ghex-42.3-1.fc36
Update to 42.3
main: Hotfix to workaround gtk #4880 (affects Save As dialogs on X11
primarily)
config: Add GNOME 42+ compatibility for dark mode, and fetch dark settings
from portal if possible
widget: Properly update highlights upon resize
find-replace: Remove spurious g_object_ref() call
Hosein Askari discovered that ncurses was incorrectly performing
memory management operations when dealing with long filenames while
writing structures into the file system. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary
code. (CVE-2017-16879)
Chung-Yi Lin discovered that ncurses was incorrectly handling access
to invalid memory areas when parsing terminfo or termcap entries where
the use-name had invalid syntax. An attacker could possibly use this
issue to cause a denial of service. (CVE-2018-19211)
It was discovered that ncurses was incorrectly performing bounds
checks when processing invalid hashcodes. An attacker could possibly
use this issue to cause a denial of service or to expose sensitive
information. (CVE-2019-17594)
It was discovered that ncurses was incorrectly handling
end-of-string characters when processing terminfo and termcap files.
An attacker could possibly use this issue to cause a denial of
service or to expose sensitive information. (CVE-2019-17595)
It was discovered that ncurses was incorrectly handling
end-of-string characters when converting between termcap and
terminfo formats. An attacker could possibly use this issue to cause
a denial of service or execute arbitrary code. (CVE-2021-39537)
It was discovered that ncurses was incorrectly performing bounds
checks when dealing with corrupt terminfo data while reading a
terminfo file. An attacker could possibly use this issue to cause a
denial of service or to expose sensitive information.
(CVE-2022-29458)
vim-8.2.5085-1.fc35
The newest upstream commit
Security fix for CVE-2022-2000
When I started working in cybersecurity 20 years ago, there were a few rock-solid security technology principles treated as gospel. One of those was the insistence on best-of-breed security technologies. Those of you working in security in the early 2000s may remember installing independent firewall and antivirus software on every endpoint.
Best-of-breed technologies were then combined as part of another time-honored principle—defense-in-depth. In theory, best-of-breed technologies would complement one another for incremental security protection.
During the intervening years, the best-of-breed mentality was imbued within cybersecurity culture, while individuals and groups closely protected their preferred technologies. Your organization was a McAfee or Symantec shop and used Check Point, Cisco, or Fortinet firewalls. Security “server huggers” saw any suggestion of change as blasphemy.
Over the past several years, the emergence of big-ticket, destructive ransomware attacks jolted the U.S. government into action to circumscribe the predominately Russian-based threat actors behind the scourge. At the same time, ransomware has been a critical factor driving the growth in corporate cybersecurity budgets as organizations grapple with the often-crippling threat.
Despite the policy measures and increased private sector funding to slow down the drumbeat of attacks, ransomware threats remained a top topic at this year’s RSA conference. Experts at the event underscored that Russian state-sanctioned criminal actors are not the only ransomware threat actors to fear, nor are ransomware attacks decreasing despite the intensified efforts to nip them in the bud. The same actions taken to quash ransomware activity might end up forging alliances among financially motivated threat actors to create hybrid cyber-attacks that meld social engineering with ransomware.
Multiple breaches, including the massive 2017 data breach at the credit reporting agency Equifax, have been traced back to unpatched vulnerabilities—a 2019 Tripwire study found that 27% of all breaches were caused by unpatched vulnerabilities, while a 2018 Ponemon study put the number at a jaw-dropping 60%.
golang-github-emicklei-restful-3.8.0-1.fc35
Update to 3.8.0. Fixes rhbz#1948196.
Mitigate CVE-2022-1996.
