Read Time:8 Second
FEDORA-EPEL-2023-342b96903b
Packages in this update:
zarafa-7.1.14-6.el7
Update description:
Backported patch from Debian to fix CVE-2022-26562 (#2192126)
Category Archives: Advisories
golang-github-prometheus-alertmanager-0.23.0-15.fc39
Read Time:54 Second
FEDORA-2023-0c6723004f
Packages in this update:
golang-github-prometheus-alertmanager-0.23.0-15.fc39
Update description:
Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39.
Changelog
* Sat Apr 29 2023 Sérgio M. Basto <sergio@serjux.com> – 0.23.0-15
– Include s390x, and disable tests because it is failing
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> – 0.23.0-14
– Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Wed Aug 10 2022 Maxwell G <gotmax@e.email> – 0.23.0-13
– Rebuild to fix FTBFS
* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> – 0.23.0-12
– Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Tue Jul 19 2022 Maxwell G <gotmax@e.email> – 0.23.0-11
– Rebuild for
CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang
* Thu Jun 23 2022 Maxwell G <gotmax@e.email> – 0.23.0-10
– Rebuild to mitigate CVE-2022-21698 (rhbz#2067400).
CVE-2020-21643
Read Time:7 Second
Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
CVE-2020-23647
Read Time:10 Second
Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form.
CVE-2022-31643
Read Time:10 Second
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.
USN-6049-1: Netty vulnerabilities
Read Time:1 Minute, 59 Second
It was discovered that Netty’s Zlib decoders did not limit memory
allocations. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. This issue only affected Ubuntu 16.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-11612)
It was discovered that Netty created temporary files with excessive
permissions. A local attacker could possibly use this issue to expose
sensitive information. This issue only affected Ubuntu 16.04 ESM, Ubuntu
18.04 ESM, and Ubuntu 20.04 ESM. (CVE-2021-21290)
It was discovered that Netty did not properly validate content-length
headers. A remote attacker could possibly use this issue to smuggle
requests. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2021-21295,
CVE-2021-21409)
It was discovered that Netty’s Bzip2 decompression decoder did not limit
the decompressed output data size. A remote attacker could possibly use
this issue to cause Netty to exhaust memory via malicious input, leading
to a denial of service. This issue only affected Ubuntu 18.04 ESM, Ubuntu
20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-37136)
It was discovered that Netty’s Snappy frame decoder function did not limit
chunk lengths. A remote attacker could possibly use this issue to cause
Netty to exhaust memory via malicious input, leading to a denial of
service. (CVE-2021-37137)
It was discovered that Netty did not properly handle control chars at the
beginning and end of header names. A remote attacker could possibly use
this issue to smuggle requests. This issue only affected Ubuntu 18.04 ESM,
Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2021-43797)
It was discovered that Netty could be made into an infinite recursion when
parsing a malformed crafted message. A remote attacker could possibly use
this issue to cause Netty to crash, leading to a denial of service. This
issue only affected Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu 22.10.
(CVE-2022-41881)
It was discovered that Netty did not validate header values under certain
circumstances. A remote attacker could possibly use this issue to perform
HTTP response splitting via malicious header values. This issue only
affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM, Ubuntu 22.04 LTS, and Ubuntu
22.10. (CVE-2022-41915)
cloud-init-23.1.2-1.fc38
Read Time:8 Second
FEDORA-2023-c17dde4052
Packages in this update:
cloud-init-23.1.2-1.fc38
Update description:
Update to 23.1.2 and fix CVE-2023-1786
USN-6037-1: Apache Commons Net vulnerability
Read Time:15 Second
ZeddYu Lu discovered that the FTP client from Apache Commons Net trusted
the host from PASV responses by default. A remote attacker with a
malicious FTP server could redirect the client to another server, which
could possibly result in leaked information about services running on the
private network of the client.
USN-6048-1: ZenLib vulnerability
Read Time:9 Second
It was discovered that ZenLib doesn’t check the return value of a specific
operation before using it. An attacker could use a specially crafted input
to crash programs using the library.
Piwigo – CVE-2023-26876
Read Time:13 Second
Posted by Rodolfo Tavares via Fulldisclosure on Apr 28
=====[ Tempest Security Intelligence – ADV-03/2023
]==========================
Piwigo – Version 13.5.0
Author: Rodolfo Tavares
Tempest Security Intelligence – Recife, Pernambuco – Brazil
=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgments
* References
=====[ Vulnerability…