OpenJDK: Incorrect comparison during range check elimination (Hotspot, 8264066) (CVE-2021-2388) * OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host (Networking, 8258432) (CVE-2021-2341) * OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files (Library, 8260967) (CVE-2021-2369) For more details about the security issue(s), including the [More…]

An update that fixes 8 vulnerabilities is now available.

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

* Update to upstream 20210716 release * update NXP 8897/8997 firmware images * rtlwifi: de-dupe rtl8723b/rtl8192e SDIO/USB WiFi firmware * Mediatek: update WiFi/bluetooth chip (MT7921) * Mediatek: update MT7915 firmware to 20201105 * Mellanox: Add new mlxsw_spectrum firmware xx.2008.2946 * cxgb4: Update firmware to revision 1.26.0.0 * firmware/i915/guc: Add HuC v7.9.3 for TGL & DG1 […]

This update upgrades Thunderbird to version 78.12.0. * Mozilla: IMAP server responses sent by a MITM prior to STARTTLS could be processed (CVE-2021-29969) * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970) * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976) * chromium-browser: Out of bounds write in ANGLE […]

Aspell could be made to execute arbitrary code or cause a crash if it received a specially crafted input.

An update is now available for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

Several security issues were fixed in MySQL.

This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for security vulnerabilities which could result in privilege escalation in combination with VT-d and various side channel attacks.

Several security issues were fixed in the kernel.

An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution (CVE-2021-29477). An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require(‘y18n’)(); y18n.setLocale(‘__proto__’); y18n.updateLocale({polluted: true}); console.log(polluted); // true (CVE-2020-7774).

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository (CVE-2021-3572). The bundled python-urllib3 was also vulnerable to:

In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream (CVE-2021-21341).

It was discovered that the previous upload of the package rabbitmq-server versioned 3.6.6-1+deb9u1 introduced a regression in function fmt_strip_tags. Big thanks to Christoph Haas for the reporting an issue and for testing the update.

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method (CVE-2021-27918).

The container suse-sles-15-sp2-chost-byos-v20210722-gen2 was updated. The following patches have been included in this update:

An update that solves one vulnerability and has one errata is now available.

Multiple vulnerabilities have been found in libsdl2, the worst of which could result in a Denial of Service condition.

Multiple vulnerabilities have been found in libyang, the worst of which could result in a Denial of Service condition.

Multiple vulnerabilities have been found in Leptonica, the worst of which could result in a Denial of Service condition.

Security fix for CVE-2021-3602 bump podman to v3.2.3 include podman-machine- cni in podman-plugins subpackage bump crun to 0.20.1 —- Fix `secrets` definition in /usr/share/containers/containers.conf

The container sles-15-sp2-chost-byos-v20210722 was updated. The following patches have been included in this update:

The container suse-sles-15-sp2-chost-byos-v20210722-hvm-ssd-x86_64 was updated. The following patches have been included in this update:

Several vulnerabilities were discovered in lemonldap-ng, a Web-SSO system. The flaws could result in information disclosure, authentication bypass, or could allow an attacker to increase its authentication level or impersonate another user, especially when lemonldap-ng is configured

Multiple vulnerabilities have been found in Apache Velocity, the worst of which could result in the arbitrary execution of code.

Multiple vulnerabilities have been found in IcedTeaWeb, the worst of which could result in the arbitrary execution of code.

– fix TELNET stack contents disclosure again (CVE-2021-22925) – fix bad connection reuse due to flawed path name checks (CVE-2021-22924) – disable metalink support to fix the following vulnerabilities CVE-2021-22923 – metalink download sends credentials CVE-2021-22922 – wrong content via metalink not discarded

The package jre-openjdk before version 16.0.2.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure.

The package jre-openjdk-headless before version 16.0.2.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure.

The package lib32-libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation.

The package libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation.

The package lib32-libcurl-compat before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation.

The package libcurl-compat before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation.

Several security issues were fixed in Ruby.

An update that solves 13 vulnerabilities and has 5 fixes is now available.

An update that solves one vulnerability, contains one feature and has 5 fixes is now available.

Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0 to 3.2.14 allows denial of service via packet injection or crafted capture file (CVE-2021-22235). References:

perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input (CVE-2013-7488). References:

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact

Several security issues were fixed in systemd.

The Qualys Research Labs discovered that an attacker-controlled allocation using the alloca() function could result in memory corruption, allowing to crash systemd and hence the entire operating system.

The Qualys Research Labs discovered that an attacker-controlled allocation using the alloca() function could result in memory corruption, allowing to crash systemd and hence the entire operating system.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

An integer overflow flaw was found in glibc that may result in reading of arbitrary memory when wordexp is used with a specially crafted untrusted regular expression input (CVE-2021-35942). References:

This update provides Mbed TLS 2.16.11, with a number of bug fixes, including security fixes. The intermediate version 2.16.10 are included security fixes. See the referenced release notes and advisories for details.

An update that fixes one vulnerability is now available.

An update that fixes one vulnerability is now available.

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. CVE-2021-30547

An update that fixes three vulnerabilities is now available.

An update that solves one vulnerability and has one errata is now available.

An update for nettle is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the stable distribution (buster), these problems have been fixed in

Multiple vulnerabilities have been found in Dovecot, the worst of which could result in a Denial of Service condition.

New upstream version (90.0) Disabled Wayland on KDE by default due to popup bugs.

Fix crash in ThemeService (thanks to OpenSUSE) —- Security fixes. CVE-2021-30506 CVE-2021-30507 CVE-2021-30508 CVE-2021-30509 CVE-2021-30510 CVE-2021-30511 CVE-2021-30512 CVE-2021-30513 CVE-2021-30514 CVE-2021-30515 CVE-2021-30516 CVE-2021-30517 CVE-2021-30518 CVE-2021-30519 CVE-2021-30520 CVE-2021-30521 CVE-2021-30522 CVE-2021-30523 CVE-2021-30524 CVE-2021-30525

An update that contains security fixes can now be installed.

An update that contains security fixes can now be installed.

Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition.

Multiple vulnerabilities have been found in Apache Commons FileUpload, the worst of which could result in a Denial of Service condition.

Multiple vulnerabilities have been found in Apache, the worst of which could result in a Denial of Service condition.

The package vivaldi before version 4.0.2312.41-1 is vulnerable to arbitrary code execution.

The package chromium before version 91.0.4472.164-1 is vulnerable to arbitrary code execution.

The package systemd before version 249-2 is vulnerable to denial of service.

The package varnish before version 6.6.1-1 is vulnerable to url request injection.

The package mbedtls before version 2.26.0-1 is vulnerable to information disclosure.

The package python-pillow before version 8.3.0-1 is vulnerable to arbitrary code execution.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes

Several vulnerabilities were discovered in php5, a server-side, HTML-embedded scripting language. An attacker could cause denial of service (DoS), memory corruption and potentially execution of arbitrary code, and server-side request forgery (SSRF) bypass.

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An update for firefox is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

Red Hat OpenShift Container Platform release 4.6.38 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.6.

Multiple vulnerabilities have been found in Pillow, the worst of which could result in a Denial of Service condition.

An update that solves 14 vulnerabilities, contains one feature and has 5 fixes is now available.

Multiple vulnerabilities have been found in Apache Thrift, the worst of which could result in a Denial of Service condition.

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service (CVE-2021-3200).

This update provides ffmpeg version 4.3.2, which fixes several security vulnerabilities and other bugs which were corrected upstream. References: – https://bugs.mageia.org/show_bug.cgi?id=28433

Release of OpenShift Serverless Client kn 1.16.0 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from

An update that fixes one vulnerability is now available.

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which