thunderbird security update

An update is available for thunderbird. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Thunderbird is a standalone mail and newsgroup client. This updat...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS such that the URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. Details Denial of Service DoS describ...

K000133224: Apache Tomcat vulnerability CVE-2022-42252

Security Advisory Description If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat did not reject a request containing an invalid...

SUSE CVE-2023-25665

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when SparseSparseMaximum is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1...

SUSE CVE-2023-28866

In the Linux kernel through 6.2.8, net/bluetooth/hcisync.c allows out-of-bounds access because ampinit1 and ampinit2 are supposed to have an intentionally invalid element, but do not...

Gecko SDK 安全漏洞

The Silicon Labs Gecko SDK GSDK is an open source library from Silicon Labs. Combines the Silicon Labs Wireless Software Development Kit SDK and the Gecko platform into one integrated package. A security vulnerability exists in the Gecko SDK, which stems from an invalid prepare to write request...

PT-2023-16519 · Unknown · Bluetooth Le Stack

Name of the Vulnerable Software and Affected Versions: Bluetooth LE stack affected versions not specified Description: An invalid prepare write request command can cause the Bluetooth LE stack to run out of memory, resulting in a denial-of-service and failure to handle subsequent connection...

PT-2023-3200

Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description The issue is related to the handling of invalid certificate policies in leaf certificates by OpenSSL. When a non-default option is used for verifying certificates, applications may be...

CVE-2022-40576

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none...

CVE-2022-40574

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none...

CVE-2022-40551

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a malicious invalid input with zero dimension, which crashes a TensorFlow model Check Failed. Note: An attacker must have privilege to provide input to a Convolution3DTranspose call. PoC import tensorflow as...

CLSA-2023-1679943745 Fix CVE(s): CVE-2023-25690

SECURITY UPDATE: proxy configuration may trigger HTTP request smuggling attack - debian/patches/CVE-2023-25690.patch: don't forward invalid query strings - CVE-2023-25690...

Mozilla: Invalid downcast in Worklets

The Mozilla Foundation Security Advisory describes this flaw as: While implementing AudioWorklets, some code may have cast one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash...

CLSA-2023-1679925211 Fix CVE(s): CVE-2023-1170

SECURITY UPDATE: Accessing invalid memory with put in Visual block mode - debian/patches/CVE-2023-1170: Adjust the cursor column if needed - CVE-2023-1170...

OSV-2023-240 Invalid-free in fuzz_die_cu_attrs.c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=57429 Crash type: Invalid-free Crash state: fuzzdiecuattrs.c...

Mozilla: Invalid downcast in Worklets

The Mozilla Foundation Security Advisory describes this flaw as: While implementing AudioWorklets, some code may have cast one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash...

PT-2023-35733 · Git +1 · Libdwarf

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to an Invalid-free crash type, as reported by OSS-Fuzz. The crash occurs in the fuzz die cu attrs.c file. No information is availabl...

Upgraded Q -> 3 from #88 [1679874647648]

Judge has assessed an item in Issue 88 as 3 risk. The relevant finding follows: L-2 Invalid and stale prices from Synthethix are not validated --- The text was updated successfully, but these errors were encountered: All reactions...

AZL-31216 CVE-2023-25665 affecting package tensorflow for versions less than 2.11.1-1

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when SparseSparseMaximum is given invalid sparse tensors as inputs, it can give a null pointer error. A fix is included in TensorFlow version 2.12 and version 2.11.1...