firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response

The Mozilla Foundation's Security Advisory: In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header is not respected and does not force a download, which could allow cross-site scripting XSS attacks...

firefox: thunderbird: XSS due to Content-Disposition being ignored in multipart/x-mixed-replace response

The Mozilla Foundation's Security Advisory: In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header is not respected and does not force a download, which could allow cross-site scripting XSS attacks...

CVE-2024-10461

In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

CVE-2024-10461

In multipart/x-mixed-replace responses, Content-Disposition: attachment in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox 132, Firefox ESR 128.4, Thunderbird 128.4, and Thunderbird 132...

PT-2024-40617 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A heap-buffer-overflow READ 6 crash has been reported. The crash involves the functions extract fmtp, parse sdp session, and parse mixed content...

PT-2024-40604 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 6 crash occurred, involving the functions extract sendrecv mode, parse sdp session, and parse mixed content. Recommendations:...

PT-2024-40606 · Git +1 · Kamailio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue was identified, potentially causing a crash. The crash occurred in the parse mixed content and parse sdp functions,...

California AI Safety Bill Vetoed

Governor Newsom has vetoed the state's AI safety bill. I have mixed feelings about the bill. There's a lot to like about it, and I want governments to regulate in this space. But, for now, it's all EU. Related, the Council of Europe treaty on AI is ready for signature. It'll be legally binding wh...

ROS-20240904-14

A vulnerability in Performance Co-Pilot performance monitoring and visualization software PCP is related to the mixed privilege levels used by systemd services associated with PCP. Exploitation of the vulnerability could allow an attacker to execute a symbolic link attack and break the isolation ...

SUSE CVE-2022-48819

In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice/sendmsgMSGZEROCOPY case syzbot found that mixing sendpage and sendmsgMSGZEROCOPY calls over the same TCP socket would again trigger the infamous warning in inetsockdestruct WARNONskforwardallocgetsk...

CVE-2022-48819

In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice/sendmsgMSGZEROCOPY case syzbot found that mixing sendpage and sendmsgMSGZEROCOPY calls over the same TCP socket would again trigger the infamous warning in inetsockdestruct WARNONskforwardallocgetsk...

UBUNTU-CVE-2022-48819

In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice/sendmsgMSGZEROCOPY case syzbot found that mixing sendpage and sendmsgMSGZEROCOPY calls over the same TCP socket would again trigger the infamous warning in inetsockdestruct WARNONskforwardallocgetsk...

CVE-2022-48819 tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case

In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice/sendmsgMSGZEROCOPY case syzbot found that mixing sendpage and sendmsgMSGZEROCOPY calls over the same TCP socket would again trigger the infamous warning in inetsockdestruct WARNONskforwardallocgetsk...

CVE-2022-48819

Summary: CVE-2022-48819 affects the Linux kernel TCP path. When mixing sendpage() data and MSG_ZEROCOPY via the same socket, a warning in inet_sock_destruct() (sk_forward_alloc_get(sk)) could be triggered, due to the sendpage() path being forgotten in zerocopy handling and the need to keep zeroco...

CVE-2022-48819 tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case

In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice/sendmsgMSGZEROCOPY case syzbot found that mixing sendpage and sendmsgMSGZEROCOPY calls over the same TCP socket would again trigger the infamous warning in inetsockdestruct WARNONskforwardallocgetsk...

AZL-44286 CVE-2024-39312 affecting package botan2 2.14.0-2

Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit encoding of the parameters. A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtree...

The vulnerability of the HMI interface configuration software Monitouch V-SFT lies in the possibility of operations going beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the HMI interface configuration software Monitouch V-SFT lies in the escape of operations beyond the buffer in memory due to the mixing of data types. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a malicious V9C format file...

SUSE CVE-2024-35803

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. According to the UEFI spec, this stack needs to b...

CVE-2024-35803

A security vulnerability was identified in the Linux kernel's EFI Extensible Firmware Interface stub, specifically affecting systems operating in mixed-mode environments. The issue arises from the EFI stub's handling of boot services, which can lead to stack overflows and potential system...

CVE-2024-35803

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. According to the UEFI spec, this stack needs to b...