[SECURITY] [DSA 5821-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5821-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 27, 2024 https://www.debian.org/security/faq -...

OPENSUSE-SU-2024:14532-1 libsndfile-devel-1.2.2-3.1 on GA media

These are all security issues fixed in the libsndfile-devel-1.2.2-3.1 package on the GA media of openSUSE Tumbleweed...

gitea -- multiple vulnerabilities

Problem Description: Fix delete branch perm checking Upgrade crypto library...

OPENSUSE-SU-2024:14531-1 libjxl-devel-0.11.1-1.1 on GA media

These are all security issues fixed in the libjxl-devel-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-10240

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project,...

CVE-2024-11669

An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes...

CVE-2024-8177

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry...

CVE-2024-8114

An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token PAT to escalate privileges...

CVE-2024-11828

A denial of service DoS condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlie...

CVE-2024-11705

creationtimestamp| type| source ---|---|--- 2024-11-26 14:22:04+00:00| seen| https://infosec.exchange/users/cve/statuses/113549700230486413...

CVE-2024-11703 vulnerabilities

Vulnerabilities for packages: firefox-esr, firefox...

CVE-2024-11704 vulnerabilities

Vulnerabilities for packages: firefox-esr, firefox...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on November 26, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-331-01 Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC ICSA-24-331-02...

OPENSUSE-SU-2024:14527-1 neomutt-20241114-1.1 on GA media

These are all security issues fixed in the neomutt-20241114-1.1 package on the GA media of openSUSE Tumbleweed...

Mozilla Firefox < 133.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 133.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-63 advisory. - A double-free issue could have occurred in secpkcs7decoderstartdecrypt when handling an error path. Under...

CVE-2024-11699

Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 133, Firefox ESR...

CVE-2024-11694

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability...

SUSE: Security Advisory (SUSE-SU-2024:4054-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:4052-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-53098

creationtimestamp| type| source ---|---|--- 2024-11-25 21:28:13+00:00| seen| https://infosec.exchange/users/cve/statuses/113545713625109946 2024-11-25 21:31:24+00:00| seen| https://infosec.exchange/users/cve/statuses/113545726140950160 2026-03-19 00:00:00+00:00| seen|...