6,444 results · Feed
-
Medium max 5.9ALSA-2024:0116 2 CVEs
Moderate: python-urllib3 security update
The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fix(es): * python-urllib3: Cookie request header isn't stripped during cross-origin redirects (CVE-2023-43804) * urllib3: Request body not str…
first Jan 10, 2024 -
Medium max 6.5ALSA-2024:0105 1 CVE
Moderate: nss security update
Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fix(es): * nss: timing attack against RSA decryption (CVE-2023-5388) For more details about t…
first Jan 10, 2024 -
High max 8.6ALSA-2024:0046 4 CVEs
Important: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: Denial of Service in SSL Certificate validation (CVE-2023-46724) * squid: NULL pointer dereference in the gopher protoc…
first Jan 3, 2024 -
High max 7.8ALSA-2024:0018 2 CVEs
Important: tigervnc security update
Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is …
first Jan 2, 2024 -
High max 8.8ALSA-2024:0012 11 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.6.0 ESR. Security Fix(es): * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced<…
first Jan 2, 2024 -
High max 8.8ALSA-2024:0003 11 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.6.0. Security Fix(es): * Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver (CVE-2023-6856)…
first Jan 2, 2024 -
High max 8.8ALSA-2023:7884 5 CVEs
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-586…
first Dec 20, 2023 -
High max 8.8ALSA-2023:7841 1 CVE
Important: gstreamer1-plugins-bad-free security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * gstreamer: MXF demuxer use-after-free vulnerability (…
first Dec 14, 2023 -
Medium max 6.2ALSA-2023:7836 6 CVEs
Moderate: avahi security update
Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zero Configuration Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network …
first Dec 14, 2023 -
High max 8.8ALSA-2023:7790 1 CVE
Important: postgresql:10 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) For more details about the security issue(s), including the impact, a CVS…
first Dec 13, 2023 -
High max 7.5ALSA-2023:7732 1 CVE
Important: tracker-miners security update
Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker. Security Fix(es): * tracker-miners: sandbox escape (CVE-2023-5557) For more det…
first Dec 12, 2023 -
High max 8.8
Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: Arbitrary Remote Code Execution (CVE-2023-42917) For more details about the security issue(s), including the impact, a CVSS score, acknowledg…
first Dec 11, 2023 -
High max 8.8ALSA-2023:7581 4 CVEs
Important: postgresql:13 security update
PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Buffer overrun from integer overflow in array modification (CVE-2023-5869) * postgresql: Memory disclosure in aggregate function calls (CVE-2023-586…
first Nov 29, 2023 -
HighALSA-2023:7508 7 CVEs
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.5.0 ESR. Security Fix(es): * Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-62…
first Nov 27, 2023 -
HighALSA-2023:7500 7 CVEs
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.5.0. Security Fix(es): * Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204) * Mozilla: Use-after-free in MessagePort::Ent…
first Nov 27, 2023 -
High max 7.4ALSA-2023:7265 2 CVEs
Important: open-vm-tools security update
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Security Fix(es): * open-vm-tools: SAML…
first Nov 15, 2023 -
Medium max 7.6ALSA-2023:7258 2 CVEs
Moderate: dotnet6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Nov 15, 2023 -
Medium max 7.6ALSA-2023:7256 2 CVEs
Moderate: dotnet7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Nov 15, 2023 -
Medium max 7.6ALSA-2023:7254 2 CVEs
Moderate: dotnet8.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. Security Fix(es): * dotnet: Arbitrary File Write and Deletion Vulnerability: FormatFtpCommand (CVE-2023-36049) …
first Nov 15, 2023 -
Critical max 9.3ALSA-2023:7213 2 CVEs
Critical: squid:4 security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fix(es): * squid: Denial of Service in HTTP Digest Authentication (CVE-2023-46847) * squid: Request/Response smuggling in HTTP/1.1 and IC…
first Nov 14, 2023 -
Medium max 4.1ALSA-2023:7207 2 CVEs
Moderate: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: Heap buffer over read in ares_parse_soa_reply (CVE-2020-22217) * c-ares: Buffer Underwrite in ares_inet_net_pton() (CVE-20…
first Nov 14, 2023 -
High max 7.7
