You are here
News
DSA-6574-1 php8.4 - security update
It was discovered that incorrect memory state tracking in PHP, a
widely-used open source general purpose scripting language, could
result in the execution of arbitrary code.
Categories: Security
DSA-6573-1 firefox-esr - security update
This update blocks compromised intermediate certificates issued by the
eMudhra CA.
Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints.
Categories: Security
DSA-6572-1 ca-certificates - security update
It was discovered that several eMudhra intermediate CA certificates have
been compromised. Updated ca-certificate packages are provided to remove
the "emSign ECC Root CA - G3" and "Comodo AAA Services root"
certificates.
Categories: Security
DSA-6571-1 xen - security update
Multiple vulnerabilities have been discovered in the Xen hypervisor,
which could result in privilege escalation, information disclosure or
denial of service.
Categories: Security
DSA-6570-1 haproxy - security update
Two vulnerabilities were discovered in HAProxy, a fast and reliable load
balancing reverse proxy, which could result in denial of service.
Categories: Security
DSA-6567-2 cifs-utils - regression update
The update for cifs-utils announced in DSA 6567-1 introduced a
regression when using the sec=krb5 and cruid mount options. Updated
packages are now available to correct this issue.
Categories: Security
DSA-6569-1 apache2 - security update
Multiple vulnerabilities have been discovered in the Apache HTTP server,
which may result in denial of service, information disclosure,
authentication bypass or HTTP request smuggling.
Categories: Security
DSA-6568-1 linux - security update
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
Categories: Security
DSA-6567-1 cifs-utils - security update
Two vulnerabilities were discovered in cifs-utils, the Common Internet
File System utilities, which could result in privilege escalation.
Categories: Security
DSA-6566-1 expat - security update
Several vulnerabilities have been discovered in Expat, an XML parsing C
library, which could result in denial of service or potentially the
execution of arbitrary code, if a malformed XML file is processed.
Categories: Security
DSA-6565-1 spip - security update
A vulnerability was discovered in SPIP, a website engine for publishing,
which could result in unauthenticated remote code execution.
Categories: Security
DSA-6564-1 jpeg-xl - security update
It was discovered that missing input sanitising in the APNG parser in
the reference code implementation of the JPEG XL format could result
in denial of service or information disclosure if malformed images are
processed.
Categories: Security
DSA-6563-1 mutt - security update
It was discovered that incorrect parsing of Content-Type headers in the
Mutt mail user agent could result in denial of service or potentially
the execution of arbitrary code.
Categories: Security
DSA-6562-1 chromium - security update
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
Categories: Security
DSA-6561-1 sogo - security update
Multiple security vulnerabilities were discovered in the SOGo groupware
server, which could result in cross-site scripting, shell injection,
password reset poisoning or SQL injection.
Categories: Security
DSA-6560-1 firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code, sandbox escape, information disclosure, mitigation bypass or
privilege escalation.
Categories: Security
DSA-6559-1 buildstream - security update
It was discovered that missing validation of tar sources in the
Buildstream software integration tool could allow to write files on the
build host.
Categories: Security
DSA-6558-1 curl - security update
It was discovered that the cURL URL transfer library, is prone to a
use-after-free vulnerability when handling a HTTP/2 RST_STREAM received
by a server during an upload, which could result in remote code
execution.
Categories: Security
DSA-6557-1 ntfs-3g - security update
Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS
driver for FUSE, which could result in denial of service, information
leak or potentially local root privilege escalation.
Categories: Security
DSA-6556-1 nagios4 - security update
Multiple security vulnerabilities were discovered in the Nagios
monitoring system, which could result in cross-site request forgery,
cross-site scripting or the execution of arbitrary commands.
Categories: Security
Pages
Co-authored by Creative Contingencies's Peter Lieverdink.