Mageia 2023-0231: qt4/qtsvg5 security update
Out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend (CVE-2021-45930) QtSvg QSvgFont m_unitsPerEm initialization is mishandled. (CVE-2023-32573)
Mageia 2023-0230: maven security update
No longer use http (non-SSL) repository references by default. References: - https://bugs.mageia.org/show_bug.cgi?id=28924 - https://www.openwall.com/lists/oss-security/2021/04/23/5
Mageia 2023-0229: webkit2 security update
Details not available at this time. (CVE-2022-48503) Memory corruption issue may lead to arbitrary code execution (CVE-2023-32435) Type confusion issue may lead to arbitrary code execution (CVE-2023-32439)
Mageia 2023-0228: curaengine security update
Denial of service due to integer overflow (CVE-2022-28041) References: - https://bugs.mageia.org/show_bug.cgi?id=32055 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/SEQGDVH43YW7AG7TRU2CTU5TMIYP27WP/
Mageia 2023-0227: golang security update
Code injection via go command with cgo in cmd/go (CVE-2023-29402) Ignoring setuid/setgid bits. (CVE-2023-29403) Arbitrary code execution (CVE-2023-29404) Arbitrary code execution (CVE-2023-29405)
Mageia 2023-0226: nodejs security update
Current nodejs 14 branch in Mageia 8 is end of life and there are no more security updates. This release allows to move to the new nodejs 18 LTS branch and fixes the following CVEs
Mageia 2023-0225: libreoffice security update
Arbitrary File Write in hsqldb 1.8.0. (CVE-2023-1183) References: - https://bugs.mageia.org/show_bug.cgi?id=32042 - https://www.libreoffice.org/about-us/security/advisories/cve-2023-1183/
Mageia 2023-0224: minidlna security update
Out-of-bounds read/write due to buffer overflow (CVE-2023-33476) References: - https://bugs.mageia.org/show_bug.cgi?id=32041 - https://www.debian.org/security/2023/dsa-5434
Mageia 2023-0223: cups security update
Use-after-free in cupsdAcceptClient(). (CVE-2023-34241) References: - https://bugs.mageia.org/show_bug.cgi?id=32040 - https://www.openwall.com/lists/oss-security/2023/06/22/4
Mageia 2023-0222: opensc security update
Crash or info leak due to heap-based buffer out of bounds read (CVE-2023-2977) References: - https://bugs.mageia.org/show_bug.cgi?id=32036
Mageia 2023-0221: keepass security update
Allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. Disputed by vendor due to level of access required. (CVE-2023-24055) Possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running (CVE-2023-32784)
Mageia 2023-0220: testng security update
Path traversal in zip files (CVE-2022-4065) References: - https://bugs.mageia.org/show_bug.cgi?id=31741 - https://lists.suse.com/pipermail/sle-security-updates/2023-March/014264.html
Mageia 2023-0219: python-setuptools security update
Denial of service via crafted HTML (CVE-2022-40897) References: - https://bugs.mageia.org/show_bug.cgi?id=31421 - https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/WAQKKYI5XTBXPHU7RRPHNAQ7W6ARWJQW/
Mageia 2023-0218: python-wheel security update
Denial of service via attacker controlled input to wheel cli (CVE-2022-40898) References: - https://bugs.mageia.org/show_bug.cgi?id=31420
Mageia 2023-0217: systemd security update
Local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting (CVE-2022-4415) References: - https://bugs.mageia.org/show_bug.cgi?id=31305
Mageia 2023-0216: apache-ivy security update
Improper path allowed when extracting archive.(CVE-2022-37865) Possible path traversal in download path (CVE-2022-37866) References: - https://bugs.mageia.org/show_bug.cgi?id=31075
Mageia 2023-0215: glances security update
Regular Expression Denial of Service (ReDoS) in angular (CVE-2022-25844) References: - https://bugs.mageia.org/show_bug.cgi?id=31059 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/
Mageia 2023-0214: perl-DBD-SQLite security update
Possible unfixed security issues due to bundled sqlite3 References: - https://bugs.mageia.org/show_bug.cgi?id=30216 - https://lists.opensuse.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/VRQ7IRKZITJLT44RH5PJICZIIRQJLXEE/
Mageia 2023-0213: skopeo/buildah/podman security update
Information disclosure flaw was found in Buildah (CVE-2021-3602) podman allows forwarding hosts ports to vm from within vm (CVE-2021-4024) Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration (CVE-2021-20206) github.com/containers/storage ddos via crafted tar file (CVE-2021-20291)
Mageia 2023-0212: xonotic security update
A bug was discovered in versions older than 0.8.6 that is believed to be exploitable by malicious server admins to crash clients or, if they defeat mitigations, execute arbitrary code. No working exploit code is known to exist at this time, See referenced release notes for other changes.
