[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.13.0esr-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...

CVE-2024-20781

Summary: Adobe InDesign Desktop (ID18.5.2, ID19.3 and earlier) is affected by a heap-based buffer overflow that could enable arbitrary code execution in the user’s context. Exploitation requires a user to open a malicious file. Connected advisories (APSB24-48) indicate a security update is availa...

CVE-2024-33654

A vulnerability has been identified in Simcenter Femap All versions V2406. The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process...

Adobe InDesign 安全漏洞

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

The vulnerability of the software platform for numerical modeling and analysis of Simcenter Nastran products lies in the execution of operations beyond the buffer boundaries in memory, allowing attackers to execute arbitrary code.

The vulnerability of the software platform for numerical modeling and analysis in Simcenter Nastran relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of the current...

Artifex Ghostscript Security Vulnerability

Artifex Ghostscript is a set of free software compiled by Artifex, Inc. based on Adobe, PostScript, and the Page Description Language for Portable Document Format PDL. A security vulnerability exists in Artifex Ghostscript versions prior to 10.03.1, which can be exploited to traverse paths to...

[slackware-security] httpd

New httpd packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/httpd-2.4.60-i586-2slack15.0.txz: Rebuilt. This update is to fix a regression and to note security issues that were not listed in the...

CVE-2024-34122

CVE-2024-34122 affects Acrobat for Edge (Edge Chromium-based) up to version 126.0.2592.68, with an out-of-bounds read when parsing a crafted file that could allow code execution under the user’s context after user interaction. The issue is confirmed across multiple sources; a remediation exists a...

Slackware: Security Advisory (SSA:2024-183-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-39704: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code on a client's machine via a crafted packet on TCP port 46318...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS advisories on June 27, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-179-01 TELSAT marKoni FM Transmitter ICSA-24-179-02 SDG Technologies PnPSCADA...

Melty-Blood-Actress-Again-Current-Code-Remote-Code-Execution

Melty Blood Actress Again Current Code v1.07 Rev. 1.4.0 Remote...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in Artifex Ghostscript prior to version 10.03.1. Path traversal is possible through a specially crafted PostScript document, allowing access to arbitrary files when the current directory is within the permitted paths. For example, a transformation like ../../foo could be...

MAL-2024-6847 Malicious code in current-weather (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in current-weather (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in get-current-env (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2416 Malicious code in get-current-env (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-23147

A maliciously crafted CATPART, XB and STEP, when parsed in ASMKERN228A.dll and ASMKERN229A.dll through Autodesk applications, can lead to a memory corruption vulnerability by write access violation. This vulnerability, in conjunction with other vulnerabilities, can lead to code execution in the...

CVE-2024-23145

A maliciously crafted PRT file, when parsed in opennurbs.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-37002

A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current process...