An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

[FR] втащить апстримный коммит для поддержки e2k

Пожалуйста обновите до до версии 1.5.2

Уязвимость реализации режима Intra-mode BTI (IMBTI) микропрограммного обеспечения процессоров Intel, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость реализации режима Intra-mode BTI (IMBTI) микропрограммного обеспечения процессоров Intel, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Уязвимость модуля LFENCE/JMP процессоров AMD, позволяющая нарушителю раскрыть защищаемую информацию

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during interaction between two cryptographic libraries, a certain dangerous combination of the prime defined by the receiver's public key, the generator defined by the receiver's public key, and the sender's ephemeral exponents can lead to a cross-configuration attack against OpenPGP.