USN-6338-2 linux-gcp, linux-gcp-6.2, linux-ibm, linux-oracle, linux-starfive vulnerabilities

Zi Fan Tan discovered that the binder IPC implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-21255 It was discovered that a race condition existed in th...

Oracle Linux 5 : Oracle / Enterprise / Linux / 5.3 / kernel (ELSA-2009-0225)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0225 advisory. - net atm: prevent local denial of service Eugene Teo 473701 CVE-2008-5079 - net fix unix sockets kernel panic Neil Horman 470436 CVE-2008-5029 - audit...

Oracle Linux 6 : python (ELSA-2011-0554)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0554 advisory. - rebase to 2.6.6: which contains the big whitespace cleanup of r81031 http://www.python.org/download/releases/2.6.6/ - fixup patch 102, patch 11, patc...

CVE-2023-39956

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

GHSA-P7V2-P9M8-QQG7 Electron context isolation bypass via nested unserializable return value

Impact Apps using contextIsolation and contextBridge are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Workarounds This issue is exploitable under eithe...

Design/Logic Flaw

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service DoS attack to be executed by sending a properly crafted request to the server. This issue affects lua-http: all versions before commit ddab283...

UBUNTU-CVE-2023-4540

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service DoS attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. This issue...

CVE-2023-4540

Improper Handling of Exceptional Conditions vulnerability in Daurnimator lua-http library allows Excessive Allocation and a denial of service DoS attack to be executed by sending a properly crafted request to the server. Such a request causes the program to enter an infinite loop. This issue...

CVE-2023-4540

The CVE-2023-4540 vulnerability affects lua-http (Daurnimator) in which improper handling of exceptional conditions allows excessive allocation and a DoS by sending a crafted request that can cause an infinite loop. Affected are lua-http: all versions before the commit ddab2835c583d45dec62680ca8d...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

hw: amd: Cross-Process Information Leak

A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances...

Oracle Linux 9 : thunderbird (ELSA-2023-4499)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-4499 advisory. 102.14.0-1.0.1 - Update to 102.14.0 build1 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Juniper Junos OS Vulnerability (JSA71639)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA71639 advisory. - An Improper Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on MX Series allows an unauthenticated network-based attacke...

Race condition

"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service DoS condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Editio...

CVE-2023-39341

"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to denial-of-service DoS condition. Affected products and versions are as follows: FFRI yarai versions 3.4.0 to 3.4.6 and 3.5.0, FFRI yarai Home and Business Editio...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

RLSA-2023:4468 Important: firefox security update

TODO: add package description This update upgrades Firefox to version 102.14.0 ESR. Security Fixes: Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions CVE-2023-4045 Mozilla: Incorrect value used during WASM compilation CVE-2023-4046 Mozilla: Potential permissions request bypa...

Mozilla: Fix potential race conditions when releasing platform objects

The Mozilla Foundation Security Advisory describes this flaw as: Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities...

Important: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Mozilla: Fix potential race conditions when releasing platform objects

The Mozilla Foundation Security Advisory describes this flaw as: Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities...