6,419 results · Feed
-
Medium max 5.9ALSA-2023:6575 5 CVEs
Moderate: libtiff security update
The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Security Fix(es): * libtiff: null pointer dereference in LZWDecode() in libtiff/tif_lzw.c (CVE-2023-2731) * libtiff: tiffcrop: null pointer dereference…
first Nov 7, 2023 -
MediumALSA-2023:6643 2 CVEs
Moderate: libssh security update
libssh is a library which implements the SSH protocol. It can be used to implement client and server applications. Security Fix(es): * libssh: NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667) * libssh: authorization bypass in p…
first Nov 7, 2023 -
Low max 4.7ALSA-2023:6632 1 CVE
Low: shadow-utils security and bug fix update
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fix(es): * shadow-utils: possible password leak during passwd(1) change (CVE-2023-…
first Nov 7, 2023 -
Low max 5.5ALSA-2023:6631 3 CVEs
Low: glib2 security and bug fix update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Securi…
first Nov 7, 2023 -
Medium max 4.8ALSA-2023:6615 1 CVE
Moderate: python-cryptography security update
The python-cryptography packages contain a Python Cryptographic Authority's (PyCA's) cryptography library, which provides cryptographic primitives and recipes to Python developers. Security Fix(es): * python-cryptography: memory corruption via immutable objec…
first Nov 7, 2023 -
Medium max 5.5ALSA-2023:6593 1 CVE
Moderate: binutils security update
The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities. Securit…
first Nov 7, 2023 -
Low max 7.1ALSA-2023:6587 1 CVE
Low: opensc security update
The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operations and enables their use for authentication, mail encryption, or digital signatures. Security Fix(es): * opensc…
first Nov 7, 2023 -
MediumALSA-2023:6578 1 CVE
Moderate: libqb security update
The libqb packages provide a library with the primary purpose of providing high performance client/server reusable features, such as high performance logging, tracing, inter-process communication, and polling. Security Fix(es): * libqb: Buffer overflow in log…
first Nov 7, 2023 -
Medium max 7.5ALSA-2023:6570 3 CVEs
Moderate: tomcat security and bug fix update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) * tomcat: not including the secure attribute causes informat…
first Nov 7, 2023 -
Medium max 7.8ALSA-2023:6569 1 CVE
Moderate: sysstat security and bug fix update
The sysstat packages provide the sar and iostat commands. These commands enable system monitoring of disk, network, and other I/O activity. Security Fix(es): * sysstat: check_overflow() function can work incorrectly, which could lead to an overflow (CVE-2023-…
first Nov 7, 2023 -
Medium max 5.9ALSA-2023:6566 1 CVE
Moderate: libmicrohttpd security update
GNU libmicrohttpd is a small C library that makes it easy to run an HTTP server as part of another application. Security Fix(es): * libmicrohttpd: remote DoS (CVE-2023-27371) For more details about the security issue(s), including the impact, a CVSS score, ac…
first Nov 7, 2023 -
Medium max 6.5ALSA-2023:6551 1 CVE
Moderate: yajl security update
Yet Another JSON Library (YAJL) is a small event-driven (SAX-style) JSON parser written in ANSI C, and a small validating JSON generator. Security Fix(es): * yajl: Memory leak in yajl_tree_parse function (CVE-2023-33460) For more details about the security is…
first Nov 7, 2023 -
MediumALSA-2023:6549 3 CVEs
Moderate: libreswan security update
Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks…
first Nov 7, 2023 -
Medium max 8.1ALSA-2023:6542 1 CVE
Moderate: perl-HTTP-Tiny security update
HTTP::Tiny is a small and simple HTTP/1.1 client written in Perl. Security Fix(es): * http-tiny: insecure TLS cert default (CVE-2023-31486) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related in…
first Nov 7, 2023 -
Medium max 8.1ALSA-2023:6539 1 CVE
Moderate: perl-CPAN security update
The CPAN module is a tool to query, download and build perl modules from CPAN sites. Security Fix(es): * perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS (CVE-2023-31484) For more details about the security issue(s), in…
first Nov 7, 2023 -
LowALSA-2023:6661 1 CVE
Low: gmp security and enhancement update
The gmp packages contain GNU MP, a library for arbitrary precision arithmetics, signed integers operations, rational numbers, and floating point numbers. Security Fix(es): * gmp: Integer overflow and resultant buffer overflow via crafted input (CVE-2021-43618…
first Nov 7, 2023 -
Medium max 8.6ALSA-2023:6635 4 CVEs
Moderate: c-ares security, bug fix, and enhancement update
The c-ares C library defines asynchronous DNS (Domain Name System) requests and provides name resolving API. The following packages have been upgraded to a later upstream version: c-ares (1.19.1). (BZ#2210370) Security Fix(es): * c-ares: buffer overflow in co…
