APSB24-60 : Security update available for Adobe Substance 3D Stager

Adobe has released an update for Adobe Substance 3D Stager. This update addresses critical and important vulnerabilities in Adobe Substance 3D Stager. Successful exploitation could lead to arbitrary code execution and memory leak in the context of the current user...

AFLplusplus: Arbitrary Code Execution

Background The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicornmode, and a lot more! Description In AFL++ 4.05c, the CmpLog component uses the current working directory to resolv...

UBUNTU-CVE-2024-42249

In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spiasync Calling spimaybeunoptimizemessage in spiasync is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.14.0esr-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...

SUSE CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

Important: gtk3

Issue Overview: gtk3: gtk2: Library injection from CWD CVE-2024-6655 Affected Packages: gtk3 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update gtk3 or yum...

Low: openssl11

Issue Overview: No CVE associated with this advisory Affected Packages: openssl11 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update openssl11 or yum update...

Gtk3: gtk2: library injection from cwd

...

Slackware Linux 15.0 / current curl Vulnerability (SSA:2024-213-01)

The version of curl installed on the remote host is prior to 8.9.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-213-01 advisory. New curl packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding description...

UBUNTU-CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

OESA-2024-1886 gtk2 security update

GTK+ is a library for creating graphical user interfaces. The library is created in C programming language. The GTK+ is also called the GIMP Toolkit. Originally, the library was created while developing the GIMP image manipulation program. Security Fixes: A flaw was found in the GTK library. Unde...

OESA-2024-1892 gtk3 security update

GTK+ is an object-oriented widget toolkit written in the programming language C; it has a C-based object-oriented architecture that allows for maximum flexibility. The GTK+ library contains a set of graphical control elements widgetsfor creating graphical user interfaces. This package contains...

Slackware: Security Advisory (SSA:2024-200-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2024-6655

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

AZL-43381 CVE-2024-6655 affecting package gtk2 for versions less than 2.24.32-12

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

AZL-43387 CVE-2024-6655 affecting package gtk3 for versions less than 3.24.28-10

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

AZL-43384 CVE-2024-6655 affecting package gtk2 for versions less than 2.24.32-12

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

AZL-43377 CVE-2024-6655 affecting package gtk3 for versions less than 3.24.28-10

A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory...

CVE-2024-6655

CVE-2024-6655 affects GTK+ libraries (gtk2 and gtk3) across multiple Linux distributions. The flaw allows library injection into a GTK application from the current working directory under certain conditions, enabling local attack with high impact on confidentiality, integrity, and availability. M...

USN-6899-1 gtk+2.0, gtk+3.0 vulnerability

It was discovered that GTK would attempt to load modules from the current directory, contrary to expectations. If users started GTK applications from shared directories, a local attacker could use this issue to execute arbitrary code, and possibly escalate privileges...