the following issues : The following security vulnerability was addressed : CVE-2018-14345: Fixed the authentication, which did not check the password for users with an already existing session and allowed any user with access to the system bus to unlock any...

openSUSE Security Update : zsh (openSUSE-2019-687)

This update for zsh to version 5.6 fixes the following security issues : CVE-2018-0502: The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line (bsc#1107296). CVE-2018-13259: Shebang lines exceeding 64 characters ...

openSUSE Security Update : apache2-mod_jk (openSUSE-2019-970)

This update for apache2-mod_jk fixes the following issue : Security issue fixed : CVE-2018-11759: Fixed connector path traversal due to mishandled HTTP requests in httpd (bsc#1114612). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : redis (openSUSE-2019-481)

This update for redis to 4.0.10 fixes the following issues : These security issues were fixed : CVE-2018-11218: Prevent heap corruption vulnerability in cmsgpack (bsc#1097430). CVE-2018-11219: Prevent integer overflow in Lua scripting (bsc#1097768). For Leap 42.3 and openSUSE SLE 12...

openSUSE Security Update : openssh (openSUSE-2019-93)

This update for openssh fixes the following issues : Security issue fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote...

openSUSE Security Update : wireshark (openSUSE-2019-92)

This update for wireshark to version 2.4.12 fixes the following issues : Security issues fixed : CVE-2019-5717: Fixed a denial of service in the P_MUL dissector (bsc#1121232) CVE-2019-5718: Fixed a denial of service in the RTSE dissector and other dissectors (bsc#1121233) ...

openSUSE Security Update : jhead (openSUSE-2019-858)

This update for jhead fixes the following issues : Security issues fixed : CVE-2018-17088: The ProcessGpsInfo function may have allowed a remote attacker to cause a denial-of-service attack or unspecified other impact via a malicious JPEG file, because there is an integer overflow...

openSUSE Security Update : soundtouch (openSUSE-2019-782)

This update for soundtouch fixes the following security issue : CVE-2018-1000223: Prevent buffer overflow in WavInFile::readHeaderBlock() that could have resulted in arbitrary code execution when opening maliocius file in soundstretch utility (bsc#1103676) This update was imported...

openSUSE Security Update : Mozilla Firefox (openSUSE-2019-763)

This update for Mozilla Firefox to version 60.2.2esr contains the following security fixes (MFSA 2018-24) : CVE-2018-12386: Type confusion in JavaScript allowed remote code execution (bsc#1110506) CVE-2018-12387: Array.prototype.push stack pointer vulnerability may enable exploits in...

CVE-2023-52743

In the Linux kernel, the following vulnerability has been resolved: ice: Do not use WQ_MEM_RECLAIM flag for workqueue When both ice and the irdma driver are loaded, a warning in check_flush_dependency is being triggered. This is due to ice driver workqueue being allocated with the WQ_MEM_RECLAIM...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2024-517)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-517 advisory. 2024-06-06: CVE-2023-52498 was added to this advisory. 2024-06-06: CVE-2023-52489 was added to this advisory. 2024-06-06: CVE-2024-26614 was added to this advisory. 2024-06-06: CVE-2023-52486...

openSUSE Security Update : openssl-1_1 (openSUSE-2019-152)

This update for openssl-1_1 fixes the following issues : Security issues fixed : The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations (bsc#1117951) Fix FIPS RSA generator (bsc#1118913) This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : curl (openSUSE-2019-173)

This update for curl fixes the following issues : Security issues fixed : CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378). CVE-2019-3822: Fixed a stack based buffer overflow in the function creating an outgoing NTLM...

CVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The...

openSUSE Security Update : libssh (openSUSE-2019-806)

This update for libssh fixes the following issues : CVE-2018-10933: Fixed a server mode authentication bypass (bsc#1108020). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : opencv (openSUSE-2019-436)

This update for opencv fixes this security issue : CVE-2017-18009: Prevent heap-based buffer over-read in the function cv::HdrDecoder::checkSignature ...

openSUSE Security Update : keepalived (openSUSE-2019-1008)

This update for keepalived to version 2.0.10 fixes the following issues : Security issues fixed (bsc#1015141) : CVE-2018-19044: Fixed a check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats CVE-2018-19045: Fixed mode when...

openSUSE Security Update : ntp (openSUSE-2019-856)

NTP was updated to 4.2.8p12 (bsc#1111853) : CVE-2018-12327: Fixed stack-based buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531) CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection...

openSUSE Security Update : runc (openSUSE-2019-208)

This update for runc fixes the following issues : Security vulnerablities addressed : CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967) CVE-2018-16873: Fix a remote...

openSUSE Security Update : pango (openSUSE-2019-707)

This update for pango fixes the following issue : Security issue fixed : CVE-2018-15120: Fixed a denial of service when parsing emoji (bsc#1103877) This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : nodejs8 (openSUSE-2019-513)

This update for nodejs8 to version 8.11.3 fixes the following issues : These security issues were fixed : CVE-2018-7167: Calling Buffer.fill() or Buffer.alloc() with some parameters could have lead to a hang which could have resulted in a DoS (bsc#1097375). CVE-2018-7161: By...

openSUSE Security Update : tor (openSUSE-2019-1107)

This update for tor to version 0.3.4.11 fixes the following issues : Security issue fixed : CVE-2019-8955: Fixed a vulnerability in the KIST cell scheduler which could lead to memory exhaustion and finally Denial-of-Service...

openSUSE Security Update : lftp (openSUSE-2019-1110)

This update for lftp fixes the following issues: Security issue fixed : CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed : The SSH login handling code detects password prompts ...

CVE-2022-34965

OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Note: The project owner believes this.....

openSUSE Security Update : pdns-recursor (openSUSE-2019-988)

This update for pdns-recursor fixes the following issues : Security issues fixed : CVE-2018-10851: Fixed denial of service via crafted zone record or crafted answer (bsc#1114157). CVE-2018-14644: Fixed denial of service via crafted query for meta-types (bsc#1114170). CVE-2018-14626:...

openSUSE Security Update : mercurial (openSUSE-2019-541)

This update for mercurial fixes the following issues : Security issues fixed : CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354). CVE-2018-13347: Fix mpatch.c that...

openSUSE Security Update : ovmf (openSUSE-2019-348)

This update for ovmf fixes the following issues : Security issues fixed : CVE-2018-12180: Fixed a buffer overflow in BlockIo service, which could lead to memory read/write overrun (bsc#1127820). CVE-2018-12178: Fixed an improper DNS check upon receiving a new DNS packet...

openSUSE Security Update : ucode-intel (openSUSE-2019-510) (Spectre)

This update for ucode-intel fixes the following issues : The microcode bundles was updated to the 20180703 release For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and helps mitigating CVE-2018-3639 (Spectre v4) (bsc#1100147 bsc#1087082 bsc#1087083). More information on:...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-676)

This update to Mozilla Firefox 60.2.0esr fixes the following issues : Security issues fixed (MFSA 2018-21, boo#1107343) : CVE-2018-12377: Use-after-free in refresh driver timers CVE-2018-12378: Use-after-free in IndexedDB CVE-2017-16541: Proxy bypass using automount and autofs ...

openSUSE Security Update : otrs (openSUSE-2019-973)

This update for otrs fixes the following issues : Update to version 4.0.33. Security issues fixed : CVE-2018-19141: Fixed privilege escalation, that an attacker who is logged into OTRS as an admin user cannot manipulate the URL to cause execution of JavaScript in the context of...

CVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The...

openSUSE Security Update : ntp (openSUSE-2019-1143)

This update for ntp fixes the following issues : Security issue fixed: CVE-2019-8936: Fixed a NULL pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd (bsc#1128525). Other issues addressed : Fixed several bugs in the BANCOMM reclock...

openSUSE Security Update : lftp (openSUSE-2019-1059)

This update for lftp fixes the following issues : Security issue fixed : CVE-2018-10916: Fixed an improper file name sanitization which could lead to loss of integrity of the local system (bsc#1103367). Other issue addressed : The SSH login handling code detects password prompts ...

openSUSE Security Update : openslp (openSUSE-2019-514)

This update for openslp fixes the following issues : CVE-2017-17833: Prevent heap-related memory corruption issue which may have manifested itself as a denial-of-service or a remote code-execution vulnerability (bsc#1090638) Prevent out of bounds reads in message parsing This...

openSUSE Security Update : GraphicsMagick (openSUSE-2019-214)

This update for GraphicsMagick fixes the following issues : Security issue fixed : CVE-2019-7397: Fixed a Memory leak in WritePDFImage function in pdf.c...

openSUSE Security Update : lcms2 (openSUSE-2019-880)

This update for lcms2 fixes the following issues : CVE-2018-16435: Heap-based buffer overflow via a crafted file in the second argument to cmsIT8LoadFromFile (bsc#1108813) This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : bitcoin (openSUSE-2019-731)

This update for bitcoin to version 0.16.3 fixes the following issues : CVE-2018-17144: Prevent remote denial of service (application crash) exploitable by miners via duplicate input (bsc#1108992). For additional changes please check the...

openSUSE Security Update : accountsservice (openSUSE-2019-902)

This update for accountsservice fixes the following issues : This security issue was fixed : CVE-2018-14036: Prevent directory traversal caused by an insufficient path check in user_change_icon_file_authorized_cb() (bsc#1099699) Thsese non-security issues were fixed : Don't abort...

openSUSE Security Update : exiv2 (openSUSE-2019-816)

This update for exiv2 fixes the following issues : exiv2 was updated to latest 0.26 branch, fixing bugs and security issues : CVE-2018-12264, CVE-2018-12265: Integer overflows in the LoaderExifJpeg class could lead to memory corruption ...

openSUSE Security Update : gitolite (openSUSE-2019-754)

This update for gitolite fixes the following issues : Gitolite was updated to 3.6.9 : CVE-2018-16976: prevent racy access to repos in process of migration to gitolite (boo#1108272) 'info' learns new '-p' option to show only physical repos (as opposed to wild repos) The update to...

openSUSE Security Update : libwpd (openSUSE-2019-955)

This update for libwpd fixes the following issues : Security issue fixed : CVE-2018-19208: illegal address access inside libwpd at function WP6ContentListener:defineTable (bsc#1115713). This update was imported from the SUSE:SLE-15:Update update...

openSUSE Security Update : nodejs6 (openSUSE-2019-234)

This update for nodejs6 to version 6.16.0 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652) CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka 'PortSmash') (bsc#1113534) ...

openSUSE Security Update : go1.11 (openSUSE-2019-1164)

This update for go1.11 to version 1.11.5 fixes the following issues : Security issue fixed : CVE-2019-6486: Fixed a CPU Denial-of-Service vulnerability affecting crypto/ellpitic related to P-521 and P-384 (bsc#1123013 go#29903). Other bug fixes and changes made : Fix erroneous trailing...

CVE-2023-52743 ice: Do not use WQ_MEM_RECLAIM flag for workqueue

In the Linux kernel, the following vulnerability has been resolved: ice: Do not use WQ_MEM_RECLAIM flag for workqueue When both ice and the irdma driver are loaded, a warning in check_flush_dependency is being triggered. This is due to ice driver workqueue being allocated with the WQ_MEM_RECLAIM...

openSUSE Security Update : openssh (openSUSE-2019-91)

This update for openssh fixes the following issues : Security issues fixed : CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571) CVE-2019-6109: Fixed an issue where the scp client would allow malicious...