This update upgrades Firefox to version 78.14.0 ESR. * Mozilla: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1 (CVE-2021-38493) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 – firefox-78.14.0-1.el7_9.i686.rpm – firefox-78.14.0-1.el7_9.x86_64.r [More…]

An update that contains security fixes can now be installed.

Several security issues were fixed in the kernel.

Update to Chromium 93. There have been … a few security fixes since the last Fedora chromium update. This update fixes the following CVEs: CVE-2021-30565 CVE-2021-30566 CVE-2021-30567 CVE-2021-30568 CVE-2021-30569 CVE-2021-30571 CVE-2021-30572 CVE-2021-30573 CVE-2021-30574 CVE-2021-30575 CVE-2021-30576 CVE-2021-30577 CVE-2021-30578 CVE-2021-30579 CVE-2021-30580 CVE-2021-30581

It was found that the patch for CVE-2021-3592 introduced a regression which prevented ssh connections to the host system. Since there is no imminent solution for the problem, the patch for CVE-2021-3592 has been reverted. Updated qemu packages are now available to correct this issue.

Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. For the oldstable distribution (buster), this problem has been fixed

Firefox could be made to crash or run programs as your login if it opened a malicious website.

* New upstream version (92.0)

Update to latest upstream release 2.0.12

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

Ghostscript could be made to crash, access files, or run programs if it opened a specially crafted file.

It was discovered that Ghostscript, the GPL PostScript/PDF interpreter, does not properly validate access for the “%pipe%”, “%handle%” and “%printer%” io devices, which could result in the execution of arbitrary code if a malformed Postscript file is processed (despite the -dSAFER

Kevin Israel discovered that Postorius, the administrative web frontend for Mailman 3, didn’t validate whether a logged-in user owns the email address when unsubscribing.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code.

Update to CVE release 3003.3-1 https://saltproject.io/security_announcements/salt-security- advisory-2021-sep-02/ CVE-2021-21996 CVE-2021-22004 CVE-2021-31607

Build of libtpms 0.8.5

8u302 update

Update to CVE release 3003.3-1 https://saltproject.io/security_announcements/salt-security- advisory-2021-sep-02/ CVE-2021-21996 CVE-2021-22004 CVE-2021-31607

kernel: use-after-free in route4_change() in net/sched/cls_route.c (CVE-2021-3715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * [SL 7.8][s390x][DASD]Crash in __list_del_entry, alias_pav_group list corrupt when running dasd_alias_remove_device() * EMBARGOED CVE-2021-3715 kern [More…]

Update to v1.41.1 Fix CVE-2021-39163, CVE-2021-39164 —- Update to v1.41.0

Cumulative bug-fix release from upstream.

– fix disclosure of HTTP auth credentials via SNI data (CVE-2021-38165)

Cumulative bug-fix release from upstream.

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

Update NTFS-3G to 2021.8.22 to fix multiple CVEs

Update NTFS-3G to 2021.8.22 to fix multiple CVEs

Update NTFS-3G to 2021.8.22 to fix multiple CVEs

Update NTFS-3G to 2021.8.22 to fix multiple CVEs

Update NTFS-3G to 2021.8.22 to fix multiple CVEs

An issue has been found in btrbk, a backup tool for btrfs subvolumes. Due to mishandling of remote hosts filtering SSH commands using ssh_filter_btrbk.sh in authorized_keys an arbitrary code execution would

IOMMU page mapping issues on x86 [XSA-378, CVE-2021-28694, CVE-2021-28695, CVE-2021-28696] (#1997531) (#1997568) (#1997537) grant table v2 status pages may remain accessible after de-allocation [XSA-379, CVE-2021-28697] (#1997520) long running loops in grant table handling [XSA-380, CVE-2021-28698] (#1997526) inadequate grant-v2 status frames array bounds check [XSA-382, CVE-2021-28699]

An update that fixes two vulnerabilities is now available.

IOMMU page mapping issues on x86 [XSA-378, CVE-2021-28694, CVE-2021-28695, CVE-2021-28696] (#1997531) (#1997568) (#1997537) grant table v2 status pages may remain accessible after de-allocation [XSA-379, CVE-2021-28697] (#1997520) long running loops in grant table handling [XSA-380, CVE-2021-28698] (#1997526) inadequate grant-v2 status frames array bounds check [XSA-382, CVE-2021-28699]

An update that fixes one vulnerability is now available.

Etienne Stalmans discovered that unsquashfs in squashfs-tools, the tools to create and extract Squashfs filesystems, does not validate filenames for traversal outside of the destination directory. An attacker can take advantage of this flaw for writing to arbitrary files to the filesystem

Update to 2.0.1 (fix RHBZ#1998578); fix RHBZ#1932066 (unsafe use of strncpy)

Update NTFS-3G to 2021.8.22 to fix multiple CVEs —- New upstream development version 1.45.7. —- Upstream patch to work with qemu 6.1 (RHBZ#1998820)

Update NTFS-3G to 2021.8.22 to fix multiple CVEs —- New upstream development version 1.45.7. —- Upstream patch to work with qemu 6.1 (RHBZ#1998820)

Update NTFS-3G to 2021.8.22 to fix multiple CVEs —- New upstream development version 1.45.7. —- Upstream patch to work with qemu 6.1 (RHBZ#1998820)

Update NTFS-3G to 2021.8.22 to fix multiple CVEs —- New upstream development version 1.45.7. —- Upstream patch to work with qemu 6.1 (RHBZ#1998820)

An XML external entity (XXE) injection in pywps allows an attacker to view files on the application server filesystem by assigning a path to the entity.

