[Bug 1971017] New: CVE-2021-28169 jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1971017
Bug ID: 1971017
Summary: CVE-2021-28169 jetty: requests to the ConcatServlet
and WelcomeFilter are able to access protected
resources within the WEB-INF directory [fedora-all]
Product: Fedora
Version: 34
Status: NEW
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mat.booth(a)gmail.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com,
mat.booth(a)gmail.com, mizdebsk(a)redhat.com,
sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 10 months
[Bug 1998315] New: CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1998315
Bug ID: 1998315
Summary: CVE-2020-18974 nasm: buffer overflow in crc64i()
nasmlib/crc64.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dominik(a)greysector.net, igor.raits(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nickc(a)redhat.com,
pbonzini(a)redhat.com
Target Milestone: ---
Classification: Other
Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause
a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue
is different than CVE-2019-7147.
Reference:
https://bugzilla.nasm.us/show_bug.cgi?id=3392568
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 10 months
[Bug 1998317] New: CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1998317
Bug ID: 1998317
Summary: CVE-2020-18974 nasm: buffer overflow in crc64i()
nasmlib/crc64.c [fedora-all]
Product: Fedora
Version: 34
Status: NEW
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: igor.raits(a)gmail.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dominik(a)greysector.net, igor.raits(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, pbonzini(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 10 months
[Bug 1824469] New: CVE-2019-20334 nasm: stack consumption occurs in expr# functions in asm/eval.c
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1824469
Bug ID: 1824469
Summary: CVE-2019-20334 nasm: stack consumption occurs in expr#
functions in asm/eval.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: dominik(a)greysector.net, i.gnatenko.brain(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nickc(a)redhat.com,
pbonzini(a)redhat.com
Target Milestone: ---
Classification: Other
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr#
functions in asm/eval.c. This potentially affects the relationships among
expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in
asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.
https://bugzilla.nasm.us/show_bug.cgi?id=3392548#c4
https://bugzilla.nasm.us/show_bug.cgi?id=3392638
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 10 months