Important: ghostscript

Issue Overview: NOTE: https://ghostscript.readthedocs.io/en/gs10.03.1/News.html NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908 ghostpdl-10.03.1 NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707754 CVE-2024-33871 Affected...

Important: R

Issue Overview: Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end user's system...

Medium: openssl

Issue Overview: Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep CVE-2024-26605 In the...

0me.sh (0.1.15), 0xrtest (1.0.0) +2407 more potentially affected by CVE-2024-29415 via ip (>=2.0.0, <=2.0.1)

ip NPM version =2.0.0, =1.0.1, =0.0.1, =1.0.3, =0.0.11, =0.0.0-experimental-827-react-checked-states, =0.0.0-experimental-827-react-checked-states, =3.5.0-rc.1 and more Source cves: CVE-2024-29415 Source advisory: OSV:GHSA-2P57-RM9W-GVFP...

Important: less

Issue Overview: less through 653 allows OS command execution via a newline character in the name of a file, because quoting is mishandled in filename.c. Exploitation typically requires use with attacker-controlled file names, such as the files extracted from an untrusted archive. Exploitation als...

Medium: ghostscript

Issue Overview: An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard. CVE-2023-52722 Affected Packages: ghostscript Issue Correction: Run dnf update ghostscript --releasever 2023.4.20240528 to upda...

Low: bcc

Issue Overview: If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default...

Important: php8.2

Issue Overview: The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cook...

GHSA-HHC7-X9W4-CW47 Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2024-30046 | .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 8.0. This advisory also provides guidance on what developers can do to update their...

Important: unbound

Issue Overview: An issue was discovered in some DNS recursive resolvers that allows remote attackers to cause a denial of service using a maliciously designed authority and response amplification. CVE-2024-33655 Affected Packages: unbound Issue Correction: Run dnf update unbound --releasever...

Important: python3.11

Issue Overview: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can r...

Medium: curl

Issue Overview: This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this b...

Medium: curl

Issue Overview: When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protoco...

Important: nghttp2

Issue Overview: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage ...

Important: mod_http2

Issue Overview: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion. CVE-2024-27316 Affected Packages: modhttp2 Issue Correction: Run dnf...

5ug-cli (>=1.0.72, <=1.4.0), @0xgraph/cli (>=0.0.1, <=0.2.1) +822 more potentially affected by CVE-2024-33883 via ejs (>=3.0.1, <=3.1.9)

ejs NPM version =3.0.1, =1.0.72, =0.0.1, =1.1.0, =0.1.7, =0.0.9, =1.0.1, =2.16.49, =1.2.4, =1.15.41, =2.0.0-beta.2, =2.0.0-beta.2, =1.1.21, =1.4.3 and more Source cves: CVE-2024-33883 Source advisory: OSV:GHSA-GHR5-CH3P-VCR6...

SUSE SLES15: kubernetes1.24-apiserver / kubernetes1.24-client / etc (SUSE-SU-2024:1164-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1164-1 advisory. - CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. bsc1219964 Tenable has extracted the preceding descriptio...

2002-app-demo (>=1.0.0, <=1.2.1), 3.21lianxi (1.0.0) +1339 more potentially affected by CVE-2024-30261 via undici (>=5.0.0, <=5.28.3)

undici NPM version =5.0.0, =1.0.0, =0.5.0, =0.1.23, =0.1.0, =0.1.1, =0.2.0, =0.5.7, =17.0.0-rc.3, =1.0.0, =12.0.0, =12.0.6 and more Source cves: CVE-2024-30261 Source advisory: OSV:GHSA-9QXR-QJ54-H672...

@angular-devkit/build-angular (>=17.1.0-next.1, <=18.0.0-next.1), @directus/api (>=15.0.0, <=19.0.2) +42 more potentially affected by CVE-2024-30260 via undici (>=6.0.0, <=6.10.2)

undici NPM version =6.0.0, =17.1.0-next.1, =15.0.0, =10.0.15, =1.0.7, =2.0.3-dev.1707221040-ae57d7fac, =2.3.0-dev.1707221040-ae57d7fac, =9.0.0-next.34, =17.2.4-snapshot-1710342685688, =17.2.4-snapshot-1710342685688, =0.0.0-nightly-20240325-3d2380c, =1.0.0, =1.0.0, =15.0.0-dev.1711510274-f1f69dafa...