A heap-based buffer overflow vulnerability was found in the blosc library. Depending on how the library is used, if there is a lack of space to write compressed data, an attacker might exploit this flaw to crash the program or potentially execute arbitrary code (CVE-2020-29367).
The php-oojs-oojs-ui package has been updated to version 0.41.0 to pick up all of the latest fixes from upstream mediawiki. References: - https://bugs.mageia.org/show_bug.cgi?id=27824
The crm configure and hb_report commands failed to sanitize sensitive information by default (bsc#1163581). An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands
An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. (CVE-2019-20919).
This kernel update is based on upstream 5.10.8 and fixes atleast the following security issue: SCSI “EXTENDED COPY” (XCOPY) requests sent to a Linux SCSI target (LIO) allow an attacker to read or write anywhere on any LIO backstore configured
It was discovered that OpenLDAP incorrectly handled certain malformed inputs. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2020-25709, CVE-2020-25710). References:
Multiple vulnerabilities related to unsafe tempfile usage (bsc#1146690, bsc#1146691, bsc#1146692, bsc#1146766, bsc#1146776, bsc#1146784, bsc#1146785, bsc#1146787). Issues where the ocfmon user was created with a default password (bsc#1021689,
The updated packages fix security vulnerabilities. See upstream releasenotes. References:
An issue in caribou, that was exposed by a CVE fix in X.org server, permits a screensaver-lock bypass. It is possible to crash the screensaver and unlock the desktop via the virtual keyboard. References:
