Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Fedora 35: libetpan 2022-df2f4923ea
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Fedora 36: libetpan 2022-de3e565494
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Fedora 37: libetpan 2022-f092bc8f7b
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Debian LTS: DLA-3210-1: gerbv security update
Two vulnerabilities were discovered gerbv, a Gerber file viewer. Most Printed Circuit Board (PCB) design programs can export data to a Gerber file.
Mageia 2022-0437: freerdp security update
FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently con…
Debian LTS: DLA-3201-1: ntfs-3g security update
Yuchen Zeng and Eduardo Vela discovered a buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE, due to incorrect validation of some of the NTFS metada…
Debian LTS: DLA-3184-1: libjettison-java security update
It was discovered that libjettison-java, a collection of StAX parsers and writers for JSON, was vulnerable to a denial-of-service attack, if the attacker provi…
Debian: DSA-5270-1: ntfs-3g security update
Yuchen Zeng and Eduardo Vela discovered a buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE, due to incorrect validation of some of the NTFS metada…
Debian LTS: DLA-3176-1: clickhouse security update
Several security vulnerabilities were discovered in clickhouse, a column-oriented database system. The vulnerabilities require authentication, but can be trigg…
Mageia 2022-0405: curl security update
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS …
Debian LTS: DLA-3175-1: python3.7 security update
Nicky Mouha discovered a buffer overflow in '_sha3', the SHA-3 hashing function module used by 'hashlib' in Python 3.7. While the attacks require a large volum…
Ubuntu 5688-2: Libksba vulnerability
Libksba could be made to crash or run programs if it decoded specially crafted data.
Ubuntu 5688-1: Libksba vulnerability
Libksba could be made to crash or run programs if it decoded specially crafted data.
Mageia 2022-0373: sos security update
SoS incorrectly handled certain data. An attacker could possibly use this issue to expose sensitive information. (CVE-2022-2806) References: - https://bugs.mag…
Debian LTS: DLA-3140-1: libpgjava security update
It was discovered that there was a potential SQL injection vulnerability in libpgjava, a Java library for connecting to PostgreSQL databases.
RedHat: RHSA-2022-6850:01 Important: openvswitch2.11 security update
An update for openvswitch2.11 is now available for Fast Datapath for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a sec…
SciLinux: SLSA-2022-6710-1 Important: thunderbird on SL7.x x86_64
This update upgrades Thunderbird to version 102.3.0. * Mozilla: Leaking of sensitive information when composing a response to an HTML email with a META refresh…
SciLinux: SLSA-2022-6711-1 Important: firefox on SL7.x x86_64
This update upgrades Firefox to version 102.3.0 ESR. * Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959) * Mozilla: Data-race w…
Debian: DSA-5239-1: gdal security update
A heap-based buffer overflow vulnerability was discovered in gdal, a Geospatial Data Abstraction Library, which could result in denial of service or potentiall…
Mageia 2022-0340: google-gson security update
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which…
Debian LTS: DLA-3114-1: mariadb-10.3 security update
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.3.36.…
Blackhat USA 2022: Return to Sender - Detecting Kernel Exploits with eBPF
Let's take a brief look at what Guillaume Fournier from Datadog presented at Blackhat USA 2022: ''One of the fastest growing subsystems in the Linux Kernel is,…
Fedora 36: qemu 2022-baf3c3b781
lsi53c895a: Do not abort when DMA requested and no data queued (#552) lsi53c895a: Fix use-after-free in lsi_do_msgout (CVE-2022-0216) (rhbz#2070902)
Debian: DSA-5197-1: curl security update
Multiple security vulnerabilities have been discovered in cURL, an URL transfer library. These flaws may allow remote attackers to obtain sensitive information…