Low: gdb

Issue Overview: GNU gdb GDB 13.0.50.20220805-git was discovered to contain a stack overflow via the function adadecode at /gdb/ada-lang.c. CVE-2023-39128 GNU gdb GDB 13.0.50.20220805-git was discovered to contain a heap use after free via the function addpeexportedsym at /gdb/coff-pe-read.c...

Medium: openssl

Issue Overview: Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a...

@appknit-project/appknit-internal-sdk (>=1.0.98-alpha.0, <=1.0.98-alpha.11), @appknit-project/appknit-platform-sdk-v2 (>=1.3.65-alpha.0, <=1.3.65-alpha.10) +97 more potentially affected by CVE-2024-21534 via jsonpath-plus (>=10.0.0, <=10.1.0)

jsonpath-plus NPM version =10.0.0, =1.0.98-alpha.0, =1.3.65-alpha.0, =0.18.0-alpha.0, =0.17.3, =0.18.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.12, =0.0.13 and more Source cves: CVE-2024-21534 Source advisory: OSV:GHSA-PPPG-CPFQ-H7WR...

GHSA-F32C-W444-8PPV Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.IO.Packaging. This advisory also provides guidance on what developers can do to update their...

GHSA-7VW9-CFWX-9GX9 Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update the...

Important: redis6

Issue Overview: Denial-of-service due to unbounded pattern matching CVE-2024-31228 Lua library commands may be exploited by an authenticated user to achieve remote-code-execution CVE-2024-31449 Affected Packages: redis6 Issue Correction: Run dnf update redis6 --releasever 2023.5.20241001 to updat...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: use timestamp to check for set element timeout CVE-2024-27397 In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name CVE-2024-3949...

@teable/sdk (>=1.5.0, <=1.8.0), @udecode/plate (>=37.0.0, <=38.0.5) +3 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=37.0.0, <=38.0.4)

@udecode/plate-core NPM version =37.0.0, =1.5.0, =37.0.0, =37.0.0, =37.0.0, =0.2.62, =0.2.83 Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

Medium: runc

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: runc Issue Correction: Run dnf update runc --releasev...

Medium: nginx

Issue Overview: NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngxhttpmp4module and...

Medium: docker

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: docker Issue Correction: Run dnf update docker...

Important: linux-firmware

Issue Overview: Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution. CVE-2023-31315 Affected Packages: linux-firmware Issue Correction: Run dnf...

Medium: ruby3.2

Issue Overview: ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27282 Affected Packages: ruby3.2 Issue Correction: Run dnf update ruby3.2 --releasever 2023.5.20240819 to update your system. New Packages:...

Medium: p7zip

Issue Overview: The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 for 7zz contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512i-2, for i=9, i=10, i=11, etc. CVE-2023-52168 The NtfsHandler.cpp NTF...

Medium: tpm2-tss

Issue Overview: tpm2-tss: arbitrary quote data may go undetected by FapiVerifyQuote CVE-2024-29040 Affected Packages: tpm2-tss Issue Correction: Run dnf update tpm2-tss --releasever 2023.5.20240819 to update your system. New Packages: aarch64: tpm2-tss-fapi-4.0.2-1.amzn2023.aarch64 ...

Medium: krb5

Issue Overview: krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37371 Affected Packages: krb5 Issue Correction: Run...

Medium: containerd

Issue Overview: The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

Important: dotnet6.0

Issue Overview: .NET and Visual Studio Denial of Service Vulnerability CVE-2024-38095 Affected Packages: dotnet6.0 Issue Correction: Run dnf update dotnet6.0 --releasever 2023.5.20240805 to update your system. New Packages: aarch64: ...

GHSA-3R34-R6W3-FQP6 Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their...

Important: ghostscript

Issue Overview: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=3b1735085ecef20b29e8db3416ab36de93e86d1f ghostpdl-10.03.1 NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707662 ADVISORIES: 'DSA-5692-1'...