Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vuln…
Two heap overflows were fixed in the rsyslog logging daemon. CVE-2019-17041
Several vulnerabilities were fixed in the OpenSC smart card utilities. CVE-2019-15945
Rongxin Wu discovered a use-after-free vulnerability in the International Components for Unicode (ICU) library which could result in denial of service or poten…
Several vulnerabilities were fixed in libvorbis, a popular library for the Vorbis audio codec. CVE-2017-14160
Several vulnerabilities were discovered in BlueZ, the Linux Bluetooth protocol stack. An attacker could cause a denial-of-service (DoS) or leak information.
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. Th…
Integer-overflow in Imf_3_1::bytesPerDeepLineTable. (CVE-2021-3933) Divide-by-zero in Imf_3_1::RGBtoXYZ. (CVE-2021-3941) References: - https://bugs.mageia.org/…
Server processes unencrypted bytes from man-in-the-middle. (CVE-2021-23214) libpq processes unencrypted bytes from man-in-the-middle. (CVE-2021-23222) Referenc…
Privilege escalation that allows an attacker to add or remove data in any database or make configuration changes. (CVE-2021-38295) References: - https://bugs.m…
The newest upstream commit Security fix for CVE-2021-3968 Security fix for CVE-2021-3973 Security fix for CVE-2021-3974
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, incorrect Kerberos ticket use, selection of we…
Header injection via default_mimetype / default_charset mbstring may use pointer from some previous request Unexpected behavior with arrays and JIT Special cha…
IPPUSB dissector crash (CVE-2021-39920). Modbus dissector crash (CVE-2021-39921). C12.22 dissector crash (CVE-2021-39922). PNRP dissector large loop (wnpa-sec-…
A symbolic link (Symlink) following vulnerability in arpwatch allows local attackers with control of the runtime user to run arpwatch and to escalate to root u…
The container bci/openjdk was updated. The following patches have been included in this update:
The container bci/openjdk-devel was updated. The following patches have been included in this update:
Jonathan Schlue discovered a vulnerability in Salt, a powerful remote execution manager. A user who has control of the source, and source_hash URLs can gain fu…
TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML …
Correct buffer overflows and segfaults, mainly due to maliciously crafted input files. References: - https://bugs.mageia.org/show_bug.cgi?id=29608
CVE-2021-42780: Fixed use after return in insert_pin() (bsc#1192005). CVE-2021-42779: Fixed use after free in sc_file_valid() (bsc#1191992). CVE-2021-42781: Fi…
CVE-2020-24741, Do not attempt to load a library relative to $PWD References: - https://bugs.mageia.org/show_bug.cgi?id=29602 - https://lists.fedoraproject.org…
Two issues have been found in atftp, an advanced TFTP client. Both are related to sending crafted requests to the server and triggering a denial-of-service due…
Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of these flaws for local root privilege …