Important: nodejs:20 security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-20…
first Nov 14, 2023 -
MediumALSA-2023:7202 1 CVE
Moderate: container-tools:4.0 security and bug fix update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) For more details about the security issue(s), inc…
first Nov 14, 2023 -
Medium max 8.1ALSA-2023:7174 1 CVE
Moderate: perl-HTTP-Tiny security update
HTTP::Tiny is a small and simple HTTP/1.1 client written in Perl. Security Fix(es): * http-tiny: insecure TLS cert default (CVE-2023-31486) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related in…
first Nov 14, 2023 -
Low max 6.4ALSA-2023:7166 1 CVE
Low: tpm2-tss security and enhancement update
The tpm2-tss packages provide the Intel implementation of the Trusted Platform Module (TPM) 2.0 System API library. This library enables programs to interact with TPM 2.0 devices Security Fix(es): * tpm2-tss: Buffer Overlow in TSS2_RC_Decode (CVE-2023-22745) …
first Nov 14, 2023 -
Medium max 7.5ALSA-2023:7165 2 CVEs
Moderate: cups security and bug fix update
The Common UNIX Printing System (CUPS) provides a portable printing layer for Linux, UNIX, and similar operating systems. Security Fix(es): * cups: heap buffer overflow may lead to DoS (CVE-2023-32324) * cups: use-after-free in cupsdAcceptClient() in schedule…
first Nov 14, 2023 -
Low max 7.1ALSA-2023:7160 1 CVE
Low: opensc security and bug fix update
The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fix(es): * opensc…
first Nov 14, 2023 -
Medium max 9.8ALSA-2023:7151 1 CVE
Moderate: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…
first Nov 14, 2023 -
MediumALSA-2023:7150 1 CVE
Moderate: librabbitmq security update
The librabbitmq packages provide an Advanced Message Queuing Protocol (AMQP) client library that allows you to communicate with AMQP servers using protocol version 0-9-1. Security Fix(es): * rabbitmq-c/librabbitmq: Insecure credentials submission (CVE-2023-35…
first Nov 14, 2023 -
Medium max 7.5ALSA-2023:7139 4 CVEs
Moderate: samba security, bug fix, and enhancement update
Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information. The following packages have be…
first Nov 14, 2023 -
Medium max 8.6ALSA-2023:7116 1 CVE
Moderate: c-ares security update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. Security Fix(es): * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904) For more details about the securit…
first Nov 14, 2023 -
Low max 4.7ALSA-2023:7112 1 CVE
Low: shadow-utils security and bug fix update
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: possible password leak during passwd(1) change (CVE-2023-…
first Nov 14, 2023 -
MediumALSA-2023:7109 1 CVE
Moderate: linux-firmware security, bug fix, and enhancement update
The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fix(es): * hw amd: Return Address Predictor vulnerability leading to information disclosure (CVE-2023-20569) For more details about the sec…
first Nov 14, 2023 -
Medium max 4.8ALSA-2023:7096 1 CVE
Moderate: python-cryptography security update
The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: memory corruption via immutable objec…
first Nov 14, 2023 -
Medium max 5.9ALSA-2023:7090 1 CVE
Moderate: libmicrohttpd security update
GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application. Security Fix(es): * libmicrohttpd: remote DoS (CVE-2023-27371) For more details about the security issue(s), including the impact, a CVSS score, ac…
first Nov 14, 2023 -
Medium max 9.8ALSA-2023:7083 2 CVEs
Moderate: emacs security update
GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command execution via shell metacharacters (CV…
first Nov 14, 2023 -
High max 7.8ALSA-2023:7077 53 CVEs
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4…
first Nov 14, 2023 -
Medium max 7.5ALSA-2023:7065 3 CVEs
Moderate: tomcat security and bug fix update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) * tomcat: not including the secure attribute causes informat…
first Nov 14, 2023 -
Medium max 6.5ALSA-2023:7057 1 CVE
Moderate: yajl security update
Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security is…
first Nov 14, 2023 -
High max 8.8ALSA-2023:7055 18 CVEs
Important: webkit2gtk3 security and bug fix update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fix(es): * webkitgtk: arbitrary code execution (CVE-2023-32393) * webkitgtk: bypass Same Origin Policy (CVE-2023-38572) * webkitgtk: Processing web content may lea…
first Nov 14, 2023