A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. (CVE-2022-27337) References:
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected. (CVE-2022-34265)
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. (CVE-2022-29970) References: - https://bugs.mageia.org/show_bug.cgi?id=30542
This kernel-linus update is based on upstream 5.15.58 and fixes at least the following security issues: Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).
This kernel update is based on upstream 5.15.58 and fixes at least the following security issues: Kernel lockdown bypass when UEFI secure boot is disabled / unavailable and IMA appraisal is enabled (CVE-2022-21505).
[1325699] High CVE-2022-2603: Use after free in Omnibox. Reported by Anonymous on 2022-05-16 [1335316] High CVE-2022-2604: Use after free in Safe Browsing. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-10 [1338470] High CVE-2022-2605: Out of bounds read in Dawn. Reported by
Phishing website URL removed from package spec file and replaced with new official site link. References: - https://bugs.mageia.org/show_bug.cgi?id=30679
It was discovered that giflib 5.2.1 (including mingw-giflib which has giflib 5.2.1 bundled) contained a heap-buffer-overflow in function DumpScreen2RGB() (CVE-2022-28506). References:
Bleichenbacher timing attacks in the RSA decryption API (CVE-2020-25657) References: - https://bugs.mageia.org/show_bug.cgi?id=30661 - https://lists.suse.com/pipermail/sle-security-updates/2022-July/011631.html
It was discovered that sqlite contained an assertion failure upon queries when compiled with -DSQLITE_ENABLE_STAT4 (CVE-2022-35737). References: - https://bugs.mageia.org/show_bug.cgi?id=30660
The webmin package has been updated to version 1.998, fixing XSS issues in the HTTP Tunnel and Read Mail modules, along with several other bugs. References: - https://bugs.mageia.org/show_bug.cgi?id=30674
When visiting directory listings for chrome:// URLs as source text, some parameters were reflected (CVE-2022-36318). When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed (CVE-2022-36319).
Add support for arbitrary size integers. Replace 'wchar_t' string decoding implementation with a 'uint32_t'-based one; fix handling of surrogates on decoding (CVE-2022-31116) Potential double free of buffer during string decoding - Fix memory leak on encoding errors when the buffer was resized - Integer parsing: always
It was discovered that gdk-pixbuf contained a buffer overwrite in io-gif-animation.c composite_frame() exploitable using a crafted GIF (CVE-2021-46829). References:
The chromium-browser-stable package has been updated to version 103.0.5060.134 branch, fixing many bugs and 11 CVE. Some of them are listed below. Use after free in Guest View. (CVE-2022-2477) Use after free in PDF. (CVE-2022-2478) Insufficient validation of untrusted input in File. (CVE-2022-2479)
Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVE-2022-2056, CVE-2022-2057, CVE-2022-2058) References:
Improved coredump handing for SUID binaries. (bsc#1192449) References: - https://bugs.mageia.org/show_bug.cgi?id=30638 - https://lists.suse.com/pipermail/sle-security-updates/2022-July/011550.html
This update provides the upstream 6.1.36 maintenance release that fixes at least the following security vulnerabilities: A vulnerability in the Oracle VM VirtualBox prior to 6.1.36 contains an easily exploitable vulnerability that allows a high privileged attacker
This kernel-linus update is based on upstream 5.15.55 and fixes at least the following security issues: There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel
This kernel update is based on upstream 5.15.55 and fixes at least the following security issues: There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel
Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.
Cloud Security Cryptography Desktop Security Firewall Government Hacks/Cracks IoT Security Network Security Organizations/Events Privacy Security Projects Security Trends Security Vulnerabilities Server Security Vendors/Products
Debian Debian LTS Fedora Gentoo Mageia Oracle openSUSE RockyLinux Slackware SuSE Ubuntu
Harden My Filesystem Learn Tips and Tricks Secure My E-mail Secure My Firewall Secure My Network Secure My Webserver Strengthen My Privacy
Best Secure Linux Distros for Enhanced Privacy & Security The Truth About Linux Malware & How to Protect Your System Is Linux A More Secure Option Than Windows For Businesses? How Secure Is Linux? Top Tips for Securing Your Linux System
Advertise Contribute Your Article Legal Notice RSS Feeds Contact Us Terms of Service Privacy Policy
Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.
