OS: Scientific
OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565) * OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689) (CVE-2021-35567) * OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550) * OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-3 [More...] |
OpenJDK: Loop in HttpsServer triggered during TLS session close (JSSE, 8254967) (CVE-2021-35565) * OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation (Libraries, 8266689) (CVE-2021-35567) * OpenJDK: Weak ciphers preferred over stronger ones for TLS (JSSE, 8264210) (CVE-2021-35550) * OpenJDK: Excessive memory allocation in RTFParser (Swing, 8265167) (CVE-2021-3 [More...] |
This update upgrades Thunderbird to version 91.2.0. * Mozilla: Use-after-free in MessageTask (CVE-2021-38496) * Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500) * Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501) * Mozilla: Downgrade attack on SMTP STARTTLS connections (CVE-2021-38502) * rust-crossb [More...] |
This update upgrades Firefox to version 91.2.0 ESR. * Mozilla: Use-after-free in MessageTask (CVE-2021-38496) * Mozilla: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 (CVE-2021-38500) * Mozilla: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 (CVE-2021-38501) * rust-crossbeam-deque: race condition may lead to double free (CVE-2021-32810) * Mozil [More...] |
OS: CentOS
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3438 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3494 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3498 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3338 |
OS: Mageia
This update provides the upstream 6.1.28 maintenance release that fixes atleast the following security vulnerabilities: Vulnerability in the Oracle VM VirtualBox prior to 6.1.28 contains an easily exploitable vulnerability that allows high privileged attacker with |
Do not include params in exception when a call to set_options fails. Additionally, block the exception that is returned from being displayed to stdout. (CVE-2021-3620) References: |
Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process, by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp |
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. (CVE-2021-30640) Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 |
CVEMAP.ORG: Vulnerabilities & Exposures
OS: Redhat
Red Hat Directory Server 11.4 is now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from |
Red Hat Advanced Cluster Management for Kubernetes 2.1.12 General Availability release images, which provide security fixes and update the container images. Red Hat Product Security has rated this update as having a security impact |
An update for java-11-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
OS: Debian
Several vulnerabilities were discovered in mailman, a web-based mailing list manager, which could result in arbitrary content injection via the options and private archive login pages, and CSRF attacks or privilege escalation via the user options page. |
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed files/streams are processed. |
Researchers at the United States of America National Security Agency (NSA) identified two denial of services vulnerability in strongSwan, an IKE/IPsec suite. |
Two security issues have been discovered in LibreOffice's support for digital signatures in ODF documents, which could result in incorrect signature indicators/timestamps being presented. |
OS: OpenSuse
An update that fixes one vulnerability is now available. |
An update that fixes one vulnerability is now available. |
An update that solves one vulnerability and has one errata is now available. |
An update that solves one vulnerability and has one errata is now available. |
OS: Suse
The container suse/sle15 was updated. The following patches have been included in this update: |
The container suse/sle15 was updated. The following patches have been included in this update: |
The container bci/golang was updated. The following patches have been included in this update: |
The container suse/sle15 was updated. The following patches have been included in this update: |
OS: Ubuntu
Several security issues were fixed in Mailman. |
Several security issues were fixed in the Linux kernel. |
Several security issues were fixed in the Linux kernel. |
libcaca could be made to crash if it received a specially crafted image. |
OS: Debian LTS
Several issues have been found in faad2, a freeware Advanced Audio Decoder player. They are related to heap buffer overflows or null pointer dereferences, which both might allow an attacker to execute code by |
Tenable discovered that in Babel, a set of tools for internationalizing Python applications, Babel.Locale allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. This |
Richard Weinberger reported that unsquashfs in squashfs-tools, the tools to create and extract Squashfs filesystems, does not check for duplicate filenames within a directory. An attacker can take advantage of this flaw |
A regression was introduced in DLA-2768-1, where the uwsgi proxy module for Apache2 (mod_proxy_uwsgi) interprets incorrect Apache configurations in a less forgiving way, causing existing setups to fail after upgrade. |
OS: Slackware
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. |
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
New alpine packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. |
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
Exploit-DB.com
NIST Vulnerability Database
OS: Fedora
- Release 3.6.2 |
Security fix for CVE-2021-39360 |
## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams This is a security release. ### Notable changes * **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at |
The newest upstream commit Security fix for CVE-2021-3778 Security fix for CVE-2021-3796 Security fix for CVE-2021-3875 Security fix for CVE-2021-3872 |
NIST Vulnerability Database
OS: Gentoo
Multiple vulnerabilities have been found in libsdl2, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in libyang, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Leptonica, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Apache Velocity, the worst of which could result in the arbitrary execution of code. |
OS: Arch
The package nodejs-lts-erbium before version 12.22.7-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. |
The package nodejs-lts-fermium before version 14.18.1-1 is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass. |
The package nodejs before version 16.11.1-1 is vulnerable to url request injection. |
The package virtualbox before version 6.1.28-1 is vulnerable to multiple issues including sandbox escape, denial of service and information disclosure. |