[SECURITY] [DLA 4078-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4078-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort March 06, 2025 https://wiki.debian.org/LTS -...

CVE-2024-47262

Dzmitry Lukyanenka, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API param.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the web interface of the Axis device. Other API endpoints or services not making use of param.cgi are not...

CVE-2025-27625

In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash \ characters are considered safe, allowing attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site, because browsers interpret these characters as...

CVE-2025-20930

Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory...

CVE-2025-20925

Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read memory...

CVE-2025-20924

Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles...

CVE-2025-20922

CVE-2025-20922 affects Samsung Notes. The vulnerability is an out-of-bounds read in the function that appends text paragraphs, allowing an attacker to read memory beyond bounds. Affected versions are prior to 4.4.26.71. The available remediation is to update to 4.4.26.71 or later. No exploitation...

CVE-2025-20915

Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...

CVE-2025-20910

CVE-2025-20910 affects Galaxy Watch Gallery versions prior to SMR Mar-2025 Release 1, where an incorrect default permission allows local attackers to access data in Galaxy Watch Gallery. The CVSS v3.1 vector (Local, Low attack complexity, No privileges, No user interaction) yields a base score of...

CVE-2025-21089

in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read...

CVE-2019-20208

dimCRead in isomedia/boxcode3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow...

CVE-2025-27655

creationtimestamp| type| source ---|---|--- 2025-03-06 00:00:21+00:00| seen| https://bsky.app/profile/vulnalerts.bsky.social/post/3ljo6sbajj52b 2025-03-06 02:16:26+00:00| seen| Telegram/1Np4XDUTqbMrImIcHm8RIgunvF0kDg4Xu2I85ZHdh8fyW9e 2025-03-06 12:00:15+00:00| seen|...

CVE-2024-57972

The pairing API request handler in Microsoft HoloLens 1 Windows Holographic through 10.0.17763.3046 and HoloLens 2 Windows Holographic through 10.0.22621.1244 allows remote attackers to cause a Denial of Service resource consumption and device unusability by sending many requests through the Devi...

CVE-2025-27508

creationtimestamp| type| source ---|---|--- 2025-03-05 23:39:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljo5nlazil2q 2025-03-06 01:18:19+00:00| seen| https://t.me/cvedetector/19663...

CVE-2024-51144

Cross Site Request Forgery CSRF vulnerability exists in the 'pvmsg.php?action=addmessage', pvmsg.php?action=confirmdelete , and ajax.server.php?page=user&action=flipfollow endpoints in Ampache = 6.6.0...

CVE-2024-31525

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result...

CVE-2025-20206

Cisco Secure Client for Windows is affected by an IPC channel vulnerability that could allow a local attacker with valid credentials to perform a DLL hijack and execute arbitrary code with SYSTEM privileges when the Secure Firewall Posture Engine (formerly HostScan) is installed. Root cause is in...

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Security Vulnerabilities fixed in Firefox ESR 128.8 MFSA 2025-16 bsc1237683 - CVE-2024-43097: Overflow when growing an SkRegion's RunArray - CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the Browser process -...

CVE-2024-13471

creationtimestamp| type| source ---|---|--- 2025-03-05 11:37:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6539 2025-03-05 14:26:12+00:00| seen| https://t.me/cvedetector/19626 2025-03-05 16:00:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ljndxykpxh2q 2025-03-06...

CVE-2025-1702

creationtimestamp| type| source ---|---|--- 2025-03-05 11:37:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6537 2025-03-05 13:00:21+00:00| published-proof-of-concept| Telegram/DsqY2xCUAceOk6gVX-WbKwN-bFih9TINF-Jy-5d0JrLUuxc 2025-03-05 14:26:13+00:00| seen|...