[slackware-security] tigervnc

New tigervnc packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: extra/tigervnc/tigervnc-1.12.0-i586-7slack15.0.txz: Rebuilt. Recompiled against xorg-server-1.20.14, including a patch for a security issue: By...

CVE-2024-8589

A maliciously crafted SLDPRT file when parsed in odxswdll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process...

OS Command Injection

snyk-gradle-plugin is vulnerable to OS Command Injection. The vulnerability is due to the Snyk CLI's failure to correctly sanitize or validate the current working directory name, allowing for potential code injection when running scans on untrusted projects...

CVE-2022-25255

...

OS Command Injection in Snyk php plugin

The Snyk php plugin is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning trusted projects...

CVE-2024-48964

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning...

CVE-2024-48963

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning truste...

CVE-2024-48963

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning truste...

CVE-2024-48964

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning...

CVE-2024-48964

The CVE-2024-48964 entry concerns the Snyk CLI prior to 1.1294.0, vulnerable to Code Injection when scanning an untrusted Gradle project due to improper handling of the current working directory name. Affected software: Snyk CLI (pre-1.1294.0). Impact: potential code injection during a test run i...

CVE-2024-48964

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning...

The vulnerability of the Adobe Framemaker desktop publishing system, related to reading beyond the buffer boundaries, allows a hacker to execute arbitrary code in the context of the current user.

The vulnerability of the desktop publishing system Adobe Framemaker relates to reading beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...

The vulnerability of the Adobe Framemaker desktop publishing system, related to the use of an unreliable search path, allows a hacker to execute arbitrary code in the context of the current user.

The vulnerability of the desktop publishing system Adobe Framemaker is related to the use of an insecure search path. Exploiting this vulnerability allows an attacker to execute arbitrary code within the context of the current user...

The vulnerability of the Substance 3D Stager software lies in its susceptibility to overflowing buffer spaces, allowing attackers to execute arbitrary code.

The vulnerability of the Substance 3D Stager software lies in the overflow of the buffer based on a queue. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...

Adobe InDesign 15.0.0 < 15.1.2 Multiple Arbitrary Code Execution (APSB20-52)

The version of Adobe InDesign installed on the remote Windows host is prior to 15.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB20-52 advisory. - A memory corruption vulnerability exists in InDesign 15.1.1 and earlier versions. Insecure handling of a malicio...

Adobe InCopy 16.0.0 < 16.4.1 Multiple Vulnerabilities (APSB22-04)

The version of Adobe InCopy installed on the remote host is prior to 16.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB22-04 advisory. - Adobe InCopy version 16.4 and earlier is affected by an out-of-bounds write vulnerability that could result in arbitrary...

CVE-2024-7993

CVE-2024-7993 affects Autodesk Revit via a PDF parsing Out-of-Bounds Write. The vulnerability allows a malicious PDF to cause a crash, data corruption, or arbitrary code execution within the process. Impact : high (data confidentiality, integrity, availability affected). Access/Exploit : local at...

Slackware: Security Advisory (SSA:2024-287-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2024-284-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.16.0esr-i686-1slack15.0.txz: Upgraded. This release contains security fixes and improvements. For...