Happy Friday fellow Linux geeks! This week, Firefox announced serious vulnerabilities that affect your privacy when browsing online have been fixed. We encourage everyone to update their browsers immediately. Multiple high-severity remote code execution vulnerabilities that affect PostgreSQL 10.x versions have also been fixed this week.

Read on to learn about how you can update your systems to obtain these fixes for your distribution.

Yours in Open Source,

Brittany Signature 150 Esm W150

python-django

The Discovery 

Several security vulnerabilities have been found in python-django. It was discovered that Storage.save allowed directory traversal if crafted filenames were passed directly to it (CVE-2021-45452), the {% debug %} template tag did not properly encode the current context (CVE-2022-22818), and the HTTP MultiPartParser had a issue whereby certain inputs to multipart forms could result in an infinite loop when parsing uploaded files (CVE-2022-23833).

Python Esm W225

The Impact

These flaws could result in cross-site scripting (XSS) attacks.

The Fix

A python-django security update that fixes these bugs has been released. We recommend that you update now to protect against attacks and compromise.

Your Related Advisories:

Register to Customize Your Advisories

Firefox

The Discovery 

Multiple security issues have been discovered in the Mozilla Firefox web browser (CVE-2022-45403, CVE-2022-45404, CVE-2022-45405 and CVE-2022-45406).


Firefox Esm W220

The Impact

These bugs could potentially result in the execution of arbitrary code, information disclosure, or spoofing.

The Fix

A security update for Firefox has been released that mitigates these flaws. We recommend that you upgrade your firefox-esr packages as soon as possible to protect the security and integrity of your systems and the privacy of your sensitive information.

Your Related Advisories:

Register to Customize Your Advisories

PostgreSQL

The Discovery

Multiple high-severity vulnerabilities have been discovered in PostgreSQL (CVE-2021-3677, CVE-2021-23214, CVE-2021-23222, CVE-2021-32027, CVE-2021-32028, CVE-2022-1552 and CVE-2022-2625).

The Impact

These bugs could result in remote code execution.

Postgresql Esm W221

The Fix

All PostgreSQL 10.x users should upgrade to the latest version immediately to protect against exploits and compromise.

Your Related Advisories:

Register to Customize Your Advisories