Daily Archives: February 20, 2023

Advisories

flatpak-runtime-f37-3720230216035716.1 flatpak-sdk-f37-3720230216035716.1

Read Time:19 Second

FEDORA-FLATPAK-2023-41da5c11ed

Packages in this update:

flatpak-runtime-f37-3720230216035716.1
flatpak-sdk-f37-3720230216035716.1

Update description:

Updated flatpak runtime and SDK, including latest Fedora 37 security and bug-fix errata.

Specifically, one of the updated packages is nss 3.88.1 that is required by latest thunderbird 102.8.0 flatpak: https://bodhi.fedoraproject.org/updates/FEDORA-FLATPAK-2023-39d93f840d

Read More

Advisories

CVE-2015-10081

Read Time:23 Second

A vulnerability was found in arnoldle submitByMailPlugin 1.0b2.9 and classified as problematic. This issue affects some unknown processing of the file edit_list.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 1.0b2.9a is able to address this issue. The name of the patch is a739f680a1623d22f52ff1371e86ca472e63756f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221495.

Read More

Advisories

clamav-0.103.8-3.el7

Read Time:57 Second

FEDORA-EPEL-2023-466d8ae059

Packages in this update:

clamav-0.103.8-3.el7

Update description:

Fix daily.cvd file
Split out documentation into separate -doc sub-package
(#2128276) Please port your pcre dependency to pcre2
Explicit dependency on systemd since systemd-devel no longer has this dependency on F37+
(#2136977) not requires data(clamav) on clamav-libs
(#2023371) Add documentation to preserve user permissions of DatabaseOwner

ClamAV 0.103.8 is a critical patch release with the following fixes:

CVE-2023-20032https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

CVE-2023-20052https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

Read More

Advisories

clamav-0.103.8-3.fc36

Read Time:57 Second

FEDORA-2023-3ba365d538

Packages in this update:

clamav-0.103.8-3.fc36

Update description:

Fix daily.cvd file
Split out documentation into separate -doc sub-package
(#2128276) Please port your pcre dependency to pcre2
Explicit dependency on systemd since systemd-devel no longer has this dependency on F37+
(#2136977) not requires data(clamav) on clamav-libs
(#2023371) Add documentation to preserve user permissions of DatabaseOwner

ClamAV 0.103.8 is a critical patch release with the following fixes:

CVE-2023-20032https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20032: Fixed a possible remote code execution vulnerability in the HFS+ file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

CVE-2023-20052https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20052: Fixed a possible remote information leak vulnerability in the DMG file parser. The issue affects versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier. Thank you to Simon Scannell for reporting this issue.

Read More