This update enforces that $LoadCode must be enabled to use the feature of evaluating typeglobs, because with the typeglob feature you would be able to set the variable $YAML::LoadCode from a YAML file, and that would be a security issue.
Archive for May 7th, 2019
Version 5.2 of WordPress is available for download or update in your WordPress dashboard. New features in this update make it easier than ever to fix your site if something goes wrong. There are even more robust tools for identifying and fixing configuration issues and fatal errors. Whether you are a developer helping clients or you manage your site solo, these tools can help get you the right information when you need it.
Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.
[20190501] – Core – XSS in com_users ACL debug views
- Project: Joomla!
- SubProject: CMS
- Impact: Moderate
- Severity: Low
- Versions: 1.7.0 through 3.9.5
- Exploit type: XSS
- Reported Date: 2019-April-29
- Fixed Date: 2019-May-07
- CVE Number: CVE-2019-11809
Description
The debug views of com_users do not properly escape user supplied data, which leads to a potential XSS attack vector.
Affected Installs
Joomla! CMS versions 1.7.0 through 3.9.5
Solution
Upgrade to version 3.9.6
Contact
The JSST at the Joomla! Security Centre.
Joomla 3.9.6 is now available. This is a security fix release for the 3.x series of Joomla which addresses one security vulnerability and contains over 25 bug fixes and improvements.
RedHat: RHSA-2019-1024:01 Important: flatpak security update
An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
RedHat: RHSA-2019-1021:01 Important: chromium-browser security update
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,
RedHat: RHSA-2019-1017:01 Important: ghostscript security update
An update for ghostscript is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
Restore s390x builds. —- 0.7.3.1