net/http: improper sanitization of Transfer-Encoding header The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid. (CVE-2022-1705)
OpenJDK: Defective secure validation in Apache Santuario (Libraries, 8278008) (CVE-2022-21476) OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions (JAXP, 8270504) (CVE-2022-21426) OpenJDK: Improper object-to-string conversion in
An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). (CVE-2021-40391) An out-of-bounds write vulnerability exists in the RS-274X aperture macro
In unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line. (CVE-2022-34903)
Command Injection via hg argument (CVE-2022-24065) References: - https://bugs.mageia.org/show_bug.cgi?id=30570 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/HQKWT7SGFDCUPPLDIELTN7FVTHWDL5YK/
A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. (CVE-2022-0959)
Updated x11-server packages fix security vulnerabilities: ProcXkbSetGeometry Out-Of-Bounds Access. The handler for the ProcXkbSetGeometry request of the Xkb extension does not properly validate the request length leading to out of bounds memory
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since
The webkit2 package has been updated to version 2.36.4, fixing several security issues and other bugs. References: - https://bugs.mageia.org/show_bug.cgi?id=30608
A popup window could be resized in a way to overlay the address bar with web content. (CVE-2022-34479) Use-after-free in nsSHistory. (CVE-2022-34470)
Crafted multipart POST request may cause a DoS (CVE-2022-30122) Crafted requests can cause shell escape sequences (CVE-2022-30123) References: - https://bugs.mageia.org/show_bug.cgi?id=30584
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution (CVE-2022-2200). An attacker could have injected CSS into stylesheets accessible via internal
Set-Cookie denial of service. (CVE-2022-32205) HTTP compression denial of service. (CVE-2022-32206) Unpreserved file permissions. (CVE-2022-32207)
Denial of Service in Gopher Processing. (CVE-2021-46784) References: - https://bugs.mageia.org/show_bug.cgi?id=30578 -
Command Injection via git argument injection (CVE-2022-25648) References: - https://bugs.mageia.org/show_bug.cgi?id=30497 - https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./thread/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/
Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. (CVE-2021-33582)
The c_rehash script allows command injection. (CVE-2022-2068) References: - https://bugs.mageia.org/show_bug.cgi?id=30573 - https://openssl-library.org/news/secadv/20220621.txt
Bottle before 0.12.20 mishandles errors during early request binding. (CVE-2022-31799) References: - https://bugs.mageia.org/show_bug.cgi?id=30532
An attacker submitting the JWT token can choose the used signing algorithm (CVE-2022-29217) References: - https://bugs.mageia.org/show_bug.cgi?id=30485
This kernel update-linus is based on upstream 5.15.50 and fixes at least the following security issues: Incomplete cleanup of multi-core shared buffers for some Intel Processors may allow an authenticated user to potentially enable information disclosure
Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.
Cloud Security Cryptography Desktop Security Firewall Government Hacks/Cracks IoT Security Network Security Organizations/Events Privacy Security Projects Security Trends Security Vulnerabilities Server Security Vendors/Products
Debian Debian LTS Fedora Gentoo Mageia Oracle openSUSE RockyLinux Slackware SuSE Ubuntu
Harden My Filesystem Learn Tips and Tricks Secure My E-mail Secure My Firewall Secure My Network Secure My Webserver Strengthen My Privacy
Best Secure Linux Distros for Enhanced Privacy & Security The Truth About Linux Malware & How to Protect Your System Is Linux A More Secure Option Than Windows For Businesses? How Secure Is Linux? Top Tips for Securing Your Linux System
Advertise Contribute Your Article Legal Notice RSS Feeds Contact Us Terms of Service Privacy Policy
Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.
