Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Intel's "DOITM" Security Feature Not Intended For Always-On Use, Linux Patches To Be Revised
Last week I wrote about Linux developers evaluating a new "DOITM" security mitigation for the latest Intel CPUs . While the cost for now of engaging the Data O…
SciLinux: SLSA-2023-0403-1 Important: sssd on SL7.x x86_64
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters (CVE-2022-4254) For more details about the security issue(s), including the impact…
RedHat: RHSA-2023-0076:01 Moderate: Red Hat Ceph Storage 5.3 security
An update for ceph, cephadm-ansible, ceph-iscsi, python-dataclasses, and python-werkzeug is now available for Red Hat Ceph Storage 5.3. Red Hat Product Securit…
Debian: DSA-5313-1: hsqldb security update
It was found that those using java.sql.Statement or java.sql.PreparedStatement in hsqldb, a Java SQL database, to process untrusted input may be vulnerable to …
Ubuntu 5787-2: Libksba vulnerability
Libksba could be made to crash or run programs if it processed specially crafted data.
Ubuntu 5787-1: Libksba vulnerability
Libksba could be made to crash or run programs if it processed specially crafted data.
Critical Security Flaw Reported in Passwordstate Enterprise Password Manager
Multiple high-severity vulnerabilities have been disclosed in Passwordstate password management solution that could be exploited by an unauthenticated remote a…
Mageia 2022-0474: freerdp security update
Affected versions of FreeRDP are missing input length validation in 'drive' channel. A malicious server can trick a FreeRDP based client to read out of bound d…
Mageia 2022-0470: libetpan security update
Null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c. (CVE-2022-4121) References: - https://bugs.mageia.org/show_bu…
Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-ex…
Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities
Google on Tuesday announced the open source availability ofOSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various pro…
Debian LTS: DLA-3234-1: hsqldb security update
It was found that those using java.sql.Statement or java.sql.PreparedStatement in hsqldb, a Java SQL database, to process untrusted input may be vulnerable to …
Debian LTS: DLA-3226-1: cgal security update
When parsing files containing Nef polygon data, several memory access violations may happen. Many of these allow code execution. CVE-2020-28601
Debian LTS: DLA-3219-1: jhead security update
Jhead, a tool for manipulating EXIF data embedded in JPEG images, allowed attackers to execute arbitrary OS commands by placing them in a JPEG filename and the…
Debian: DSA-5294-1: jhead security update
Jhead, a tool for manipulating EXIF data embedded in JPEG images, allowed attackers to execute arbitrary OS commands by placing them in a JPEG filename and the…
Fedora 35: libetpan 2022-df2f4923ea
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Fedora 36: libetpan 2022-de3e565494
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Fedora 37: libetpan 2022-f092bc8f7b
A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimap_mailbox_data_status_free(). …
Debian LTS: DLA-3210-1: gerbv security update
Two vulnerabilities were discovered gerbv, a Gerber file viewer. Most Printed Circuit Board (PCB) design programs can export data to a Gerber file.
Mageia 2022-0437: freerdp security update
FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently con…
Debian LTS: DLA-3201-1: ntfs-3g security update
Yuchen Zeng and Eduardo Vela discovered a buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE, due to incorrect validation of some of the NTFS metada…
Debian LTS: DLA-3184-1: libjettison-java security update
It was discovered that libjettison-java, a collection of StAX parsers and writers for JSON, was vulnerable to a denial-of-service attack, if the attacker provi…
Debian: DSA-5270-1: ntfs-3g security update
Yuchen Zeng and Eduardo Vela discovered a buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE, due to incorrect validation of some of the NTFS metada…
Debian LTS: DLA-3176-1: clickhouse security update
Several security vulnerabilities were discovered in clickhouse, a column-oriented database system. The vulnerabilities require authentication, but can be trigg…