OPENSUSE-SU-2024:14554-1 oras-1.2.1-1.1 on GA media

These are all security issues fixed in the oras-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

[SECURITY] [DLA 3976-1] tgt security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3976-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz November 30, 2024 https://wiki.debian.org/LTS -...

CVE-2024-11706 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

CVE-2024-11693

The executable file warning was not presented when downloading .library-ms files. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox 133, Firefox ESR 128.5, Thunderbird 133, and Thunderbird 128.5...

CVE-2024-10978 affecting package postgresql for versions less than 16.5-1

CVE-2024-10978 affecting package postgresql for versions less than 16.5-1. An upgraded version of the package is available that resolves this issue...

MGASA-2024-0358 Updated mpg123 packages fix security vulnerability

An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution may not be dismissed. The complexity required to exploit this fla...

RockyLinux 8 : kernel-rt (RLSA-2024:8870)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8870 advisory. kernel: net/bluetooth: race condition in conninfomin,maxageset CVE-2024-24857 kernel: dmaengine: fix NULL pointer in channel unregistration function...

Malicious code in fedlearnre (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cbc005ae139aa93da4c4f580aaef573edfee5f079036ff5989a8974a15d3cb14 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in music-source-separation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a4aa4c5d893735fb71d4983056b6d254f087a4f5c82df6976e2efdab41f0c9f2 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11544 Malicious code in byted-flex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f7c46f02d189ba471aba10b985193a2e0476f4f7f9f6e068ddf3fe79c2088ea1 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in apa-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 361503e28f7ed26889dd3b64e15bd3702d16e1c57dcc009a2cd1e0a7303a85aa The OpenSSF Package Analysis project identified 'apa-components' @ 6.1.3 npm as malicious. It is considered malicious because: - The package...

7ghost (>=4.11.16 <=4.11.46), @abhilashgoswami/block-text (>=0.0.6 <=0.0.7) +227 more potentially affected by CVE-2020-26303 via insane (>=2.4.0 <=2.6.2)

insane NPM version =2.4.0, =4.11.16, =0.0.6, =0.0.8, =8.3.28-ST.0, =0.2.0, =0.0.2-canary.1.10.0, =2.35.0, =14.42.1-canary.1016.19978.0, =0.1.0, =22.0.0, =0.1.0, =1.9.3, =0.1.0, =0.13.85 and more Source cves: CVE-2020-26303 Source advisory: OSV:GHSA-W455-MFQ9-HF74...

Malicious code in react-native-community (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in mowirie (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alexablueprintswizard (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-43892 affecting package kernel for versions less than 5.15.167.1-1

CVE-2024-43892 affecting package kernel for versions less than 5.15.167.1-1. A patched version of the package is available...

Ubuntu: Security Advisory (USN-7003-5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenIPMI-2.0.36.4+git.c114912-1.1 on GA media (moderate)

OpenIPMI-2.0.36.4+git.c114912-1.1 on GA media Announcement ID: openSUSE-SU-2024:14373-1 Rating: moderate Cross-References: CVE-2024-42934 CVSS scores: CVE-2024-42934 SUSE : 5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVE-2024-42934 SUSE : 2.3...

CVE-2024-45614 vulnerabilities

Vulnerabilities for packages: ruby3.2-puma, gitlab-cng...

MAL-2024-11603 Malicious code in haaahhaha (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8c6599371614e7710276d1475abae424b77a913aed8885e7191b0db82d96e40 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...