Most recent entries from all

ALSA-2020:4694 — Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Affected: AlmaLinux:8: libslirp, AlmaLinux:8: libslirp-devel, AlmaLinux:8: python-podman-api

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)

* QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

certfr-2022-avi-591 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-591

EUVD-2026-42186

fkie_cve-2020-14040

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

GHSA-5rcv-m4m3-hfh7 — golang.org/x/text Infinite loop

Affected: Go: golang.org/x/text

Go version v0.3.3 of the x/text package fixes a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

### Specific Go Packages Affected golang.org/x/text/encoding/unicode golang.org/x/text/transform

gsd-2020-14040

RHSA-2020:3087 — Red Hat Security Advisory: Red Hat OpenShift Jaeger 1.17.5 container images security update

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

RHSA-2020:3665 — Red Hat Security Advisory: go-toolset:rhel8 security update

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash golang: data race in certain net/http servers including ReverseProxy can lead to DoS golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

UBUNTU-CVE-2020-14040

Affected: Ubuntu:16.04:LTS: golang-x-text, Ubuntu:18.04:LTS: golang-x-text, Ubuntu:20.04:LTS: golang-golang-x-text, Ubuntu:20.04:LTS: golang-x-text

WID-SEC-W-2022-0510 — IBM DB2: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, willkürlichen Code mit erhöhten Rechten auszuführen, Informationen falsch darzustellen und beliebigen Code auszuführen.