Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Debian LTS: DLA-3114-1: mariadb-10.3 security update
Several issues have been discovered in the MariaDB database server. The vulnerabilities are addressed by upgrading MariaDB to the new upstream version 10.3.36.…
Blackhat USA 2022: Return to Sender - Detecting Kernel Exploits with eBPF
Let's take a brief look at what Guillaume Fournier from Datadog presented at Blackhat USA 2022: ''One of the fastest growing subsystems in the Linux Kernel is,…
Fedora 36: qemu 2022-baf3c3b781
lsi53c895a: Do not abort when DMA requested and no data queued (#552) lsi53c895a: Fix use-after-free in lsi_do_msgout (CVE-2022-0216) (rhbz#2070902)
Debian: DSA-5197-1: curl security update
Multiple security vulnerabilities have been discovered in cURL, an URL transfer library. These flaws may allow remote attackers to obtain sensitive information…
Ubuntu 5530-1: PHP vulnerability
PHP could be made to crash or run programs if it processed specially crafted data.
Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability
Atlassian has rolled out fixes to remediate a critical security vulnerability pertaining to the use of hard-coded credentials affectingthe Questions For Conflu…
Ubuntu 5524-1: HarfBuzz vulnerability
HarfBuzz could be made to crash if it opened specially crafted data.
Debian: DSA-5185-1: mat2 security update
A directory traversal vulnerability was discovered in the Metadata anonymisation toolkit, which could result in information disclosure via a malformed ZIP arch…
Debian: DSA-5184-1: xen security update
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. In addition this updates provides mitigations …
Fedora 36: xen 2022-c4ec706488
Linux disk/nic frontends data leaks [XSA-403, CVE-2022-26365, CVE-2022-33740, CVE-2022-33741, CVE-2022-3374]
Fedora 36: xen 2022-925fc688c1
x86: MMIO Stale Data vulnerabilities [XSA-404, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166]
SciLinux: SLSA-2022-5239-1 Moderate: 389-ds-base on SL7.x x86_64
389-ds-base: sending crafted message could result in DoS (CVE-2022-0918) * 389-ds-base: expired password was still allowed to access the database (CVE-2022-099…
Mageia 2022-0240: libtiff security update
Heap-buffer-overflow in TIFFReadRawDataStriped() in tiffinfo.c. (CVE-2022-1354) Stack-buffer-overflow in tiffcp.c in main(). (CVE-2022-1355) Out-of-bounds read…
Mageia 2022-0239: 389-ds-base security update
An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can…
Fedora 35: kernel 2022-177a008b98
The 5.18.5 stable kernel update contains mitigation for the processor MMIO stale-data vulnerabilities. These are covered by CVE-2022-21166 CVE-2022-21125 and C…
Linux Botnets Now Exploit Critical Atlassian Confluence Bug
Several botnets are now using exploits targeting a critical remote code execution (RCE) vulnerability to infect Linux servers running unpatched Atlassian Confl…
Debian LTS: DLA-3035-1: libdbi-perl security update
It was discovered that CVE-2014-10401 was fixed incompletely in the Perl5 Database Interface (DBI). An attacker could trigger information disclosure through a …
RedHat: RHSA-2022-4786:01 Moderate: openvswitch2.13 security update
An update for openvswitch2.13 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a secu…
RedHat: RHSA-2022-4788:01 Moderate: openvswitch2.16 security update
An update for openvswitch2.16 is now available in Fast Datapath for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a secu…
Ubuntu 5424-2: OpenLDAP vulnerabili
OpenLDAP could be made to perform arbitrary modifications to the database.
Fedora 35: rubygem-nokogiri 2022-e9b2e1c1
This rpm backports the patch for the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, which is assigned as…
Fedora 36: rubygem-nokogiri 2022-00713284
New version 1.13.6 is released. This rpm addresses the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, wh…
Fedora 34: rubygem-nokogiri 2022-0e5d64ce
This rpm backports the patch for the issue for improper handling of unexpected data types, related to untrusted inputs to the SAX parsers, which is assigned as…
Ubuntu 5424-1: OpenLDAP vulnerabili
OpenLDAP could be made to perform arbitrary modifications to the database.