Everything
CPAN 2.28 allows Signature Verification Bypass. (CVE-2020-16156) References: – https://bugs.mageia.org/show_bug.cgi?id=29878 – https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
This update provides Mbed TLS 2.16.12, with a number of bug fixes and a security fix. Mbed TLS has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. (CVE-2021-44732)
A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp. (CVE-2021-3997) References:
CWE-122 Heap-based Buffer Overflow (CVE-2021-4136) CWE-125 Out-of-bounds Read (CVE-2021-4166) CWE-416 Use After Free (CVE-2021-4173) CWE-416 Use After Free (CVE-2021-4187)
Buffer overflow vulnerability in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp. (CVE-2021-40985) References:
security update
The 5.15.14 stable kernel update contains a number of important fixes across the tree.
Is loyalty fraud on your radar? Here’s why your hard-earned reward points and air miles may be easy pickings for cybercriminals. The post Making loyalty pay: How to keep your loyalty rewards safe from scammers appeared first on WeLiveSecurity
kernel: perf_event_parse_addr_filter memory (CVE-2020-25704) * kernel: fuse: fuse_do_getattr() calls make_bad_inode() in inappropriate situations (CVE-2020-36322) * kernel: Heap buffer overflow in firedtv driver (CVE-2021-42739) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * [More…]
An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
An update for samba is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
An update is now available for ansible-runner for Red Hat Ansible Automation Platform 2.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
Security fix for CVE-2021-46059, CVE-2022-0158, CVE-2022-0156
security update
security update
Security fix for CVE-2021-41500. Upstream notes for version 1.2.7 read: “Bug fixes, Python 3.10 compatibility”.
As you attempt to strike it rich in the digital gold rush, make sure you know how to recognize various schemes that want to part you from your digital coins The post Cryptocurrency scams: What to know and how to protect yourself appeared first on WeLiveSecurity
The following updated rpms for Oracle Linux 7 have been uploaded to the Unbreakable Linux Network:
This update upgrades Thunderbird to version 91.5.0. * Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140) * Mozilla: Race condition when playing audio files (CVE-2022-22737) * Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738) * Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740) * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741) [More…]
This update upgrades Firefox to version 91.5.0 ESR. * Mozilla: Iframe sandbox bypass with XSLT (CVE-2021-4140) * Mozilla: Race condition when playing audio files (CVE-2022-22737) * Mozilla: Heap-buffer-overflow in blendGaussianBlur (CVE-2022-22738) * Mozilla: Use-after-free of ChannelEventQueue::mOwner (CVE-2022-22740) * Mozilla: Browser window spoof using fullscreen mode (CVE-2022-22741) [More…]
Several security issues were fixed in Pillow.
Several security issues were fixed in Ghostscript.
Apache Log4j 1.2 could be made to crash or run programs if it received specially crafted input.
security update
security update
We don’t need no stinkin’ wall power as CES shows off the power and promise of usable long-range wireless charging The post CES 2022: Wireless power for all appeared first on WeLiveSecurity
ESET researchers look at malware that abuses vulnerabilities in kernel drivers and outline mitigation techniques against this type of exploitation The post Signed kernel drivers – Unguarded gateway to Windows’ core appeared first on WeLiveSecurity
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize HTML messages. This would allow an attacker to perform Cross-Site Scripting (XSS) attacks.
An update that fixes two vulnerabilities is now available.
lxml could be made to execute arbitrary code if it received a specially crafted XML or HTML file.
Several security issues were fixed in Ghostscript.
Two issues were found in GDAL, a geospatial library, that could lead to denial of service via application crash or possibly the execution of arbitrary code if maliciously crafted data was parsed.
openssl: Read buffer overruns processing ASN.1 strings (CVE-2021-3712) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 openssl-1.0.2k-23.el7_9.x86_64.rpm openssl-debuginfo-1.0.2k-23.el7_9.i686.rpm openssl-debuginfo-1.0.2k-23.el7_9.x86_64.rpm openssl-libs-1.0.2k-23.e [More…]
But as we learned in mashing up other technologies, the security devil is in the details The post CES 2022 – the “anyone can make an electric car” edition appeared first on WeLiveSecurity
An update that solves two vulnerabilities, contains one feature and has 13 fixes is now available.
An update that fixes one vulnerability is now available.
Introduced regression Exiv2.
An update that solves one vulnerability and has two fixes is now available.
Several vulnerabilities were discovered in WordPress, a web blogging tool. They allowed remote attackers to perform SQL injection, run unchecked SQL queries, bypass hardening, or perform Cross-Site Scripting (XSS) attacks.
Use-after-free in sampled_data_sample (called from sampled_data_continue and interp). (CVE-2021-45944) Heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). (CVE-2021-45949)
security update