openSUSE 15 Security Update : chromium (openSUSE-SU-2023:0247-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0247-1 advisory. - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted...

[SECURITY] [DSA 5498-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 15, 2023 https://www.debian.org/security/faq -...

OPENSUSE-SU-2023:0247-1 Security update for chromium

This update for chromium fixes the following issues: - CVE-2023-4863: temporary build with the bundled library on Leap boo1215231...

Microsoft Edge (Chromium) < 117.0.2045.31 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 117.0.2045.31. It is, therefore, affected by multiple vulnerabilities as referenced in the September 15, 2023 advisory. - Microsoft Edge Chromium-based Elevation of Privilege Vulnerability CVE-2023-36562, CVE-2023-3673...

Fedora 38 : firefox (2023-c7af372e2e)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c7af372e2e advisory. - Updated to latest upstream 117.0.1 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

Fedora 38 : libwebp (2023-c4fa8a204d)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c4fa8a204d advisory. Backport fix for CVE-2023-4863. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2023:0247-1 Rating: important References: 1215231 Cross-References: CVE-2023-4863 CVSS scores: CVE-2023-4863 SUSE: 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Backports SLE-15-SP4...

USN-6367-1: Firefox vulnerability

It was discovered that Firefox did not properly manage memory when handling WebP images. If a user were tricked into opening a webpage containing malicious WebP image file, an attacker could potentially exploit these to cause a denial of service or execute arbitrary code. CVE-2023-4863...

[slackware-security] mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 15.0, and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.2.2-i686-1slack15.0.txz: Upgraded. This release contains a security fix for a critical heap...

Mozilla Firefox ESR Security Advisories (MFSA2023-29, MFSA2023-12) - Windows

Mozilla Firefox ESR is prone to heap buffer vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2023-256-04)

The version of mozilla-thunderbird installed on the remote host is prior to 115.2.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-256-04 advisory. - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : libwebp vulnerability (USN-6369-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6369-1 advisory. It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a special...

Google Chrome Security Update (stable-channel-update-for-desktop_11-2023-09) - Windows

Google Chrome is prone to a heap buffer overflow vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...

Ubuntu 20.04 LTS : Firefox vulnerability (USN-6367-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6367-1 advisory. It was discovered that Firefox did not properly manage memory when handling WebP images. If a user were tricked into opening a webpage containing malicious WebP...

Debian DSA-5496-1 : firefox-esr - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5496 advisory. - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page...

Debian DSA-5497-1 : libwebp - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5497 advisory. A buffer overflow in parsing WebP images may result in the execution of arbitrary code. For the stable distribution bookworm, this problem has been fixed in version...

Slackware Linux 15.0 / current libwebp Vulnerability (SSA:2023-257-01)

The version of libwebp installed on the remote host is prior to 1.3.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-257-01 advisory. - Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory...

[SECURITY] [DSA 5496-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5496-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 13, 2023 https://www.debian.org/security/faq -...

Mozilla Rushes to Patch WebP Critical Zero-Day Exploit in Firefox and Thunderbird

Mozilla on Tuesday released security updates to resolve a critical zero-day vulnerability in Firefox and Thunderbird that has been actively exploited in the wild, a day after Google released a fix for the issue in its Chrome browser. The shortcoming, assigned the identifier CVE-2023-4863, is a he...

Mozilla Firefox ESR < 115.2.1

The version of Firefox ESR installed on the remote Windows host is prior to 115.2.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2023-40 advisory. - Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue...