Upstream details at : https://access.redhat.com/errata/RHSA-2021:2784 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2725 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2741 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:2683 |
The package jre-openjdk before version 16.0.2.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. |
The package jre-openjdk-headless before version 16.0.2.u7-1 is vulnerable to multiple issues including arbitrary code execution and information disclosure. |
The package lib32-libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. |
The package libcurl-gnutls before version 7.78.0-1 is vulnerable to multiple issues including information disclosure and insufficient validation. |
This update upgrades Firefox to version 78.12.0 ESR. * Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970) * Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976) * chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and [More...] |
XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE --- SL7 noarch - xstream-1.3.1-14.el7_9.noarch.rpm - xstream-javadoc-1.3.1-14.el7_9.noarch.rpm - Scientific Linux Development Team |
linuxptp: missing length check of forwarded messages (CVE-2021-3570) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE --- SL7 x86_64 - linuxptp-2.0-2.el7_9.1.x86_64.rpm - linuxptp-debuginfo-2.0-2.el7_9.1.x86_64.rpm - Scientific Linux Development Team |
kernel: Integer overflow in Intel(R) Graphics Drivers (CVE-2020-12362) * kernel: Use after free via PI futex state (CVE-2021-3347) * kernel: use-after-free in n_tty_receive_buf_common function in drivers/tty/n_tty.c (CVE-2020-8648) * kernel: Improper input validation in some Intel(R) Graphics Drivers (CVE-2020-12363) * kernel: Null pointer dereference in some Intel(R) Graphics Drivers (CVE [More...] |
An integer overflow bug in Redis version 6.0 or newer could be exploited using the `STRALGO LCS` command to corrupt the heap and potentially result with remote code execution (CVE-2021-29477). An integer overflow bug in Redis 6.2 before 6.2.3 could be exploited to corrupt |
This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true (CVE-2020-7774). |
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository (CVE-2021-3572). The bundled python-urllib3 was also vulnerable to: |
In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream (CVE-2021-21341). |
New curl packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
New kernel packages are available for Slackware 14.2 to fix a security issue. |
New polkit packages are available for Slackware 14.2 and -current to fix a security issue. |
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
Several security issues were fixed in the kernel. |
Several security issues were fixed in curl. |
Several security issues were fixed in Ruby. |
Several security issues were fixed in GNU binutils. |
It was discovered that the Key Distribution Center (KDC) in krb5, the MIT implementation of Kerberos, is prone to a NULL pointer dereference flaw. An unauthenticated attacker can take advantage of this flaw to cause a denial of service (KDC crash) by sending a request containing a |
Several vulnerabilities were discovered in lemonldap-ng, a Web-SSO system. The flaws could result in information disclosure, authentication bypass, or could allow an attacker to increase its authentication level or impersonate another user, especially when lemonldap-ng is configured |
The Qualys Research Labs discovered that an attacker-controlled allocation using the alloca() function could result in memory corruption, allowing to crash systemd and hence the entire operating system. |
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. |
Update to 91.0.4472.164. CVE-2021-30559 CVE-2021-30541 CVE-2021-30560 CVE-2021-30561 CVE-2021-30562 CVE-2021-30563 CVE-2021-30564 |
Upgrade to fossil 2.14.2 |
New upstream release. This is a security release for CVE-2021-36740 aka VSV00007 |
New upstream release. This is a security release for CVE-2021-36740 aka VSV00007 |
The container suse-sles-15-sp2-chost-byos-v20210722-gen2 was updated. The following patches have been included in this update: |
The container sles-15-sp2-chost-byos-v20210722 was updated. The following patches have been included in this update: |
The container suse-sles-15-sp2-chost-byos-v20210722-hvm-ssd-x86_64 was updated. The following patches have been included in this update: |
The container ses/7/rook/ceph was updated. The following patches have been included in this update: |
This update ships updated CPU microcode for some types of Intel CPUs and provides mitigations for security vulnerabilities which could result in privilege escalation in combination with VT-d and various side channel attacks. |
Two issue have been found in aspell, the GNU Aspell spell-checker. One issue is related to a stack-based buffer over-read via an isolated \ |
It was discovered that the previous upload of the package rabbitmq-server versioned 3.6.6-1+deb9u1 introduced a regression in function fmt_strip_tags. Big thanks to Christoph Haas for the reporting an issue and for testing the update. |
ooooooo_q discovered that the actionpack_page-caching Ruby gem, a static page caching module for Rails, allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view. |
An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability |
An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability |
An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
Updated dependency packages for ovirt-engine and ovirt-host that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which |
Multiple vulnerabilities have been found in libsdl2, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in libyang, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Leptonica, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Apache Velocity, the worst of which could result in the arbitrary execution of code. |
An update that fixes three vulnerabilities is now available. |
An update that solves one vulnerability, contains one feature and has 5 fixes is now available. |
An update that fixes four vulnerabilities is now available. |
An update that solves one vulnerability and has one errata is now available. |