Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Ubuntu 5524-1: HarfBuzz vulnerability
HarfBuzz could be made to crash if it opened specially crafted data.
Debian: DSA-5185-1: mat2 security update
A directory traversal vulnerability was discovered in the Metadata anonymisation toolkit, which could result in information disclosure via a malformed ZIP arch…
Debian: DSA-5184-1: xen security update
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. In addition this updates provides mitigations …
Fedora 36: xen 2022-c4ec706488
Linux disk/nic frontends data leaks [XSA-403, CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-3374]
Fedora 36: xen 2022-925fc688c1
x86: MMIO Stale Data vulnerabilities [XSA-404, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166]
SciLinux: SLSA-2022-5239-1 Moderate: 389-ds-base on SL7.x x86_64
389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-099…
Mageia 2022-0240: libtiff security update
Heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c. (CVE-2022-1354) Stack-buffer-overflow in tiffcp.c in main(). (CVE-2022-1355) Out-of-bounds read…
Mageia 2022-0239: 389-ds-base security update
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can…
Fedora 35: kernel 2022-177a008b98
The 5.18.5 stable kernel update contains mitigation for the processor MMIO stale-data vulnerabilities. These are covered by CVE-2022-21166 CVE-2022-21125 and C…
Linux Botnets Now Exploit Critical Atlassian Confluence Bug
Several botnets are now using exploits targeting a critical remote code execution (RCE) vulnerability to infect Linux servers running unpatched Atlassian Confl…
Debian LTS: DLA-3035-1: libdbi-perl security update
It was discovered that CVE-2014-10401 was fixed incompletely in the Perl5 Database Interface (DBI). An attacker could trigger information disclosure through a …
RedHat: RHSA-2022-4786:01 Moderate: openvswitch2.13 security update
An update for openvswitch2.13 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a secu…
RedHat: RHSA-2022-4788:01 Moderate: openvswitch2.16 security update
An update for openvswitch2.16 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a secu…
Ubuntu 5424-2: OpenLDAP vulnerabili
OpenLDAP could be made to perform arbitrary modifications to the database.
Fedora 35: rubygem-nokogiri 2022-e9b2e1c1
This rpm backports the patch for the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, which is assigned as…
Fedora 36: rubygem-nokogiri 2022-00713284
New version 1.13.6 is released. This rpm addresses the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, wh…
Fedora 34: rubygem-nokogiri 2022-0e5d64ce
This rpm backports the patch for the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, which is assigned as…
Ubuntu 5424-1: OpenLDAP vulnerabili
OpenLDAP could be made to perform arbitrary modifications to the database.
Researchers Explain How Exploit Vanity URLs Could Allow Phishing Attacks
While vanity URLs have become a convenient way to personalize links, they also risk phishing…Researchers Explain How Exploit Vanity URLs Could Allow Phishing A…
Debian LTS: DLA-3001-1: libgoogle-gson-java security upda
It was discovered that the package com.google.code.gson:gson before 2.8.9 is vulnerable to Deserialization of Untrusted Data via the writeReplace() method in i…
Mageia 2022-0142: libarchive security upda
7zip reader: fix PPMD read beyond boundary. ZIP reader: fix possible out of bounds read. ISO reader: fix possible heap buffer overflow in read_children(). RARv…
Mageia 2022-0133: usbredir security upda
A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This iss…
New Vulnerability in CRI-O Engine Lets Attackers Escape Kubernetes Containers
A newly disclosed security vulnerability in the Kubernetes container engine CRI-O calledcr8escapecould be exploited by an attacker to break out of containers a…
Debian: DSA-5101-1: libphp-adodb security upda
Emmet Leahy reported that libphp-adodb, a PHP database abstraction layer library, allows to inject values into a PostgreSQL connection string. Depending on how…