There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.

GENTOO:GLSA-202107-27 | URL:https://security.gentoo.org/glsa/202107-27 | MISC:https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370 | URL:https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370 | MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1939149 | URL:https://bugzilla.redhat.com/show_bug.cgi?id=1939149 | MLIST:[debian-lts-announce] 20210703 [SECURITY] [DLA 2701-1] openexr security update | URL:https://lists.debian.org/debian-lts-announce/2021/07/msg00001.html | MLIST:[debian-lts-announce] 20221211 [SECURITY] [DLA 3236-1] openexr security update | URL:https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.

CISCO:20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host located behind the ALG. For more information about these vulnerabilities, see the Details section of this advisory. Note: These vulnerabilities have been publicly discussed as NAT Slipstreaming.

CISCO:20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-natalg-bypass-cpKGqkng

A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper resource management when connection rates are high. An attacker could exploit this vulnerability by opening a significant number of connections on an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.

CISCO:20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Resource Exhaustion Denial of Service Vulnerability | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-Unk689XY

A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. This vulnerability is due to incorrect handling of certain TCP segments when the affected device is operating in transparent mode. An attacker could exploit this vulnerability by sending a crafted TCP segment through an affected device. A successful exploit could allow the attacker to poison the MAC address tables in adjacent devices, resulting in network disruption.

CISCO:20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Transparent Mode Denial of Service Vulnerability | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dos-JxYWMJyL

A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to query SNMP data. This vulnerability is due to ineffective access control. An attacker could exploit this vulnerability by sending an SNMPv3 query to an affected device from a host that is not permitted by the SNMPv3 access control list. A successful exploit could allow the attacker to send an SNMP query to an affected device and retrieve information from the device. The attacker would need valid credentials to perform the SNMP query.

CISCO:20211027 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control Vulnerability | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-snmpaccess-M6yOweq3

Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory.

CISCO:20211103 Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-catpon-multivulns-CE3DSYGr

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

MISC:https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4 | URL:https://lists.apache.org/thread/nq2w9gjzm1cjx1rh6zw41ty39qw7qpx4 | MISC:https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk | URL:https://lists.apache.org/thread/p4l0g49rzzzpn8yt9q9p0xp52h3zmsmk

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

CISCO:20211124 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021 | URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ | CONFIRM:https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf | CONFIRM:https://kc.mcafee.com/corporate/index?page=content&id=SB10379 | URL:https://kc.mcafee.com/corporate/index?page=content&id=SB10379 | CONFIRM:https://security.netapp.com/advisory/ntap-20211008-0004/ | URL:https://security.netapp.com/advisory/ntap-20211008-0004/ | CONFIRM:https://www.tenable.com/security/tns-2021-17 | URL:https://www.tenable.com/security/tns-2021-17 | DEBIAN:DSA-4982 | URL:https://www.debian.org/security/2021/dsa-4982 | FEDORA:FEDORA-2021-dce7e7738e | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/ | FEDORA:FEDORA-2021-e3f6dd670d | URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/ | GENTOO:GLSA-202208-20 | URL:https://security.gentoo.org/glsa/202208-20 | MISC:http://httpd.apache.org/security/vulnerabilities_24.html | URL:http://httpd.apache.org/security/vulnerabilities_24.html | MISC:https://www.oracle.com/security-alerts/cpuapr2022.html | URL:https://www.oracle.com/security-alerts/cpuapr2022.html | MISC:https://www.oracle.com/security-alerts/cpujan2022.html | URL:https://www.oracle.com/security-alerts/cpujan2022.html | MLIST:[debian-lts-announce] 20211002 [SECURITY] [DLA 2776-1] apache2 security update | URL:https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html | MLIST:[httpd-users] 20210923 Re: [users@httpd] 2.4.49 security fixes: more info | URL:https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029@%3Cusers.httpd.apache.org%3E | MLIST:[httpd-users] 20210923 Re: [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info | URL:https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c@%3Cusers.httpd.apache.org%3E | MLIST:[httpd-users] 20210923 [users@httpd] 2.4.49 security fixes: more info | URL:https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697@%3Cusers.httpd.apache.org%3E | MLIST:[httpd-users] 20210923 [users@httpd] Re: [External] : [users@httpd] 2.4.49 security fixes: more info | URL:https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432@%3Cusers.httpd.apache.org%3E