CVE-2024-43370

gettext.js is a GNU gettext port for Node and browsers. The CVE-2024-43370 vulnerability is a cross-site scripting (XSS) vulnerability triggered when .po dictionary files are corrupted. The issue has been fixed in version 2.0.3. A workaround is to control the origin of the dictionary catalog to p...

CVE-2024-43370 gettext.js vulnerable to cross-site scripting (XSS)

gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...

OPENSUSE-SU-2024:14124-1 gettext-its-gtk3-3.24.43-1.1 on GA media

These are all security issues fixed in the gettext-its-gtk3-3.24.43-1.1 package on the GA media of openSUSE Tumbleweed...

RHEL 8 : mingw-gettext (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - gettext: double free in defaultaddmessage in read-catalog.c CVE-2018-18751 Note that Nessus has not tested for this...

RHEL 8 : gettext (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - libcroco: Stack overflow in function crparserparseanycore in cr-parser.c CVE-2020-12825 Note that Nessus has not...

RHEL 8 : gettext (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - gettext: double free in defaultaddmessage in read-catalog.c CVE-2018-18751 Note that Nessus has not tested for this...

openSUSE: Security Advisory for php7 (SUSE-SU-2023:3541-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NewStart CGSL MAIN 5.04 : gettext Vulnerability (NS-SA-2023-0068)

The remote NewStart CGSL host, running version MAIN 5.04, has gettext packages installed that are affected by a vulnerability: - An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an invalid free in pogramparse in po-gram-gen....

@bbc/timeline-state-resolver-tools (>=9.4.0-nightly-release53-6a8a2347-20250820-110110.0 <=10.0.0-nightly-release53-20251030-091938-982ec310.0), @bitrefill/airfill-widget (>=4.2.2 <=4.8.3) +159 more potentially affected by CVE-2024-21528 via node-gettext (>=0.1.2 <=3.0.1)

node-gettext NPM version =0.1.2, =9.4.0-nightly-release53-6a8a2347-20250820-110110.0, =4.2.2, =2.2.0, =2.2.0, =0.9.1, =1.1.2, =4.1.0-alpha.1, =0.0.4, =5.2.0-alpha.13, =5.2.0, =1.0.6, =1.0.17, =1.0.3, =4.1.2, =4.1.4 and more Source cves: CVE-2024-21528 Source advisory: SNYK:JS-NODEGETTEXT-6100943...

Prototype Pollution

Overview node-gettext is an A JavaScript implementation of gettext, a localization framework Affected versions of this package are vulnerable to Prototype Pollution via the addTranslations function in gettext.js due to improper user input sanitization. PoC js const Gettext = require'node-gettext'...

Rocky Linux 8 : gettext (RLSA-2019:3643)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:3643 advisory. - An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an invalid free in pogramparse in...

Ubuntu 16.04 ESM : Gettext vulnerability (USN-4779-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4779-1 advisory. Danilo Segan discovered that Gettext mishandled certain input. An attacker could use this vulnerability to execute arbitrary code. Tenable has extracted the...

The vulnerability of the gettext() function in the distributed version control system Git for Windows allows a hacker to insert any messages they want.

The vulnerability of the gettext function in the distributed version control system Git for Windows is related to an incorrect limitation on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious individual to deploy arbitrary messages...

Oracle Linux 8 : gettext (ELSA-2019-3643)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3643 advisory. 0.19.8.1-17 - Ported CI gating tests to Python 3.6 0.19.8.1-16 - add CI gating tests 0.19.8.1-15 - fix CVE-2018-18751: double-free in xgettext rhbz1647049 Tenab...

Oracle Linux 7 : gettext (ELSA-2020-1138)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1138 advisory. 0.19.8.1-3 - fix CVE-2018-18751: double-free in xgettext rhbz1648433 Tenable has extracted the preceding description block directly from the Oracle Linux securi...

CLSA-2023-1688675103 git: Fix of CVE-2023-25815

CVE-2023-25815: gettext: avoid using gettext if the locale dir is not present...

CLSA-2023-1688673526 git: Fix of CVE-2023-25815

CVE-2023-25815: gettext: avoid using gettext if the locale dir is not present...

git: malicious placement of crafted messages when git was compiled with runtime prefix

A vulnerability was found in Git. This security flaw occurs when Git compiles with runtime prefix support and runs without translated messages, and it still uses the gettext machinery to display messages, which subsequently looks for translated messages in unexpected places. This flaw allows the...

git: malicious placement of crafted messages when git was compiled with runtime prefix

A vulnerability was found in Git. This security flaw occurs when Git compiles with runtime prefix support and runs without translated messages, and it still uses the gettext machinery to display messages, which subsequently looks for translated messages in unexpected places. This flaw allows the...

git: malicious placement of crafted messages when git was compiled with runtime prefix

A vulnerability was found in Git. This security flaw occurs when Git compiles with runtime prefix support and runs without translated messages, and it still uses the gettext machinery to display messages, which subsequently looks for translated messages in unexpected places. This flaw allows the...