first Nov 7, 2023 -
Medium max 9.8ALSA-2023:6544 2 CVEs
Moderate: ghostscript security and bug fix update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: buffer overflow in base/sbcp.c …
first Nov 7, 2023 -
High max 7.5
Important: go-toolset and golang security and bug fix update
Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. The golang packages provide the Go programming language compiler. Security Fix(es): * golang: net/http, x/net/http2: rapid stream resets can cause excess…
first Oct 16, 2023 -
Medium max 5.3ALSA-2023:5733 3 CVEs
Moderate: java-1.8.0-openjdk security update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fix(es): * OpenJDK: segmentation fault in ciMethodBlocks (CVE-2022-40433) * OpenJDK: IOR deserialization issue in CORBA (8…
first Oct 18, 2023 -
Medium max 7.5
Moderate: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE…
first Oct 16, 2023 -
High max 7.5ALSA-2023:5689 1 CVE
Important: bind security update
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …
first Oct 12, 2023 -
HighALSA-2023:5459 1 CVE
Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fix(es): * ghostscript: vulnerable to OS command inject…
first Oct 5, 2023 -
HighALSA-2023:5456 1 CVE
Important: python3.11 security update
Python is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. Security Fix(es): * python: …
first Oct 5, 2023 -
High max 7.8
Important: glibc security update
The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot…
first Oct 5, 2023 -
High max 9.8
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.3.1 ESR. Security Fix(es): * firefox: use-after-free in workers (CVE-2023-3600) * Mozilla: Out-of-bound…
first Oct 4, 2023 -
High max 8.8
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.15.1. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more details about the security issue(s), including the im…
first Sep 19, 2023 -
High max 8.8
Important: libwebp security update
The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange…
first Sep 19, 2023 -
High max 8.8
Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 102.15.1 ESR. Security Fix(es): * libwebp: Heap buffer overflow in WebP Codec (CVE-2023-4863) For more deta…
first Sep 18, 2023 -
Medium max 6.5ALSA-2023:5146 1 CVE
Moderate: .NET 7.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Sep 13, 2023 -
Medium max 6.5ALSA-2023:5143 1 CVE
Moderate: .NET 6.0 security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…
first Sep 13, 2023 -
High max 7.5
Important: nodejs security update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)…
first Oct 17, 2023 -
High max 8.8ALSA-2023:5763 2 CVEs
Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: a heap-based buffer overflow in the SOCKS5 proxy handshake (CVE-2023-38545)…
first Oct 17, 2023 -
Medium max 5.3ALSA-2023:5753 2 CVEs
Moderate: java-17-openjdk security and bug fix update
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fix(es): * OpenJDK: memory corruption issue on x86_64 with AVX-512 (8317121) (CVE-2023-22025) * OpenJDK: certificate path v…
first Oct 18, 2023 -
Medium max 5.3ALSA-2023:5744 1 CVE
Moderate: java-11-openjdk security and bug fix update
The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Security Fix(es): * OpenJDK: certificate path validation issue during client authentication (8309966) (CVE-2023-22081) For more deta…
first Oct 18, 2023 -
High max 7.5ALSA-2023:5684 8 CVEs
Important: galera and mariadb security update
MariaDB is a multi-user, multi-threaded SQL database server that is binary compatible with MySQL. The following packages have been upgraded to a later upstream version: galera (26.4.14), mariadb (10.5.22). Security Fix(es): * mariadb: node crashes with Transp…
first Oct 12, 2023 -
High max 8.8
Important: libvpx security update
The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fix(es): * libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217) * …
first Oct 9, 2023 -
High max 9.8ALSA-2023:5532 3 CVEs
Important: nodejs security and bug fix update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * nodejs: Permissions policies can be bypassed via Module._load (CVE-2023-32002) * nodejs: Permissions pol…
first Oct 9, 2023 -
High max 9.8
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.3.1. Security Fix(es): * firefox: use-after-free in workers (CVE-2023-3600) * Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169) * Mozilla: Use…
first Oct 4, 2023 -
High max 9.8ALSA-2023:5363 4 CVEs
Important: nodejs:18 security, bug fix, and enhancement update
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs (18). (BZ#2223313, BZ#2234404) Security Fix(es…
first Sep 26, 2023