The container suse/sle15 was updated. The following patches have been included in this update:

The container suse/sle15 was updated. The following patches have been included in this update:

The container suse/sle15 was updated. The following patches have been included in this update:

The container suse/sle15 was updated. The following patches have been included in this update:

The container suse/sles12sp5 was updated. The following patches have been included in this update:

An update that solves one vulnerability and has two fixes is now available.

An update that solves one vulnerability and has one errata is now available.

An update that solves one vulnerability and has two fixes is now available.

An update that fixes two vulnerabilities is now available.

An update that fixes 7 vulnerabilities is now available.

Security release for the 0.4 branch: https://lib.openmpt.org/libopenmpt/2021/08/22/security- updates-0.5.11-0.4.23-0.3.32/

An update that solves 11 vulnerabilities and has 7 fixes is now available.

An update that fixes two vulnerabilities is now available.

An update that fixes 8 vulnerabilities is now available.

The container sles-15-sp3-chost-byos-v20210827 was updated. The following patches have been included in this update:

The container suse-sles-15-sp3-chost-byos-v20210827-hvm-ssd-x86_64 was updated. The following patches have been included in this update:

The container suse-sles-15-sp3-chost-byos-v20210827-gen2 was updated. The following patches have been included in this update:

Upstream details at : https://access.redhat.com/errata/RHSA-2021:3338

Upstream details at : https://access.redhat.com/errata/RHSA-2021:3336

Upstream details at : https://access.redhat.com/errata/RHSA-2021:3325

Upstream details at : https://access.redhat.com/errata/RHSA-2020:1021

Upstream details at : https://access.redhat.com/errata/RHSA-2018:3140

An update that solves two vulnerabilities, contains one feature and has one errata is now available.

NTFS-3G could be made to execute arbitrary code if it received a specially crafted image file.

sssd: shell command injection in sssctl (CVE-2021-3621) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * Memory leak in the simple access provider * id lookup is failing intermittently * SSSD is NOT able to contact the Global Catalog […]

kernel: out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c (CVE-2021-22555) * kernel: race condition for removal of the HCI controller (CVE-2021-32399) * kernel: powerpc: RTAS calls can be used to compromise kernel integrity (CVE-2020-27777) * kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation (CVE-2021-29154) * kernel: [More…]

bind: Broken inbound incremental zone update (IXFR) can cause named to terminate unexpectedly (CVE-2021-25214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 bind-9.11.4-26.P2.el7_9.7.x86_64.rpm bind-chroot-9.11.4-26.P2.el7_9.7.x86_64.rpm bind-debuginfo-9.11.4-26.P2.el7_9.7.i68 [More…]

libsndfile: Heap buffer overflow via crafted WAV file allows arbitrary code execution (CVE-2021-3246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 libsndfile-1.0.25-12.el7_9.1.i686.rpm libsndfile-1.0.25-12.el7_9.1.x86_64.rpm libsndfile-debuginfo-1.0.25-12.el7_9.1.i686.rpm li [More…]

hivex: stack overflow due to recursive call of _get_children() (CVE-2021-3622) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE — SL7 x86_64 hivex-1.3.10-6.12.el7_9.i686.rpm hivex-1.3.10-6.12.el7_9.x86_64.rpm hivex-debuginfo-1.3.10-6.12.el7_9.i686.rpm hivex-debuginfo-1.3.10-6.12.el7_9.x86_64 [More…]

APR could be made to expose sensitive information if it received a specially crafted input.

grilo could be made to allow MITM attacks.

An update for libsndfile is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

An update for libX11 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability

Several vulnerabilities have been discovered in Exiv2, a C++ library and a command line utility to manage image metadata which could result in denial of service or the execution of arbitrary code if a malformed file is parsed.

An update for libsndfile is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,

An update that fixes one vulnerability is now available.

New upstream stable version 1.24.6; fixes CVE-2021-3716.

New upstream stable version 1.26.5; fixes CVE-2021-3716.

An issue has been found in gthumb, an image viewer and browser. A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c allows attackers to

Michael Catanzaro reported a problem in Grilo, a framework for discovering and browsing media. TLS certificate verification is not enabled on the SoupSessionAsync objects created by Grilo, leaving users vulnerable to network MITM attacks.

– CVE-2021-37750 (explicit NULL deref on KDC)

A security flaw was found on rubygem-addressable that a crafted template may cause DOS. This issue is now assinged as CVE-2021-32740. This new rpm should fix this issue.

A security flaw was found on rubygem-addressable that a crafted template may cause DOS. This issue is now assinged as CVE-2021-32740. This new rpm should fix this issue.