bluez security update

5.63-3 + bluez-5.63-3 - Add back the tests for OSCI. 5.63-2 + bluez-5.63-2 - Change default of ClassicBondedOnly to true to align with HID specification. - Resolves: RHEL-18429 - Fixing CVE-2021-41229...

Mozilla Thunderbird < 128.5.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.5.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-69 advisory. - The Matrix specification demands homeservers to perform validation of the server-name and media-id components o...

Security Vulnerabilities fixed in Thunderbird 128.5.2 — Mozilla

The Matrix specification demands homeservers to perform validation of the server-name and media-id components of MXC URIs with the intent to prevent path traversal. However, it is not mentioned that a similar check must also be performed on the client to prevent client-side path traversal...

GHSA-H97M-WW89-6JMQ `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

idna 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with...

RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

idna 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with...

CVE-2024-11705

NSCDeriveKey inadvertently assumed that the phKey parameter is always non-NULL. When it was passed as NULL, a segmentation fault SEGV occurred, leading to crashes. This behavior conflicted with the PKCS11 v3.0 specification, which allows phKey to be NULL for certain mechanisms. This vulnerability...

PT-2024-9960

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 133 Mozilla Thunderbird versions prior to 133 Description: The issue is related to the NSC DeriveKey function in Mozilla Firefox and Thunderbird, which incorrectly assumes that the phKey parameter is always...

PDF-XChange Editor 缓冲区错误漏洞

PDF-XChange Editor is a PDF editor software and PDF reader. PDF-XChange Editor XPS file parsing has an out-of-bounds read remote code execution vulnerability that can be exploited by an attacker to execute code in the context of the current process...

CVE-2024-50226

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report 1, cxltest was updated to register mock memory-devices after the mock root-port/bus device had been...

Mz Automation Libiec61850 安全漏洞

Mz Automation Libiec61850 is an open source library for the IEC 61850 protocol from Mz Automation. A security vulnerability exists in Mz Automation Libiec61850 that stems from the presence of a null pointer dereference that allows a malicious server to cause a denial of service via an MMS...

CVE-2024-50226

CVE-2024-50226 : Linux kernel vulnerability in the CXL port code. A use-after-free during teardown of a region with multiple endpoint decoders (example: decoders 7.0 and 14.0 sharing a switch-decoder 3.0) could allow out-of-order shutdown and leave stale references. The patch ensures: (1) proper ...

CVE-2024-50226 cxl/port: Fix use-after-free, permit out-of-order decoder shutdown

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report 1, cxltest was updated to register mock memory-devices after the mock root-port/bus device had been...

CVE-2024-10975

CVE-2024-10975 affects HashiCorp Nomad: Nomad Community Edition prior to 1.9.2 and Nomad Enterprise prior to 1.9.2, 1.8.7, or 1.7.15. The issue allows arbitrary cross-namespace volume creation via unauthorized CSI writes, with CVSS v3.1 base score 7.7 (HIGH): network attack vector, requiring low ...

CVE-2024-50141

In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFIMEMORYRUNTIME block for PRM handler and context PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services. The issue arises because the PRMT is finding a block of type...

CVE-2024-50141 ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context

In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFIMEMORYRUNTIME block for PRM handler and context PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services. The issue arises because the PRMT is finding a block of type...

CVE-2024-50345 Open redirect via browser-sanitized URLs in symfony/http-foundation

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class...

CVE-2024-50345

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class...

The vulnerability of the Quality Manager Specification component in the Oracle Process Manufacturing (OPM) application for process development management system of the Oracle E-Business Suite allows a malicious actor to gain access to read, modify, or delete data.

The vulnerability of the Quality Manager Specification component in the Oracle Process Manufacturing OPM application for process development management system of the Oracle E-Business Suite is related to deficiencies in the authorization procedures. Exploiting this vulnerability could allow an...

CVE-2024-21250

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite component: Quality Manager Specification. Supported versions that are affected are 12.2.13-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP...

Agent Dart is missing certificate verification checks

Certificate verification in lib/agent/certificate.dart has been found to contain two issues: - During the delegation verification in checkDelegation function the canisterranges aren't verified. The impact of not checking the canisterranges is that a subnet can sign canister responses in behalf of...