OS: Slackware
New bind packages are available for Slackware 15.0 and -current to fix security issues. |
New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. |
New expat packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix a security issue. |
New vim packages are available for Slackware 15.0 and -current to fix a security issue. |
OS: Suse
The container suse-sles-15-sp4-chost-byos-v20220923-hvm-ssd-x86_64 was updated. The following patches have been included in this update: |
The container suse-sles-15-sp4-chost-byos-v20220923-x86_64-gen2 was updated. The following patches have been included in this update: |
An update that fixes one vulnerability is now available. |
An update that fixes two vulnerabilities is now available. |
OS: Redhat
Red Hat OpenShift Virtualization release 4.9.6 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
Red Hat OpenShift Container Platform release 4.10.33 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. |
Red Hat OpenShift Container Platform release 4.11.5 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. |
An update for booth is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from |
OS: Ubuntu
Several security issues were fixed in the Linux kernel. |
Python could be made to redirect web traffic if its http.server received a specially crafted request. |
Several security issues were fixed in libjpeg-turbo. |
OAuthLib could be made to crash if it received specially crafted network traffic. |
OS: OpenSuse
An update that solves two vulnerabilities and has two fixes is now available. |
An update that fixes one vulnerability is now available. |
An update that fixes two vulnerabilities is now available. |
An update that fixes one vulnerability is now available. |
NIST Vulnerability Database
CVEMAP.ORG: Vulnerabilities & Exposures
OS: Gentoo
Multiple vulnerabilities have been found in Oracle JDK and JRE, the worst of which could result in the arbitrary execution of code. |
Multiple vulnerabilities have been discovered in Fetchmail, the worst of which could result in email disclosure to third parties. |
Multiple vulnerabilities have been discovered in libaacplus, the worst of which could result in denial of service. |
Multiple vulnerabilities have been discovered in GRUB, the worst of which may allow for secureboot bypass. |
OS: Fedora
**Redis 7.0.5** - Released Wed Sep 21 20:00:00 IST 2022 Upgrade urgency: SECURITY, contains fixes to security issues. Security Fixes: * (**CVE-2022-35951**) Executing a XAUTOCLAIM command on a stream key in a specific state, with a specially crafted COUNT argument, may cause an integer overflow, a subsequent heap overflow, and potentially lead to remote code |
Update to 102.3.0 ; https://www.mozilla.org/en- US/security/advisories/mfsa2022-42/ ; https://www.thunderbird.net/en- US/thunderbird/102.3.0/releasenotes/ |
Update Gajim to 1.5.1 (and python-nbxmpp to 3.2.2) |
Update Gajim to 1.5.1 (and python-nbxmpp to 3.2.2) |
Exploit-DB.com
OS: Debian LTS
Several security vulnerabilities have been discovered in Poppler, a PDF rendering library, that could lead to denial of service or possibly other unspecified impact when processing maliciously crafted documents. |
Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a |
Sandipan Roy discovered two vulnerabilities in InfoZIP's unzip program, a de-archiver for .zip files, which could result in denial of service or potentially the execution of arbitrary code. |
Several security vulnerabilities were discovered in mediawiki, a website engine for collaborative work. Insufficiently escaped input text may allow a malicious user to perform cross-site-scripting (XSS) attacks. |
OS: Scientific
open-vm-tools: local root privilege escalation in the virtual machine (CVE-2022-31676) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 open-vm-tools-11.0.5-3.el7_9.4.x86_64.rpm open-vm-tools-debuginfo-11.0.5-3.el7_9.4.x86_64.rpm open-vm-tools-desktop-11.0.5-3.el7_9.4.x8 [More...] |
systemd-resolved: use-after-free when dealing with DnsStream in resolved-dns-stream.c (CVE-2022-2526) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 libgudev1-219-78.el7_9.7.i686.rpm libgudev1-219-78.el7_9.7.x86_64.rpm systemd-219-78.el7_9.7.x86_64.rpm systemd-debu [More...] |
This update upgrades Firefox to version 91.13.0 ESR. * Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472) * Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473) * Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 (CVE-2022-38477) * Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and F [More...] |
This update upgrades Thunderbird to version 91.13.0. * Mozilla: Address bar spoofing via XSLT error handling (CVE-2022-38472) * Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions (CVE-2022-38473) * Mozilla: Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 (CVE-2022-38477) * Mozilla: Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and F [More...] |
OS: Mageia
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead (CVE-2022-40956). By injecting a cookie with certain special characters, an attacker on a |
A buffer overflow issue which may lead to arbitrary code execution was addressed with improved memory handling. (CVE-2022-32886) Visiting a website that frames malicious content may lead to UI spoofing. he issue was addressed with improved UI handling. (CVE-2022-32891) |
tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c. (CVE-2022-27939) tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get_ipv6_next in common/get.c. (CVE-2022-27940) |
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead (CVE-2022-40956). By injecting a cookie with certain special characters, an attacker on a |
OS: CentOS
Upstream details at : https://access.redhat.com/errata/RHSA-2022:6381 |
Upstream details at : https://access.redhat.com/errata/RHSA-2022:6170 |
Upstream details at : https://access.redhat.com/errata/RHSA-2022:6160 |
Upstream details at : https://access.redhat.com/errata/RHSA-2022:6169 |
NIST Vulnerability Database
OS: Debian
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, CSP bypass or session fixation. |
Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed. |
Several vulnerabilities were discovered in BIND, a DNS server implementation. CVE-2022-2795 |
An arbitrary code execution vulnerability was disovered in fish, a command line shell. When using the default configuraton of fish, changing to a directory automatically ran `git` commands in order to display information about the current repository in the prompt. Such |
OS: Arch
The package python-django before version 4.0.4-1 is vulnerable to sql injection. |
The package xz before version 5.2.5-3 is vulnerable to arbitrary command execution. |
The package gzip before version 1.12-1 is vulnerable to arbitrary command execution. |
The package libtiff before version 4.3.0-2 is vulnerable to multiple issues including arbitrary code execution and denial of service. |