SUSE-SU-2024:0242-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird 115.7 MFSA 2024-04 bsc1218955: - CVE-2024-0741: Out of bounds write in ANGLE - CVE-2024-0742: Failure to update user input timestamp - CVE-2024-0746: Crash when listing printers on Linux - CVE-2024-0747:...

The vulnerability of the Server Key Distribution service in the Windows operating system allows a hacker to circumvent existing security restrictions.

The vulnerability of the Server Key Distribution service in the Windows operating system is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

RHEL 8 : krb5 (RHSA-2024:0252)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0252 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending...

Rocky Linux 8 : idm:DL1 (RLSA-2024:0143)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0143 advisory. - A security feature bypass vulnerability exists in the way Key Distribution Center KDC determines if a service ticket can be used for delegation via...

AlmaLinux 8 : idm:DL1 (ALSA-2024:0143)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0143 advisory. Kerberos: delegation constrain bypass in S4U2Proxy CVE-2020-17049 ipa: Invalid CSRF protection CVE-2023-5455 Tenable has extracted the preceding descripti...

Kerberos: delegation constrain bypass in S4U2Proxy

It was found that the Kerberos Key Distribution Center KDC delegation feature, Service for User S4U, did not sufficiently protect the tickets it's providing from tempering. A malicious, authenticated service principal allowed to delegate could use this flaw to impersonate a non-forwardable user...

CentOS 8 : idm:DL1 (CESA-2024:0143)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2024:0143 advisory. - A security feature bypass vulnerability exists in the way Key Distribution Center KDC determines if a service ticket can be used for delegation via...

CVE-2024-21316

Windows Server Key Distribution Service Security Feature Bypass...

CVE-2024-21316

Windows Server Key Distribution Service Security Feature Bypass...

Security feature bypass

Windows Server Key Distribution Service Security Feature Bypass...

CVE-2024-21316 Windows Server Key Distribution Service Security Feature Bypass

...

CVE-2024-21316

CVE-2024-21316 is a Windows Server vulnerability described as a Key Distribution Service Security Feature Bypass. Documents confirm the issue affects Windows Server/KDS handling and carry a CVSS v3.1 base score of 6.1 (Network, Low attack complexity, High privileges required, User interaction req...

CVE-2024-21316 Windows Server Key Distribution Service Security Feature Bypass

...

January 9, 2024—KB5034129 (OS Build 20348.2227)

None None...

January 9, 2024—KB5034130 (OS Build 25398.643)

None None...

Windows Server Key Distribution Service Security Feature Bypass

...

Microsoft Windows Server Key Distribution Service Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Server Key Distribution Service. An attacker could exploit this vulnerability to bypass certain features. The following products and...

PT-2024-1153 · Microsoft · Windows Server Key Distribution Service +1

Name of the Vulnerable Software and Affected Versions: Windows Server Key Distribution Service affected versions not specified Description: The issue is related to errors in the certificate authentication procedure of the Windows Server Key Distribution Service. It allows a remote attacker to...

NewStart CGSL MAIN 5.04 : krb5 Multiple Vulnerabilities (NS-SA-2023-0102)

The remote NewStart CGSL host, running version MAIN 5.04, has krb5 packages installed that are affected by multiple vulnerabilities: - The Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/dotgsreq.c via a FAST inne...

krb5: double-free in KDC TGS processing

A vulnerability was found in MIT krb5, where an authenticated attacker can cause a KDC to free the same pointer twice if it can induce a failure in authorization data handling...