Fedora 38 : ofono (2024-e8a02e129e)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e8a02e129e advisory. Backport upstream fixes for CVE-2023-4233 and CVE-2023-4234 Tenable has extracted the preceding description block directly from the Fedora security...

PT-2024-10418

Name of the Vulnerable Software and Affected Versions FFmpeg version 6.1.1 Description The issue is related to an integer overflow in the FFmpeg CAF decoder. This could potentially allow an attacker to cause a denial of service. Recommendations For version 6.1.1, consider updating to a newer...

RHEL 9 : squid (RHSA-2024:1515)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1515 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP and HTTP data objects. Security Fixes: squid: Denial of Service in...

DEBIAN-CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

UBUNTU-CVE-2024-29025

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. The HttpPostRequestDecoder can be tricked to accumulate data. While the decoder can store items on the disk if configured so, there are no limits ...

macOS 14.x < 14.4.1 (HT214096)

The remote host is running a version of macOS / Mac OS X that is 14.x prior to 14.4.1. It is, therefore, affected by a vulnerability: - An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We...

RHEL 8 : squid:4 (RHSA-2024:1479)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1479 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fixes: squid: Denial of Service in...

macOS 13.x < 13.6.6 (HT214095)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.6.6. It is, therefore, affected by a vulnerability: - An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We...

Updated python python3 packages fix security vulnerabilities

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...

[SECURITY] Fedora 40 Update: dav1d-1.4.0-1.fc40

dav1d is a new AV1 cross-platform Decoder, open-source, and focused on speed and correctness...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : dav1d (SUSE-SU-2024:0964-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0964-1 advisory. - CVE-2024-1580: Fixed tilestartoff calculations for extremely large frame sizes bsc1220100. Tenable has...

Oracle Linux 8 : squid:4 (ELSA-2024-1375)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1375 advisory. - Resolves: RHEL-19551 - squid:4/squid: denial of service in HTTP request parsing CVE-2023-50269 - Resolves: RHEL-28611 - squid:4/squid: Denial of...

PT-2024-22685

Name of the Vulnerable Software and Affected Versions Qiskit IBM Runtime versions 0.1.0 through 0.21.1 Description The issue concerns the deserialization of JSON data using qiskit ibm runtime.RuntimeDecoder, which can lead to arbitrary code execution given a correctly formatted input string. This...

Oracle Linux 9 : squid (ELSA-2024-1376)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-1376 advisory. - Resolves: RHEL-19555 - squid: denial of service in HTTP request parsing CVE-2023-50269 - Resolves: RHEL-28614 - squid: Denial of Service in HTTP...

RHEL 8 : squid:4 (RHSA-2024:1375)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1375 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: deni...

The vulnerability of the HttpStateData() function in the Chunked decoder of the Squid proxy server allows a hacker to induce a service failure.

The vulnerability of the HttpStateData function in the Chunked decoder of the Squid proxy server is related to buffer overflows in the stack due to uncontrolled recursion during HTTP message processing. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Squid Denial of Service Vulnerability (CNVD-2024-13541)

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A denial of service vulnerability exists in Squid that stems from the presence of a recursion error, which can be...

DEBIAN-CVE-2023-52491

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it...

UBUNTU-CVE-2023-52491

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it...

CVE-2024-0050

In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a missing validation check. This could lead to a local non-security issue with no additional execution privileges needed. User interaction is not needed for exploitation...