OS: Arch
The package chromium before version 96.0.4664.45-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, content spoofing, information disclosure, same-origin policy bypass, sandbox escape and denial of service. |
The package opera before version 81.0.4196.54-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation and access restriction bypass. |
The package kubectl-ingress-nginx before version 1.0.4-1 is vulnerable to information disclosure. |
The package grafana before version 8.2.4-1 is vulnerable to access restriction bypass. |
OS: Mageia
In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. This is similar to CVE-2018-20685. (CVE-2019-7282) |
Integer-overflow in Imf_3_1::bytesPerDeepLineTable. (CVE-2021-3933) Divide-by-zero in Imf_3_1::RGBtoXYZ. (CVE-2021-3941) References: - https://bugs.mageia.org/show_bug.cgi?id=29657 |
Server processes unencrypted bytes from man-in-the-middle. (CVE-2021-23214) libpq processes unencrypted bytes from man-in-the-middle. (CVE-2021-23222) References: |
All FreeRDP clients prior to version 2.4.1 using gateway connections ('/gt:rpc') fail to validate input data. A malicious gateway might allow client memory to be written out of bounds. This issue has been resolved in version 2.4.1. If you are unable to update then use `/gt:http` rather than /gt:rdp connections if possible or use a direct connection without a |
OS: Redhat
Red Hat OpenShift Container Platform release 4.7.38 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
Updated Red Hat JBoss Web Server 5.6.0 packages are now available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, |
An update for samba is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which |
OS: CentOS
Upstream details at : https://access.redhat.com/errata/RHSA-2021:4134 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3841 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:4116 |
Upstream details at : https://access.redhat.com/errata/RHSA-2021:3791 |
OS: Ubuntu
Several security issues were fixed in the Linux kernel. |
Several security issues were fixed in the Linux kernel. |
Several security issues were fixed in the Linux kernel. |
Several security issues were fixed in the Linux kernel. |
OS: Suse
The container bci/openjdk was updated. The following patches have been included in this update: |
The container bci/openjdk-devel was updated. The following patches have been included in this update: |
The container suse/sles12sp4 was updated. The following patches have been included in this update: |
The container suse/sles12sp3 was updated. The following patches have been included in this update: |
OS: Debian LTS
Two heap overflows were fixed in the rsyslog logging daemon. CVE-2019-17041 |
Out-of-bounds read for an incomplete URI with an IPv6 address containing an embedded IPv4 address has been fixed in uriparser, a library to parse Uniform Resource Identifiers (URIs). |
In rsync, a remote file-copying tool, remote attackers were able to bypass the argument-sanitization protection mechanism by passing additional --protect-args. |
Several vulnerabilities were fixed in the OpenSC smart card utilities. CVE-2019-15945 |
OS: OpenSuse
An update that fixes 16 vulnerabilities is now available. |
An update that fixes one vulnerability is now available. |
An update that fixes 16 vulnerabilities is now available. |
An update that fixes 16 vulnerabilities is now available. |
NIST Vulnerability Database
OS: Scientific
openssh: privilege escalation when AuthorizedKeysCommand or AuthorizedPrincipalsCommand are configured (CVE-2021-41617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 openssh-7.4p1-22.el7_9.x86_64.rpm openssh-askpass-7.4p1-22.el7_9.x86_64.rpm openssh-clients-7.4p1-22.e [More...] |
krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field (CVE-2021-37750) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 krb5-debuginfo-1.15.1-51.el7_9.i686.rpm krb5-debuginfo-1.15.1-51.el7_9.x86_64.rpm krb5- [More...] |
kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after- free (CVE-2020-36385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE Bug Fix(es): * scsi: ibmvfc: Avoid link down on FS9100 canister reboot * crash in qla2x00_status_entry() because of corrupt srb * qedf driver: race c [More...] |
rpm: Signature checks bypass via corrupted rpm package (CVE-2021-20271) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 rpm-4.11.3-48.el7_9.x86_64.rpm rpm-build-4.11.3-48.el7_9.x86_64.rpm rpm-build-libs-4.11.3-48.el7_9.i686.rpm rpm-build-libs-4.11.3-48.el7_9.x86_64. [More...] |
OS: Fedora
guests may exceed their designated memory limit [XSA-385, CVE-2021-28706] PoD operations on misaligned GFNs [XSA-388, CVE-2021-28704, CVE-2021-28707 CVE-2021-28708] issues with partially successful P2M updates on x86 [XSA-389, CVE-2021-28705, CVE-2021-28709] certain VT-d IOMMUs may not work in shared page table mode [XSA-390, CVE-2021-28710] |
Update containerd and moby-engine - Security fix for CVE-2021-41190 |
Update containerd and moby-engine - Security fix for CVE-2021-41190 |
Update containerd and moby-engine - Security fix for CVE-2021-41190 |
CVEMAP.ORG: Vulnerabilities & Exposures
NIST Vulnerability Database
OS: Gentoo
Multiple vulnerabilities have been found in libsdl2, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in libyang, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Leptonica, the worst of which could result in a Denial of Service condition. |
Multiple vulnerabilities have been found in Apache Velocity, the worst of which could result in the arbitrary execution of code. |
Exploit-DB.com
OS: Slackware
New bind packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. |
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. |
New httpd packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. |
New alpine packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. |
OS: Debian
Andrew Bartlett discovered that Samba, a SMB/CIFS file, print, and login server for Unix, may map domain users to local users in an undesired way. This could allow a user in an AD domain to potentially become root on domain members. |
Rongxin Wu discovered a use-after-free vulnerability in the International Components for Unicode (ICU) library which could result in denial of service or potentially the execution of arbitrary code. |
It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, did not properly sanitize requests and mail messages. This would allow an attacker to perform Cross-Side Scripting (XSS) or SQL injection attacks. |
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, incorrect Kerberos ticket use, selection of weak ciphers or information disclosure. |