ROS-20240411-11

A vulnerability in the bsonutf8validate function of the MongoDB database management system is related to a loop with an unreachable exit condition. unreachable exit condition. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service...

ROS-20240411-10

A vulnerability in the bsonutf8validate function of the MongoDB database management system is related to a loop with an unreachable exit condition. unreachable exit condition. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service...

CVE-2024-2496 affecting package libvirt for versions less than 7.10.0-8

CVE-2024-2496 affecting package libvirt for versions less than 7.10.0-8. A patched version of the package is available...

CVE-2023-45288 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, kustomize, cluster-proportional-autoscaler, gostatsd, minify, oauth2-proxy, kuberay-operator, kubernetes-dashboard, flannel, nats-server, terraform, nodetaint, smarter-device-manager, nri-prometheus, sbom-scorecard, kubevela, controller-gen,...

Moderate: Red Hat Security Advisory: less security update

An update for less is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

ROS-20240402-09

A vulnerability in the loginpassword component of the FreeIpa server is related to sending user requests, that can perform actions on behalf of the user. Exploitation of the vulnerability could allow An attacker acting remotely to cause a loss of system confidentiality and integrity...

CVE-2024-29489

Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecmagetobjecttype...

SUSE CVE-2024-2494

A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the gnew0 function results in a crash due to the negative length being...

SUSE CVE-2024-27936

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request...

SUSE CVE-2024-2611

A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

[SECURITY] Fedora 38 Update: mingw-expat-2.6.1-1.fc38

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

CVE-2024-22412

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

CVE-2024-23672 vulnerabilities

Vulnerabilities for packages: tomcat...

SUSE CVE-2023-52514

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

cups: heap buffer overflow may lead to DoS

A flaw was found in the Cups package. A buffer overflow vulnerability in the |formatlogline| function could allow remote attackers to cause a denial of service. Exploitation is only possible when the configuration file, cupsd.conf, has the value of loglevel set to DEBUG...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: spicedb, src, kots, k3s, argo-workflows, kube-bench, trillian, amass, ferretdb, temporal-server, caddy, kine, step, step-ca...

SUSE CVE-2024-25081

Splinefont in FontForge through 20230101 allows command injection via crafted filenames...

SUSE CVE-2022-48624

closealtfile in filename.c in less before 606 omits shellquote calls for LESSCLOSE...

SUSE CVE-2024-20925

unknown...

GHSA-XR7R-F8XQ-VFVV vulnerabilities

Vulnerabilities for packages: cadvisor, zot, nerdctl, grype, newrelic-infrastructure-agent, k3d, kubescape, k3s, podman, skaffold, ctop, buildkitd, docker, kots, trivy, k9s, skopeo, wolfictl, kaniko, kubernetes, zarf, syft, runc...