A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system integrity (CVE-2019-17566). . MGASA-2021-0168 - Updated batik packages fix security vulnerabilities Publication date: 02 Apr 2021 URL: https://advisories.mageia.org/MGASA-2021-0168.html Type: security Affected Mageia releases: 7 CVE: CVE-2019-17566, CVE-2020-11987 A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack (SSRF) via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system integrity (CVE-2019-17566). The Apache Batik library is vulnerable to SSRF via the NodePickerPanel that allow an attacker to cause the underlying server to make arbitrary GET requests (CVE-2020-11987). References: - https://bugs.mageia.org/show_bug.cgi?id=26800 - https://www.openwall.com/lists/oss-security/2021/02/24/2 - https://xmlgraphics.apache.org/security.html - https://lists.fedoraproject.org/archives/list/
Code was executed even if noexec ("-n") was specified. (bdo#58288 / bsc#1178978) References: - https://bugs.mageia.org/show_bug.cgi?id=27655 . MGASA-2021-0006 - Updated dash packages fix a security vulnerability Publication date: 08 Jan 2021 URL: https://advisories.mageia.org/MGASA-2021-0006.html Type: security Affected Mageia releases: 7 Code was executed even if noexec ("-n") was specified. (bdo#58288 / bsc#1178978) References: - https://bugs.mageia.org/show_bug.cgi?id=27655 - https://www.openwall.com/lists/oss-security/2020/11/11/3 - https://www.openwall.com/lists/oss-security/2020/11/12/1 - https://lists.suse.com/pipermail/sle-security-updates/2020-November/007839.html - SRPMS: - 7/core/dash-0.5.10.2-1.1.mga7 . Dash components refreshed to rectify a vulnerability that enabled execution even when noexec was set. Insights included.. dash Security Update,Mageia Advisory,Execution Risk,Mageia Update. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.