liblouis-3.22.0-1.fc36
Fixes CVE-2022-26981, CVE-2022-31783, and further issues.
A detailed list of changes can be found at http://liblouis.org/liblouis/2022/06/07/liblouis-release-3.22.0.html
python-bottle-0.12.21-1.el8
Security fix for CVE-2022-31799
python-bottle-0.12.21-1.el9
Security fix for CVE-2022-31799
Elton Nokaj discovered that incorrect error handling in Bottle, a WSGI
framework for Python, could result in the disclosure of sensitive
information.
rubygem-jmespath-1.3.1-1.el7
Security fix for for CVE-2022-32511 and update to 1.3.1
rubygem-jmespath-1.6.1-1.fc35
Security fix for CVE-2022-32511 (update to 1.6.1)
rubygem-jmespath-1.6.1-1.fc36
Security fix for CVE-2022-32511 (update to 1.6.1)
USN-5396-1 addressed a vulnerability in Ghostscript. This update
provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Ghostscript incorrectly handled certain PostScript
files. If a user or automated system were tricked into processing a
specially crafted file, a remote attacker could possibly use this issue to
access arbitrary files, execute arbitrary code, or cause a denial of
service.
It was dicovered that Varnish Cache did not clear a pointer between the
handling of one client request and the next request within the same connection.
A remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2019-20637)
It was discovered that Varnish Cache could have an assertion failure when a
TLS termination proxy uses PROXY version 2. A remote attacker could possibly
use this issue to restart the daemon and cause a performance loss.
(CVE-2020-11653)
It was discovered that Varnish Cache allowed request smuggling and VCL
authorization bypass via a large Content-Length header for a POST
request. A remote attacker could possibly use this issue to obtain sensitive
information. (CVE-2021-36740)
It was discovered that Varnish Cache allowed request smuggling for HTTP/1
connections. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2022-23959)
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by out-of-bound read/write and can be exploited by attackers to make denial of service.
