[Bug 1998315] New: CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1998315
Bug ID: 1998315
Summary: CVE-2020-18974 nasm: buffer overflow in crc64i()
nasmlib/crc64.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dominik(a)greysector.net, igor.raits(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nickc(a)redhat.com,
pbonzini(a)redhat.com
Target Milestone: ---
Classification: Other
Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause
a denial of service via 'crc64i' in the component 'nasmlib/crc64'. This issue
is different than CVE-2019-7147.
Reference:
https://bugzilla.nasm.us/show_bug.cgi?id=3392568
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 1998317] New: CVE-2020-18974 nasm: buffer overflow in crc64i() nasmlib/crc64.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1998317
Bug ID: 1998317
Summary: CVE-2020-18974 nasm: buffer overflow in crc64i()
nasmlib/crc64.c [fedora-all]
Product: Fedora
Version: 34
Status: NEW
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: igor.raits(a)gmail.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dominik(a)greysector.net, igor.raits(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, pbonzini(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 1824469] New: CVE-2019-20334 nasm: stack consumption occurs in expr# functions in asm/eval.c
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1824469
Bug ID: 1824469
Summary: CVE-2019-20334 nasm: stack consumption occurs in expr#
functions in asm/eval.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: dominik(a)greysector.net, i.gnatenko.brain(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nickc(a)redhat.com,
pbonzini(a)redhat.com
Target Milestone: ---
Classification: Other
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr#
functions in asm/eval.c. This potentially affects the relationships among
expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in
asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.
https://bugzilla.nasm.us/show_bug.cgi?id=3392548#c4
https://bugzilla.nasm.us/show_bug.cgi?id=3392638
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 1824470] New: CVE-2019-20334 nasm: stack consumption occurs in expr# functions in asm/eval.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1824470
Bug ID: 1824470
Summary: CVE-2019-20334 nasm: stack consumption occurs in expr#
functions in asm/eval.c [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: nasm
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: i.gnatenko.brain(a)gmail.com
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dominik(a)greysector.net, i.gnatenko.brain(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, pbonzini(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 1800412] New: spec-version-maven-plugin-2.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1800412
Bug ID: 1800412
Summary: spec-version-maven-plugin-2.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: spec-version-maven-plugin
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.1
Current version/release in rawhide: 1.2-15.fc32
URL: http://glassfish.java.net/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20405/
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 1980947] New: jsoup-1.14.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1980947
Bug ID: 1980947
Summary: jsoup-1.14.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jsoup
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.14.1
Current version/release in rawhide: 1.13.1-6.fc35
URL: http://jsoup.org/download
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1479/
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 11 months
[Bug 2085304] New: CVE-2022-25762 tomcat: request mixup
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2085304
Bug ID: 2085304
Summary: CVE-2022-25762 tomcat: request mixup
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: askrabec(a)redhat.com
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Other
If a web application sends a WebSocket message concurrently with the WebSocket
connection closing, it is possible that the application will continue to use
the socket after it has been closed. The error handling triggered in this case
could cause the a pooled object to be placed in the pool twice. This could
result in subsequent connections using the same object concurrently which could
result in data being returned to the wrong use and/or other errors.
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.76
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2085304
1 year, 11 months
[Bug 2086392] New: CVE-2022-1379 plantuml: URL Restriction Bypass [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2086392
Bug ID: 2086392
Summary: CVE-2022-1379 plantuml: URL Restriction Bypass
[fedora-all]
Product: Fedora
Version: 36
Status: NEW
Component: plantuml
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: saroy(a)redhat.com
Reporter: saroy(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: blaise(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, puntogil(a)libero.it,
saroy(a)redhat.com, sumitgarg44(a)gmail.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2086392
1 year, 11 months