Product:

Leap

(Opensuse)
Repositories https://github.com/phpmyadmin/phpmyadmin
https://github.com/ImageMagick/ImageMagick
https://github.com/torvalds/linux
https://github.com/krb5/krb5
https://github.com/madler/zlib
https://github.com/libgd/libgd
https://github.com/php/php-src
https://github.com/ceph/ceph
https://github.com/libarchive/libarchive
https://github.com/roundcube/roundcubemail
https://github.com/dbry/WavPack
https://github.com/file/file
https://github.com/git/git
https://github.com/dosfstools/dosfstools
https://github.com/golang/go
https://github.com/tats/w3m
https://github.com/atheme/atheme
https://github.com/quassel/quassel
https://github.com/ntp-project/ntp
https://github.com/apache/httpd
https://github.com/requests/requests
https://github.com/esnet/iperf
https://github.com/lighttpd/lighttpd1.4
https://github.com/bcgit/bc-java
https://github.com/opencontainers/runc
https://github.com/heimdal/heimdal
https://github.com/erikd/libsndfile
https://github.com/libjpeg-turbo/libjpeg-turbo
https://github.com/FreeRDP/FreeRDP
https://github.com/mysql/mysql-server
https://git.kernel.org/pub/scm/git/git.git
https://github.com/WebKit/webkit
https://github.com/liblouis/liblouis
https://github.com/lavv17/lftp
https://github.com/viewvc/viewvc
https://github.com/moinwiki/moin-1.9
https://github.com/ClusterLabs/pacemaker
https://github.com/curl/curl
https://github.com/vadz/libtiff
https://github.com/uclouvain/openjpeg
https://github.com/libimobiledevice/libimobiledevice
https://github.com/FFmpeg/FFmpeg
https://github.com/fragglet/lhasa
https://github.com/TigerVNC/tigervnc
https://github.com/mm2/Little-CMS
https://github.com/stedolan/jq
https://github.com/Matroska-Org/libmatroska
https://github.com/mdadams/jasper
https://github.com/the-tcpdump-group/tcpdump
#Vulnerabilities 1780
Date Id Summary Products Score Patch Annotated
2020-06-18 CVE-2017-9108 An issue was discovered in adns before 1.5.2. adnshost mishandles a missing final newline on a stdin read. It is wrong to increment used as well as setting r, since used is incremented according to r, later. Rather one should be doing what read() would have done. Without this fix, adnshost may read and process one byte beyond the buffer, perhaps crashing or perhaps somehow leaking the value of that byte. Fedora, Adns, Leap 7.5
2020-06-18 CVE-2017-9109 An issue was discovered in adns before 1.5.2. It fails to ignore apparent answers before the first RR that was found the first time. when this is fixed, the second answer scan finds the same RRs at the first. Otherwise, adns can be confused by interleaving answers for the CNAME target, with the CNAME itself. In that case the answer data structure (on the heap) can be overrun. With this fixed, it prefers to look only at the answer RRs which come after the CNAME, which is at least arguably correct. Fedora, Adns, Leap 9.8
2020-06-18 CVE-2017-9104 An issue was discovered in adns before 1.5.2. It hangs, eating CPU, if a compression pointer loop is encountered. Fedora, Adns, Leap 9.8
2020-06-18 CVE-2017-9103 An issue was discovered in adns before 1.5.2. pap_mailbox822 does not properly check st from adns__findlabel_next. Without this, an uninitialised stack value can be used as the first label length. Depending on the circumstances, an attacker might be able to trick adns into crashing the calling program, leaking aspects of the contents of some of its memory, causing it to allocate lots of memory, or perhaps overrunning a buffer. This is only possible with applications which make non-raw... Fedora, Adns, Leap 9.8
2020-06-22 CVE-2020-14983 The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack. Chocolate_doom, Crispy_doom, Backports, Leap 9.8
2020-07-09 CVE-2020-12424 When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78. Firefox, Leap 6.5
2020-07-09 CVE-2020-12418 Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird, Leap 6.5
2020-07-09 CVE-2020-12415 When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78. Firefox, Leap 6.5
2020-07-09 CVE-2020-12419 When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0. Ubuntu_linux, Firefox, Firefox_esr, Thunderbird, Leap 8.8
2020-07-09 CVE-2020-12422 In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out of bounds write, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 78. Firefox, Leap 8.8