Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian LTS: DLA-3851-1: gunicorn Security Advisory Updates
Gunicorn, an event-based HTTP/WSGI server, fails to properly validate Transfer- Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By c…
Mageia 2024-0241: erofs-utils Security Advisory Updates
Heap Buffer Overflow in the erofsfsck_dirent_iter function in fsck/main.c in erofs-utils v1.6 allows remote attackers to execute arbitrary code via a crafted e…
Ubuntu 6843-1: Plasma Workspace Security Advisory Updates
plasma-workspace would allow unintended access to the session manager.
Ubuntu 6850-1: OpenVPN Security Advisory Updates
OpenVPN could allow unintended access to network services.
Mageia 2024-0236: python-gunicorn Security Advisory Updates
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting T…
Mageia 2024-0227: cups Security Advisory Updates
When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can be caused to perform an arbitrary chmod of t…
Debian LTS: DLA-3835-1: roundcube Security Advisory Updates
Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could allow a remote a…
Mageia 2024-0224: atril Security Advisory Updates
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists …
Debian LTS: DLA-3829-1: sendmail Security Advisory Updates
sendmail allowed SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed…
Debian LTS: DLA-3827-1: plasma-workspace Security Advisory Updates
Unauthorized local user access to the session manager has been fixed in the Plasma Workspace component of the KDE Plasma desktop environment. For Debian 10 bus…
Ubuntu 6826-1: mod_jk Security Advisory Updates
mod_jk could allow unintended access to network services.
Azure Service Tags Vulnerability: Microsoft Warns of Potential Abuse by Hackers
Microsoft is warning about the potential abuse of Azure Service Tags by malicious actors to forge requests from a trusted service and get around firewall rules…
Fedora 39: cacti-spine 2024-27a594f71d Security Advisory Updates
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.…
Fedora 39: cacti 2024-27a594f71d Security Advisory Updates
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.…
Ubuntu 6800-1: browserify-sign Security Advisory Updates
browserify-sign could allow unintended access if it opened a specially crafted file.
Okta Warns of Credential Stuffing Attacks Targeting Customer Identity Cloud
Okta is warning that a cross-origin authentication feature in Customer Identity Cloud (CIC) is susceptible to credential stuffing attacks orchestrated by threa…
Debian LTS: DLA-3820-1: bluez Security Advisory Updates
An problem has been fixed with the handling of the AVRCP protocol in the bluetooth stack that could lead to remote code execution. For Debian 10 buster, this p…
CISA Warns of Actively Exploited Apache Flink Security Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a security flaw impacting Apache Flink, an open-source, unified stream-proce…
NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploi…
Gentoo: GLSA-202405-32: Mozilla Thunderbird: Security Advisory Updates
Multiple vulnerabilities have been discovered in Mozilla Thunderbird, the worst of which could lead to remote code execution.
Gentoo: GLSA-202405-24: ytnef: Security Advisory Updates
Multiple vulnerabilities have been discovered in ytnef, the worst of which could potentially lead to remote code execution.
Gentoo: GLSA-202405-15: Mozilla Firefox: Security Advisory Updates
Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which can lead to remote code execution.
Gentoo: GLSA-202405-14: QtWebEngine: Security Advisory Updates
Multiple vulnerabilities have been discovered in QtWebEngine, the worst of which could lead to remote code execution.
Gentoo: GLSA-202405-11: MIT krb5: Security Advisory Updates
Multiple vulnerabilities have been discovered in MIT krb5, the worst of which could lead to remote code execution.