Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. . MGASA-2025-0175 - Updated golang packages fix security vulnerabilities Publication date: 02 Jun 2025 URL: https://advisories.mageia.org/MGASA-2025-0175.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-22870, CVE-2025-22871 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied - CVE-2025-22870. The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext - CVE-2025-22871. References: - https://bugs.mageia.org/show_bug.cgi?id=34078 - https://www.openwall.com/lists/oss-security/2025/03/07/2 - https://www.openwall.com/lists/oss-security/2025/04/04/4 - https://lists.fedoraproject.org/archives/list/
Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506). Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788). . MGASA-2019-0116 - Updated firefox packages fix security vulnerability Publication date: 21 Mar 2019 URL: https://advisories.mageia.org/MGASA-2019-0116.html Type: security Affected Mageia releases: 6 CVE: CVE-2018-18506, CVE-2019-9788, CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9793, CVE-2019-9795, CVE-2019-9796 Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506). Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788). Use-after-free when removing in-use DOM elements (CVE-2019-9790). Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791). IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792). Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793). Type-confusion in IonMonkey JIT compiler (CVE-2019-9795). Use-after-free with SMIL animation controller (CVE-2019-9796). References: - https://bugs.mageia.org/show_bug.cgi?id=24534 - https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ - https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ - https://access.redhat.com/errata/RHSA-2019:0622 - https://www.cve.org/CVERecord?id=CVE-2018-18506 - https://www.cve.org/CVERecord?id=CVE-2019-9788 - https://www.cve.org/CVERecord?id=CVE-2019-9790 - https://www.cve.org/CVERecord?id=CVE-2019-9791 - https://www.cve.org/CVERecord?id=CVE-2019-9792 - https://www.cve.org/CVERecord?id=CVE-2019-9793 - https://www.cve.org/CVERecord?id=CVE-2019-9795 - https://www.cve.org/CVERecord?id=CVE-2019-9796 SRPMS: - 6/core/firefox-60.6.0-2.mga6 - 6/core/firefox-l10n-60.6.0-1.mga6 - 6/core/nspr-4.21-1.mga6 - 6/core/rootcerts-20190306.00-1.mga6 - 6/core/nss-3.36.7-1.1.mga6 . The Opera browser received its latest upgrade on Fedora on April 15,2020, tackling important vulnerabilities and enhancing user experience.. Firefox Update, Mageia Security, Memory Bugs Fix, Proxy Auto-Configuration, Software Update. . LinuxSecurity.com Team
Moderate: libproxy security update. Date: Thu, 15 Nov 2012 08:45:18 -0600 Reply-To: Pat Riehecky Sender: Security Errata for Scientific Linux From: Pat Riehecky Organization: Fermilab Subject: Security ERRATA Moderate: libproxy on SL6.x i386/x86_64 MIME-Version: 1.0 Synopsis: Moderate: libproxy security update Issue Date: 2012-11-14 CVE Numbers: CVE-2012-4505 -- A buffer overflow flaw was found in the way libproxy handled the downloading of proxy auto-configuration (PAC) files. A malicious server hosting a PAC file or a man-in-the-middle attacker could use this flaw to cause an application using libproxy to crash or, possibly, execute arbitrary code, if the proxy settings obtained by libproxy (from the environment or the desktop environment settings) instructed the use of a PAC proxy configuration. (CVE-2012-4505) All applications using libproxy must be restarted for this update to take effect. -- SL6 x86_64 libproxy-0.3.0-3.el6_3.i686.rpm libproxy-0.3.0-3.el6_3.x86_64.rpm libproxy-bin-0.3.0-3.el6_3.x86_64.rpm libproxy-python-0.3.0-3.el6_3.x86_64.rpm libproxy-devel-0.3.0-3.el6_3.i686.rpm libproxy-devel-0.3.0-3.el6_3.x86_64.rpm libproxy-gnome-0.3.0-3.el6_3.x86_64.rpm libproxy-kde-0.3.0-3.el6_3.x86_64.rpm libproxy-mozjs-0.3.0-3.el6_3.x86_64.rpm libproxy-webkit-0.3.0-3.el6_3.x86_64.rpm i386 libproxy-0.3.0-3.el6_3.i686.rpm libproxy-bin-0.3.0-3.el6_3.i686.rpm libproxy-python-0.3.0-3.el6_3.i686.rpm libproxy-devel-0.3.0-3.el6_3.i686.rpm libproxy-gnome-0.3.0-3.el6_3.i686.rpm libproxy-kde-0.3.0-3.el6_3.i686.rpm libproxy-mozjs-0.3.0-3.el6_3.i686.rpm libproxy-webkit-0.3.0-3.el6_3.i686.rpm - Scientific Linux Development Team . A security patch for libproxy resolves a buffer underflow issue in proxy auto-configuration on Scientific Linux.. libproxy Update, Buffer Overflow, Scientific Linux Security. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.