RHEL 7 : thunderbird (RHSA-2024:2913)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:2913 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 115.11.0. Security Fixes: firefox...

CVE-2024-35887

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35887 ax25: fix use-after-free bugs caused by ax25_ds_del_timer

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35887

CVE-2024-35887 affects the Linux kernel ax25 subsystem. When an ax25 device detaches, ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer; if the timer handler is running, del_timer() may run concurrently with ax25_dev_put() freeing the device, causing a use-after-free. Th...

CVE-2024-35869 smb: client: guarantee refcounted children from parent session

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon-ses are also...

CVE-2024-35869 smb: client: guarantee refcounted children from parent session

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon-ses are also...

Fedora 40 : firefox (2024-eabe68b149)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-eabe68b149 advisory. - new upstream update 126.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

CVE-2024-35797

CVE-2024-35797 is a vulnerability in the Linux kernel’s memory management, specifically affecting the cachestat feature when handling shared memory. The flaw stems from race conditions during operations like swapping or invalidation, which can lead to out-of-bounds memory access or invalid pointe...

CVE-2024-35797

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1 A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling...

CVE-2024-35797

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1 A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling...

CVE-2024-35797 mm: cachestat: fix two shmem bugs

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1 A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling...

CVE-2024-35797

CVE-2024-35797 pertains to the Linux kernel, specifically the mm: cachestat path involving two shmem-related bugs that could occur when cachestat runs concurrently with swapping and invalidation. Root causes described in the sources: (1) a poisoned swap entry in the shmem inode’s xarray could lea...

CVE-2024-35797

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1 A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling...

CVE-2024-35789

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fastrx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free...

CVE-2024-35789 wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fastrx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free...

Oracle Linux 9 : thunderbird (ELSA-2024-2888)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-2888 advisory. 115.11.0-1.0.1 - Add Oracle prefs 115.11.0-1 - Update to 115.11.0 build2 Tenable has extracted the preceding description block directly from the Oracle...

Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of the...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of the...

Important: Red Hat Security Advisory: firefox security update

An update for Firefox is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...