Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian LTS: DLA-3140-1: libpgjava security update
It was discovered that there was a potential SQL injection vulnerability in libpgjava, a Java library for connecting to PostgreSQL databases.
RedHat: RHSA-2022-6850:01 Important: openvswitch2.11 security update
An update for openvswitch2.11 is now available for Fast Datapath for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a sec…
SciLinux: SLSA-2022-6710-1 Important: thunderbird on SL7.x x86_64
This update upgrades Thunderbird to version 102.3.0. * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh…
SciLinux: SLSA-2022-6711-1 Important: firefox on SL7.x x86_64
This update upgrades Firefox to version 102.3.0 ESR. * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959) * Mozilla: Data-race w…
Debian: DSA-5239-1: gdal security update
A heap-based buffer overflow vulnerability was discovered in gdal, a Geospatial Data Abstraction Library, which could result in denial of service or potentiall…
Mageia 2022-0340: google-gson security update
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which…
Debian LTS: DLA-3114-1: mariadb-10.3 security update
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.3.36.…
Blackhat USA 2022: Return to Sender - Detecting Kernel Exploits with eBPF
Let's take a brief look at what Guillaume Fournier from Datadog presented at Blackhat USA 2022: ''One of the fastest growing subsystems in the Linux Kernel is,…
Fedora 36: qemu 2022-baf3c3b781
lsi53c895a: Do not abort when DMA requested and no data queued (#552) lsi53c895a: Fix use-after-free in lsi_do_msgout (CVE-2022-0216) (rhbz#2070902)
Debian: DSA-5197-1: curl security update
Multiple security vulnerabilities have been discovered in cURL, an URL transfer library. These flaws may allow remote attackers to obtain sensitive information…
Ubuntu 5530-1: PHP vulnerability
PHP could be made to crash or run programs if it processed specially crafted data.
Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affectingthe Questions For Conflu…
Ubuntu 5524-1: HarfBuzz vulnerability
HarfBuzz could be made to crash if it opened specially crafted data.
Debian: DSA-5185-1: mat2 security update
A directory traversal vulnerability was discovered in the Metadata anonymisation toolkit, which could result in information disclosure via a malformed ZIP arch…
Debian: DSA-5184-1: xen security update
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. In addition this updates provides mitigations …
Fedora 36: xen 2022-c4ec706488
Linux disk/nic frontends data leaks [XSA-403, CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-3374]
Fedora 36: xen 2022-925fc688c1
x86: MMIO Stale Data vulnerabilities [XSA-404, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166]
SciLinux: SLSA-2022-5239-1 Moderate: 389-ds-base on SL7.x x86_64
389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-099…
Mageia 2022-0240: libtiff security update
Heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c. (CVE-2022-1354) Stack-buffer-overflow in tiffcp.c in main(). (CVE-2022-1355) Out-of-bounds read…
Mageia 2022-0239: 389-ds-base security update
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can…
Fedora 35: kernel 2022-177a008b98
The 5.18.5 stable kernel update contains mitigation for the processor MMIO stale-data vulnerabilities. These are covered by CVE-2022-21166 CVE-2022-21125 and C…
Linux Botnets Now Exploit Critical Atlassian Confluence Bug
Several botnets are now using exploits targeting a critical remote code execution (RCE) vulnerability to infect Linux servers running unpatched Atlassian Confl…
Debian LTS: DLA-3035-1: libdbi-perl security update
It was discovered that CVE-2014-10401 was fixed incompletely in the Perl5 Database Interface (DBI). An attacker could trigger information disclosure through a …
RedHat: RHSA-2022-4786:01 Moderate: openvswitch2.13 security update
An update for openvswitch2.13 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a secu…