RHEL 9 : libvpx (RHSA-2023:5539)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5539 advisory. The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimed...

Important: libvpx security update

The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format. Security Fixes: libvpx: Heap buffer overflow in vp8 encoding in libvpx CVE-2023-5217 libvpx: crash related to VP9 encoding in libvp...

OSV-2023-989 Heap-buffer-overflow in load_sections_64

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63074 Crash type: Heap-buffer-overflow READ Crash state: loadsections64 parseclasses64 classes...

OSV-2023-988 Heap-buffer-overflow in xmlCopyCharMultiByte

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63086 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlCopyCharMultiByte xmlParseCommentComplex xmlParseComment...

PT-2023-36067 · Git +1 · Radare2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read crash has been reported. The crash involves the load sections 64, parse classes 64, and classes functions. No information is...

Debian dla-3601 : thunderbird - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3601 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3601-1 [email protected]...

PT-2023-36066 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow crash. Technical details about the crash include the xmlCopyCharMultiByte, xmlParseCommentComplex, and...

OSV-2023-977 Heap-buffer-overflow in _dwarf_memcpy_noswap_bytes

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63024 Crash type: Heap-buffer-overflow READ 8 Crash state: dwarfmemcpynoswapbytes fillinuniarch64 dwarfmachosetup...

OSV-2023-976 Heap-buffer-overflow in Flow::dissectMDNS

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63060 Crash type: Heap-buffer-overflow READ 2 Crash state: Flow::dissectMDNS NetworkInterface::processPacket NetworkInterface::dissectPacket...

Oracle Linux 8 : kvm_utils3 (ELSA-2023-12855)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12855 advisory. - storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' Peter Krempa Orabug: 35644221 CVE-2023-3750 - virpci: Resolve leak in...

Fedora 38 : thunderbird (2023-1f5f7b9b92)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1f5f7b9b92 advisory. Rebase / Update to 115.3.1 ; https://www.thunderbird.net/en-US/thunderbird/115.0/whatsnew/ ; https://support.mozilla.org/en-US/kb/thunderbird-115-supernova-f...

PT-2023-36061 · Git +1 · Libdwarf

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details include a crash type of Heap-buffer-overflow READ 8, and the crash state...

PT-2023-36060 · Git +1 · Ntopng

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. The crash occurs in the Flow::dissectMDNS function, which is called by...

RLSA-2023:5214 Important: libwebp security update

The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photographic images. WebP consists of a codec based on the VP8 format, and a container based on the Resource Interchange File Format RIFF. Webmasters, web...

thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

GHSA-F9PM-4G9P-6VM3 Bundled libwebp in pywebp vulnerable

Impact pywebp versions before v0.3.0 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. The vulnerability was a heap buffer overflow which allowed a remote attacker to perform an out of bounds memory write. Patches The problem has been patched upstream in libwebp 1.3.2. pywe...

Bundled libwebp in pywebp vulnerable

Impact pywebp versions before v0.3.0 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. The vulnerability was a heap buffer overflow which allowed a remote attacker to perform an out of bounds memory write. Patches The problem has been patched upstream in libwebp 1.3.2. pywe...

AlmaLinux 9 : firefox (ALSA-2023:5434)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5434 advisory. - During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash. This vulnerability...

Fedora 37 : thunderbird (2023-6b5635d7d3)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-6b5635d7d3 advisory. Update to 102.15.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/ ; https://www.mozilla.org/en-US/security/advisories/mfsa2023-32/ ;...

RockyLinux 8 : thunderbird (RLSA-2023:5201)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:5201 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the RockyLinux security...