Important: open-vm-tools

Issue Overview: VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be ab...

@affinidi/common-check-widget (1.5.1), @deep-foundation/deepcase-app (>=0.1.0-beta.20, <=0.1.0-beta.41) +31 more potentially affected by CVE-2023-46234 via browserify-sign (>=2.6.0, <=4.0.4)

browserify-sign NPM version =2.6.0, =0.1.0-beta.20, =1.4.1673-beta.0, =1.4.811, =1.1.3, =1.1.1, =1.3.0-15, =3.3.0, =0.1.1, =3.7.0, =3.10.0 and more Source cves: CVE-2023-46234 Source advisory: OSV:GHSA-X9W5-V3Q2-3RHW...

Medium: libXpm

Issue Overview: A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43786 libX11: integer overflow in XCreateImage leading to a heap...

Important: docker

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: docker Issue Correction: Run dnf update docker...

Important: nginx

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 Affected Packages: nginx Issue Correction: Run dnf update nginx...

GHSA-67HX-6X53-JW92 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Impact Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluateor path.evaluateTruthy internal Babel methods. Known affected plugins are: - @babel/plugin-transform-runtime -...

CVE-2023-5535

A heap-based buffer overflow vulnerability was found in some affected packages of Vim. This flaw allows an attacker to send a specially crafted file that could lead to a complete system compromise when opened by a victim...

@anfo/difftool (>=0.0.1, <=0.0.11), @bdefore/nivo-patterned-radial-arc (0.79.1) +125 more potentially affected by CVE-2023-26152 via static-server (>=2.0.0, <=2.2.1)

static-server NPM version =2.0.0, =0.0.1, =0.0.1, =2.0.0-beta.1, =0.1.21, =0.5.0, =0.0.1, =2.59.1-alpha.1, =1.1.0, =3.0.3, =0.1.10, =1.0.0, =1.0.2 and more Source cves: CVE-2023-26152 Source advisory: OSV:GHSA-V834-RHV4-65M3...

Medium: mutt

Issue Overview: Null pointer dereference when viewing a specially crafted email in Mutt 1.5.2 1.5.2 2.2.12 CVE-2023-4875 Affected Packages: mutt Issue Correction: Run dnf update mutt --releasever 2023.2.20231002 or dnf update --advisory ALAS2023-2023-357 --releasever 2023.2.20231002 to update you...

Important: ghostscript

Issue Overview: In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS...

Medium: cups

Issue Overview: A vulnerability was found in OpenPrinting CUPS. The security flaw occurs due to failure in validating the length provided by an attacker-crafted CUPS document, possibly leading to a heap-based buffer overflow and code execution. CVE-2023-4504 Affected Packages: cups Issue...

Important: curl

Issue Overview: HTTP headers eat all memory NOTE: https://www.openwall.com/lists/oss-security/2023/09/13/1 NOTE: https://curl.se/docs/CVE-2023-38039.html NOTE: Introduced by: https://github.com/curl/curl/commit/7c8c723682d524ac9580b9ca3b71419163cb5660 curl-7830 NOTE: Experimental tag removed in:...

Medium: pmix

Issue Overview: OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. CVE-2023-41915 Affected Packages: pmix Issue Correction: Run dnf update pmix --releasever 2023.2.20231002 or...

Low: libwebp

Issue Overview: No CVE associated with this advisory Affected Packages: libwebp Issue Correction: Run dnf update libwebp --releasever 2023.2.20231002 or dnf update --advisory ALAS2023-2023-358 --releasever 2023.2.20231002 to update your system. More information on how to update your system can be...

123-x-ed-eied (>=1.0.5, <=1.0.6), 1k-tasks (>=2.3.0, <=3.6.1) +5857 more potentially affected by CVE-2023-44270 via postcss (>=8.0.0, <=8.4.30)

postcss NPM version =8.0.0, =1.0.5, =2.3.0, =1.0.0, =0.0.14, =1.0.51, =0.0.23-alpha.5, =0.3.27, =1.6.1, =0.3.0, =0.0.2, =0.0.1, =0.14.3 and more Source cves: CVE-2023-44270 Source advisory: OSV:GHSA-7FH5-64P2-3V2J...

ac-rumqttc (>=0.21.0-alpha.1, <=0.21.0-alpha.2), acme (0.1.40) +1096 more potentially affected by CVE-2023-43669 via tungstenite (>=0.5.4, <=0.19.0)

tungstenite CARGO version =0.5.4, =0.21.0-alpha.1, =0.1.41, =0.1.0, =0.0.4, =0.1.0, =0.10.0-alpha.1.6, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2023-43669 Source advisory: OSV:RUSTSEC-2023-0065...

Medium: nasm

Issue Overview: A Segmentation Fault issue discovered in in ieeesegment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. CVE-2020-21528 Affected Packages: nasm Issue Correction: Run dnf update nasm --releasever...

Medium: libtiff

Issue Overview: An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2022-40090 Affected Packages: libtiff Issue Correction: Run dnf update libtiff --releasever 2023.2.20230920 or dnf update --advisory...

Medium: poppler

Issue Overview: In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service application crashes with SIGABRT by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomple...

Medium: ImageMagick

Issue Overview: A vulnerability was found in ImageMagick. This issue occurs as an undefined behavior, casting double to sizet in svg, mvg and other coders. CVE-2023-34151 Affected Packages: ImageMagick Issue Correction: Run dnf update ImageMagick --releasever 2023.1.20230825 or dnf update...