CVE-2023-49809 Todo plugin gets crashed and disabled by member

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with null request body to that endpoint and make it crash. After a few repetitions, the plugin is disabled...

Rocky Linux 8 : yajl (RLSA-2023:7057)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7057 advisory. - There's a memory leak in yajl 2.1.0 with use of yajltreeparse function. which will cause out-of-memory in server and cause crash. CVE-2023-33460 Note that Ness...

RHEL 8 : firefox (RHSA-2023:7512)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7512 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

RHEL 7 : thunderbird (RHSA-2023:7505)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:7505 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.5.0. Security Fixes: Mozilla:...

SUSE CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

Debian dla-3661 : firefox-esr - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3661 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3661-1 [email protected]...

Fedora 39 : vim (2023-45cf2b4014)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-45cf2b4014 advisory. The newest upstream commit Security fixes for CVE-2023-48233, CVE-2023-48231, CVE-2023-48232, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236,...

Mozilla Thunderbird < 115.5

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 115.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-52 advisory. - Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

CVE-2023-6238

A buffer overflow vulnerability was found in the NVM Express NVMe driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access DMA into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes...

Security Vulnerabilities fixed in Firefox ESR 115.5.0 — Mozilla

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element. It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to ...

wireshark security update

1:2.6.2-17 - Resolves: 2211412 - XRA dissector infinite loop 1:2.6.2-16 - Resolves: 2210866 - VMS TCPIPtrace file parser crash - Resolves: 2210867 - NetScaler file parser crash - Resolves: 2210869 - RTPS dissector crash...

Oracle Linux 9 : libX11 (ELSA-2023-6497)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6497 advisory. 1.7.0-8 - CVE fix for: CVE-2023-3138 Resolve: rhbz2213763 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Oracle Linux 9 : libreswan (ELSA-2023-6549)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6549 advisory. - Update to 4.12 to fix CVE-2023-38710, CVE-2023-38711, CVE-2023-38712 - Just bumping up the version to include bugs for CVE-2023-2295. There is no cod...

Important: thunderbird

Issue Overview: The Mozilla Foundation Security Advisory describes this flaw as: It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay. CVE-2023-5721 The Mozilla Foundation Security Advisory describ...

kernel: dm flakey: don't corrupt the zero page

A flaw was found in the Linux kernel's dm-flakey device mapper target. When the corrupt bio writes option is enabled, dm-flakey can corrupt the kernel's global zero page. Since the zero page is shared system-wide and used by glibc's calloc implementation via mmap, corrupting it causes userspace...

kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route

There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...

Google Chrome 安全漏洞

Google Chrome is a browser by Google. A memory misreference vulnerability exists in versions of Google Chrome prior to 119.0.6045.159, which stems from a mix-up in the instructions responsible for freeing memory by the Garbage Collection function. An attacker could exploit this vulnerability to...