Mageia 2021-0292: openjpeg2 security update
A heap-based buffer overflow was found in openjpeg. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg (CVE-2021-3575). References:
A heap-based buffer overflow was found in openjpeg. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg (CVE-2021-3575). References:
A flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences (CVE-2021-20231). A flaw was found in gnutls. A use after free issue in client_send_params in
Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c (CVE-2020-36277). Leptonica before 1.80.0 allows a heap-based buffer over-read in findNextBorderPixel in ccbord.c (CVE-2020-36278).
A vulnerability was found in the iconv program provided by glibc when it's invoked with the -c option. It can enter an infinite loop while parsing an invalid multi-byte sequence (CVE-2016-10228). References:
A privilege escalation vulnerability was found in bash in the way it dropped privileges when started with an effective user id not equal to the real user id. Bash may be vulnerable to this flaw if the setuid permission is set and the owner of the bash program itself is a non-root user. A local attacker could exploit this flaw to escalate their privileges on the system
A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability (CVE-2020-27840).
Updated graphicsmagick packages fix security vulnerabilities: The graphicsmagick package has been updated to version 1.3.36, fixing several security issues and other bugs. See the upstream NEWS file for details.
A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case (CVE-2019-20052). References: - https://bugs.mageia.org/show_bug.cgi?id=27969
Updated stunnel package fixes security vulnerability: Client certificate not correctly verified when redirect and verifyChain options are used (CVE-2021-20230).
The kernel-linus update in MGASA-2021-0258 contained some security fixes that caused regressions in atleast some container and chroot setups. This update provides upstream 5.10.45 that adds follow-up fixes to resolve the regressions and other various security-related and other bugfixes.
The kernel update in MGASA-2021-0257 contained some security fixes that caused regressions in atleast some container and chroot setups. This update provides upstream 5.10.45 that adds follow-up fixes to resolve the regressions and other various security-related and other bugfixes.
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing
mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of- service (DoS) condition via unspecified vectors (CVE-2021-20718). References: - https://bugs.mageia.org/show_bug.cgi?id=29103
The DVB-S2-BB dissector could go into an infinite loop. References: - https://bugs.mageia.org/show_bug.cgi?id=29088 - https://www.wireshark.org/security/wnpa-sec-2021-05
An issue allowing to cause crash and locked screen bypass (CVE-2021-34557). References: - https://bugs.mageia.org/show_bug.cgi?id=29086 - https://www.openwall.com/lists/oss-security/2021/06/05/1
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity (CVE-2021-20208).
An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libslic3r 1.3.0 and Master Commit 92abbc42. A specially crafted AMF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability (CVE-2020-28591).
Incremental zone transfers (IXFR) provide a way of transferring changed portion(s) of a zone between servers. An IXFR stream containing SOA records with an owner name other than the transferred zone's apex may cause the receiving named server to inadvertently remove the SOA record for the zone in question from the zone database. This leads to an assertion failure when the
gnome-autoar: directory traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations (CVE-2021-28650). Also the previous update (Bug 28454) introduced a regression, fixed here.
An out-of-bounds write in decode_frame in libavcodec/exr.c because of errors in calculations of when to perform memset zero operations (CVE-2020-35965). References: - https://bugs.mageia.org/show_bug.cgi?id=28276