DEBIAN-CVE-2024-35176

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this...

UBUNTU-CVE-2024-35176

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this...

AZL-42037 CVE-2024-32020 affecting package git for versions less than 2.39.4-1

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a...

CVE-2024-27982 affecting package nodejs18 for versions less than 18.20.2-1

CVE-2024-27982 affecting package nodejs18 for versions less than 18.20.2-1. A patched version of the package is available...

CVE-2023-38709 affecting package httpd for versions less than 2.4.59-1

CVE-2023-38709 affecting package httpd for versions less than 2.4.59-1. An upgraded version of the package is available that resolves this issue...

AZL-40334 CVE-2024-27061 affecting package hyperv-daemons for versions less than 6.6.29.1-1

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Fix use after free in unprepare sun8icecipherunprepare should be called before cryptofinalizeskcipherrequest, because client callbacks may immediately free memory, that isn't needed anymore. But it will be used...

CVE-2022-41717 affecting package moby-cli for versions less than 24.0.9-1

CVE-2022-41717 affecting package moby-cli for versions less than 24.0.9-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-32487 affecting package less for versions less than 590-4

CVE-2024-32487 affecting package less for versions less than 590-4. A patched version of the package is available...

CVE-2024-3852

GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

CVE-2024-3856

A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects Firefox 125...

AZL-38575 CVE-2023-45288 affecting package node-problem-detector for versions less than 0.8.15-4

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

RHEL 8 : firefox (RHSA-2024:1491)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:1491 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5

CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5. A patched version of the package is available...

CVE-2022-45873 affecting package systemd-bootstrap for versions less than 250.3-17

CVE-2022-45873 affecting package systemd-bootstrap for versions less than 250.3-17. A patched version of the package is available...

CVE-2023-39318 affecting package golang for versions less than 1.21.6-1

CVE-2023-39318 affecting package golang for versions less than 1.21.6-1. A patched version of the package is available...

CVE-2023-39319 affecting package golang for versions less than 1.21.6-1

CVE-2023-39319 affecting package golang for versions less than 1.21.6-1. A patched version of the package is available...

CVE-2023-44487 affecting package golang for versions less than 1.21.6-1

CVE-2023-44487 affecting package golang for versions less than 1.21.6-1. A patched version of the package is available...

CVE-2023-48795 affecting package jsch for versions less than 0.1.55-2

CVE-2023-48795 affecting package jsch for versions less than 0.1.55-2. A patched version of the package is available...

AZL-35267 CVE-2023-40547 affecting package shim-unsigned-aarch64 for versions less than 15.8-3

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

AZL-33896 CVE-2023-51258 affecting package yasm for versions less than 1.3.0-16

A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the newToken function in the modules/preprocs/nasm/nasm-pp:1512...