Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Mageia 2024-0301: postgresql15 & postgresql13 Security Advisory Updates
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_d…
Ubuntu 7012-1: curl Security Advisory Updates
curl could incorrectly check bad certificates when OCSP stapling is in use.
Mageia 2024-0297: botan2 Security Advisory Updates
An attacker could present an ECDSA X.509 certificate using explicit encoding where the parameters are very large. When parsing, the parameter is checked to be …
Mageia 2024-0291: openssl Security Advisory Updates
Possible denial of service in X.509 name checks. (CVE-2024-6119) References: - https://bugs.mageia.org/show_bug.cgi?id=33520 - https://openssl-library.org/news…
Mageia 2024-0287: libtiff Security Advisory Updates
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certai…
Fedora 40: webkitgtk 2024-6b8845e3f0 Security Advisory Updates
Fix web process cache suspend/resume when sandbox is enabled. Fix accelerated images disappearing after scrolling. Fix video flickering with DMA-BUF sink. Fix …
Fedora 39: webkitgtk 2024-ba78b27eb8 Security Advisory Updates
Fix web process cache suspend/resume when sandbox is enabled. Fix accelerated images disappearing after scrolling. Fix video flickering with DMA-BUF sink. Fix …
Mageia 2024-0258: apache Security Advisory Updates
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading pe…
Debian LTS: DLA-3851-1: gunicorn Security Advisory Updates
Gunicorn, an event-based HTTP/WSGI server, fails to properly validate Transfer- Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By c…
Mageia 2024-0242: libopenmpt Security Advisory Updates
Possible out-of-bounds read or write when reading malformed MED files. (r19389). [Null-pointer write (32bit platforms) or excessive memory allocation (64bit pl…
Debian: DSA-5719-1: emacs Security Advisory Updates
It was discovered that Emacs is prone to arbitrary shell code evaluation when opening a specially crafted Org file. This update includes updates pending for th…
Debian: DSA-5718-1: org-mode Security Advisory Updates
It was discovered that Org Mode for Emacs is prone to arbitrary shell code evaluation when opening a specially crafted Org file. This update includes updates p…
Mageia 2024-0236: python-gunicorn Security Advisory Updates
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting T…
Mageia 2024-0227: cups Security Advisory Updates
When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of t…
Debian LTS: DLA-3826-1: cups Security Advisory Updates
An issue has been found in cups, the Common UNIX Printing System(tm). When starting the cupsd server with a Listen configuration item pointing to a symbolic li…
Mageia 2024-0200: openssl Security Advisory Updates
The updated packages fix security vulnerabilities: Excessive time spent checking DSA keys and parameters. (CVE-2024-4603) Use After Free with SSL_free_buffers.…
Okta Warns of Credential Stuffing Attacks Targeting Customer Identity Cloud
Okta is warning that a cross-origin authentication feature in Customer Identity Cloud (CIC) is susceptible to credential stuffing attacks orchestrated by threa…
Debian LTS: DLA-3821-1: libreoffice Security Advisory Updates
Unchecked script execution in Graphic on-click binding in affected LibreOffice versions allows an attacker to create a document which without prompt will execu…
Debian: DSA-5690-1: libreoffice Security Advisory Updates
Amel Bouziane-Leblond discovered that LibreOffice's support for binding scripts to click events on graphics could result in unchecked script execution.
Mageia 2024-0175: mutt Security Advisory Updates
Null pointer dereference when viewing a specially crafted email in Mut1.5.2 1.5.2
Mageia 2024-0173: glibc Security Advisory Updates
Stack-based buffer overflow in netgroup cache: If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent cli…
Mageia 2024-0171: tpm2-tss Security Advisory Updates
A flaw was found in the tpm2-tss package, where there was no check that the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows a…
Ubuntu 6761-1: Anope Security Advisory Updates
Anope could be made to bypass authentication checks for suspended accounts.
Fedora 38: xen 2024-a676697123 Security Advisory Updates
x86: Native Branch History Injection [XSA-456, CVE-2024-2201] update to xen 4.17.4, remove patches now included upstream rebase xen.gcc12.fixes.patch x86 HVM h…