stack-based buffer overflow in handle_request() in DHT.c (CVE-2021-44847) References: – https://bugs.mageia.org/show_bug.cgi?id=29821 – https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/S7EBS3NIRYJ7V3PTNINP3PJSVUHGZTGA/
HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818) References: – https://bugs.mageia.org/show_bug.cgi?id=29817
e2guardian did not validate TLS hostnames (CVE-2021-44273) References: – https://bugs.mageia.org/show_bug.cgi?id=29811 – https://www.openwall.com/lists/oss-security/2021/12/23/2
ReDoS vulnerability in html_preprocess_rules in ebooks/conversion/preprocess.py References: – https://bugs.mageia.org/show_bug.cgi?id=29803
HTTP Request Smuggling due to spaces in headers. The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). (CVE-2021-22959) HTTP Request Smuggling when parsing the body. The parse ignores chunk extensions when parsing the body of chunked requests. This leads […]
Authenticate active help requests to the local help web server (CVE-2020-27225) References: – https://bugs.mageia.org/show_bug.cgi?id=29048
security update
Two vulnerabilities were fixed in the reSIProcate SIP stack. CVE-2017-11521
An update that fixes 33 vulnerabilities is now available.
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.
The container suse/sle15 was updated. The following patches have been included in this update:
The container suse/sle15 was updated. The following patches have been included in this update:
New wpa_supplicant packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.
A couple of vulnerabilites were found in paramiko, an implementation of SSHv2 protocol in Python. CVE-2018-1000805
An XSS vulnerability was discovered in noVNC, a HTML5 VNC client, in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
A cookie prefix spoofing vulnerability in CGI::Cookie.parse and a regular expression denial of service vulnerability (ReDoS) on date parsing methods were discovered in src:ruby2.1, the Ruby interpreter.
Several vulnerabilities were discovered in djvulibre, a library and set of tools to handle documents in the DjVu format. An attacker could crash document viewers and possibly execute arbitrary code through
The python-rdflib-tools package (tools for converting to and from RDF) had wrappers that could load Python modules from the current working directory, allowing code injection.
An update that contains security fixes can now be installed.
Several security vulnerabilities were found in Apache Log4j2, a Logging Framework for Java, which could lead to a denial of service or information disclosure.
Invalid read for malformed DVI files was fixed in GNU libextractor, a library that extracts meta-data from files of arbitrary type. For Debian 9 stretch, this problem has been fixed in version
Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack
Backport fix for CVE-2021-45078
Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack
Backport fix for CVE-2021-45078
The container suse/sle15 was updated. The following patches have been included in this update:
The container suse/sle15 was updated. The following patches have been included in this update:
The container suse/sle15 was updated. The following patches have been included in this update:
The 5.15.11 stable kernel update contains a number of important fixes across the tree.
Updat eto 4.6.5 to fix CVE-2021-43818.
Update to 2.53.10.1 Backport fixes to improve compatibility of some sites
The container suse/sle15 was updated. The following patches have been included in this update:
The container suse/sle15 was updated. The following patches have been included in this update:
The container ses/7/ceph/ceph was updated. The following patches have been included in this update:
The container ses/7/ceph/grafana was updated. The following patches have been included in this update:
The container ses/7/cephcsi/cephcsi was updated. The following patches have been included in this update:
security update
security update
https://lib.openmpt.org/libopenmpt/2021/12/23/security- update-0.5.15-releases-0.4.27-0.3.36/
The following vulnerabilities have been discovered in the wpewebkit web engine: CVE-2021-30887
The following vulnerabilities have been discovered in the webkit2gtk web engine: CVE-2021-30887
OpenPGP signature status doesn’t consider additional message content. (CVE-2021-4126) Matrix chat library libolm bundled with Thunderbird vulnerable to a buffer overflow. (CVE-2021-44538)
security update
security update
Security fix for CVE-2021-44224, CVE-2021-44790
Rebuild 3.8.5 using golang-1.16.12
Rebuild 3.8.5 using golang-1.16.12
An update that fixes four vulnerabilities is now available.
An update that solves two vulnerabilities and has one errata is now available.
An update that solves two vulnerabilities and has one errata is now available.
An update that fixes one vulnerability is now available.
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:
security update
An update that fixes 33 vulnerabilities is now available.
An update that solves one vulnerability and has one errata is now available.
An update that fixes one vulnerability is now available.
It was discovered that missing SAML signature validation in the SOGo groupware could result in impersonation attacks. For the oldstable distribution (buster), this problem has been fixed
An update that fixes three vulnerabilities is now available.
An update that solves one vulnerability and has one errata is now available.
An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which
An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
An update for the postgresql:12 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
An update for openssl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
security update
An update that fixes three vulnerabilities is now available.
An update that fixes three vulnerabilities is now available.
An update that fixes two vulnerabilities is now available.
An update that fixes 5 vulnerabilities is now available.
An update for log4j is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.6 Advanced Update Support, Red
security update
security update
An update that fixes one vulnerability is now available.
Updated olm packages fix security vulnerability: The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is
Updated privoxy packages fix security vulnerabilities: A security issue has been found in Privoxy before version 3.0.33. get_url_spec_param() did not free memory of compiled pattern spec before bailing (CVE-2021-44540).
Updated watchdog packages fixes an issue with a memory leak when verbose mode is on. References: – https://bugs.mageia.org/show_bug.cgi?id=29576
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or spoofing.
Updated mediawiki packages fix security vulnerabilities: == Security fixes == * (T292763. CVE-2021-44854) REST API incorrectly publicly caches autocomplete search results from private wikis.
In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable (writable) property (CVE-2021-44225).
security update
An update that fixes one vulnerability is now available.
It was discovered that modsecurity-apache, an Apache module to tighten the Web application security, does not properly handles excessively nested JSON objects, which could result in denial of service. The update introduces a new ‘SecRequestBodyJsonDepthLimit’ option to limit the
security update
xwayland 21.1.4 Security fix for CVE-2021-4008, CVE-2021-4009, CVE-2021-4010, CVE-2021-4011 Store EGLcontext to avoid superfluous eglMakeCurrent() calls Prefer EGLStream with NVIDIA proprietary driver if both GBM and EGLstream are available
Update log4j to 2.16.0 – Disables JNDI by default
Fix out of bounds read issue in *larrv functions (CVE-2021-4048)
– Update the libsqlite3-sys crate to version 0.23.2. – Update the rusqlite crate to version 0.26.3. This update also contains a fix for RUSTSEC-2021-0128.
security update
security update
Chen Zhaojun of Alibaba Cloud Security Team discovered a critical security vulnerability in Apache Log4j, a popular Logging Framework for Java. JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker
The container suse/sle15 was updated. The following patches have been included in this update:
An update that fixes 7 vulnerabilities is now available.
An update that fixes 9 vulnerabilities is now available.
security update
Apache Log4j2
– Update to latest upstream (95.0)
**MariaDB 10.5.13** Release notes: https://mariadb.com/kb/en/mariadb-10513-release-notes/ Maintainer notes: This update contains – conditionally only on F>=35 – patch for OpenSSL 3 This update enables LTO – Link Time Optimization This update disables DTRACE on ARMv7hl architecture as a temporary workaround for BZ #2026600
**MariaDB 10.5.13** Release notes: https://mariadb.com/kb/en/mariadb-10513-release-notes/ Maintainer notes: This update contains – conditionally only on F>=35 – patch for OpenSSL 3 This update enables LTO – Link Time Optimization This update disables DTRACE on ARMv7hl architecture as a temporary workaround for BZ #2026600