Fedoraproject: >> Fedora >> 37 Security Vulnerabilities
JPEGOPTIM v1.4.7 was discovered to contain a segmentation violation which is caused by a READ memory access at jpegoptim.c.
CVSS Score
6.5
EPSS Score
0.01
Published
2022-07-01
MariaDB v10.4 to v10.7 was discovered to contain an use-after-poison in prepare_inplace_add_virtual at /storage/innobase/handler/handler0alter.cc.
CVSS Score
7.5
EPSS Score
0.022
Published
2022-07-01
MariaDB v10.5 to v10.7 was discovered to contain an assertion failure at table->get_ref_count() == 0 in dict0dict.cc.
CVSS Score
7.5
EPSS Score
0.021
Published
2022-07-01
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select.
CVSS Score
7.5
EPSS Score
0.023
Published
2022-07-01
MariaDB v10.5 to v10.7 was discovered to contain a segmentation fault via the component st_select_lex_unit::exclude_level.
CVSS Score
7.5
EPSS Score
0.022
Published
2022-07-01
MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc.
CVSS Score
7.5
EPSS Score
0.024
Published
2022-07-01
A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user namespace, the NO_NEW_PRIVS prctl is not activated, and the entered mount namespace is under the attacker's control. In this way, the filesystem layout can be adjusted to gain root privileges through execution of available setuid-root binaries such as su or sudo.
CVSS Score
7.8
EPSS Score
0.004
Published
2022-06-09
A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number.
CVSS Score
6.5
EPSS Score
0.038
Published
2022-06-02
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites that cannot fully trust template authors should upgrade to versions 3.1.45 or 4.1.1 to receive a patch for this issue. There are currently no known workarounds.
CVSS Score
8.8
EPSS Score
0.049
Published
2022-05-24
compile in regexp.c in Artifex MuJS through 1.2.0 results in stack consumption because of unlimited recursion, a different issue than CVE-2019-11413.
CVSS Score
5.5
EPSS Score
0.011
Published
2022-05-18