Stable Channel Update for Desktop

The Stable channel has been updated to 128.0.6613.113/.114 for Windows, Mac and 128.0.6613.113 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 128.0.6613.114 for Windows and Mac...

DEBIAN-CVE-2024-43912

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: disallow setting special AP channel widths Setting the AP channel width is meant for use with the normal 20/40/... MHz channel width progression, and switching around in S1G or narrow channels isn't supported...

UBUNTU-CVE-2024-43912

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: disallow setting special AP channel widths Setting the AP channel width is meant for use with the normal 20/40/... MHz channel width progression, and switching around in S1G or narrow channels isn't supported...

CVE-2024-43912 wifi: nl80211: disallow setting special AP channel widths

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: disallow setting special AP channel widths Setting the AP channel width is meant for use with the normal 20/40/... MHz channel width progression, and switching around in S1G or narrow channels isn't supported...

SUSE CVE-2022-48927

In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indiodev-numchannels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channel...

GHSA-C6VP-JJGV-38WJ Mattermost allows remote/synthetic users to create sessions, reset passwords

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset...

Mattermost doesn't redact remote users' original email addresses

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server...

CVE-2024-43813 IDOR when marking read a user's channel

Mattermost versions 9.5.x = 9.5.7, 9.10.x = 9.10.0 fail to enforce proper access controls which allows any authenticated user, including guests, to mark any channel inside any team as read for any user...

CVE-2024-32939

Mattermost CVE-2024-32939 affects multiple 9.x branches (9.9.x up to 9.9.1; 9.5.x up to 9.5.7; 9.10.x up to 9.10.0; 9.8.x up to 9.8.2) when shared channels are enabled. The issue is that remote users’ original email addresses stored in user props are not redacted even when emails are configured n...

CVE-2024-32939 Email addresses of remote users visible in props regardless of server settings

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."...

CVE-2024-39836 Munged email address used for password resets and notifications

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0 and 9.8.x = 9.8.2 fail to ensure that remote/synthetic users cannot create sessions or reset passwords, which allows the munged email addresses, created by shared channels, to be used to receive email notifications and to reset...

CVE-2024-39836

Mattermost server vulnerable versions: 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, and 9.8.x

DEBIAN-CVE-2022-48927

In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indiodev-numchannels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channel...

CVE-2022-48927

In the Linux kernel, the following vulnerability has been resolved: iio: adc: tsc2046: fix memory corruption by preventing array overflow On one side we have indiodev-numchannels includes all physical channels + timestamp channel. On other side we have an array allocated only for physical channel...

PT-2024-24990 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.8.x through 9.8.2 Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.9.x through 9.9.1 Mattermost versions 9.10.x through 9.10.0 Description: The issue arises when shared channels are enabled in Mattermost,...

CVE-2023-4208

creationtimestamp| type| source ---|---|--- 2024-08-16 09:00:19+00:00| published-proof-of-concept| https://t.me/HackerArsenal/171 2024-08-16 09:01:34+00:00| published-proof-of-concept| https://t.me/Kelvinseccommunity/738 2024-08-16 11:03:01+00:00| published-proof-of-concept|...

ROS-20240814-05

A vulnerability in the "Save As" function of Mozilla Firefox, Firefox ESR and Thunderbird email client on Windows operating systems is related to insufficient input data validation. Thunderbird email client of Windows operating systems is related to insufficient input data validation. Exploitatio...

kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number

A flaw was found in the Linux kernel. Two TCP spoofing primitives exist where an attacker can brute force the server-chosen send window by acknowledging data that was never sent, called "ghost ACKs." There are side channels that also allow the attacker to leak the otherwise secret server-chosen...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to disallow the modification of local channels by a remote, when shared channels are enabled. This allows a malicious remote user to make an arbitrary local channel...

Incorrect Error Handling

github.com/mattermost/mattermost-server is vulnerable to Incorrect Error Handling. The vulnerability is caused due to a failure to properly safeguard an error handling. This allows an attacker to permanently delete local data by abusing dangerous error handling, when share channels were enabled...