Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 16.7.8 and iPadOS version 16.7.8, which stems from a processing file...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS version 17.5 and iPadOS version 17.5, which originates from a...

Apple macOS Monterey Security Vulnerability

Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. A security vulnerability exists in Apple macOS Monterey version 12.5, which stems from handling AppleScript that may result in unexpected termination or leakage of process memory...

CVE-2024-37408

CVE-2024-37408 affects fprintd up to version 1.94.3, where the lack of a security attention mechanism could allow actions authorized by pam_fprintd.so for Sudo. Multiple connected sources (Red Hat, SUSE, Ubuntu, Debian trackers) confirm the issue; some vendors dispute it and suggest PAM configura...

Golang < 1.21.11, 1.22.x < 1.22.4 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.21.11 or 1.22.x prior to 1.22.4. It is, therefore, is affected by multiple vulnerabilities: - archive/zip: mishandling of corrupt central directory record allows for the insertion of code and contents depending on the implementation...

PYSEC-2024-110

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

GO-2024-2887 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Updated microcode packages fix security vulnerabilities

The updated package fixes security vulnerabilities: Hardware logic contains race conditions in some IntelR Processors may allow an authenticated user to potentially enable partial information disclosure via local access. CVE-2023-45733 Sequence of processor instructions leads to unexpected behavi...

CVE-2024-29072

A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability occurs due to improper certification validation of the updater executable before executing it. A low privilege user can trigger the update action which can result in unexpected elevation of privilege...

ERROR: User doesn't have permission for given Destination path is recorded unexpectedly.

The following error message is recorded unexpectedly in the ns.log file of the admin partition for the pendo functionality: "ERROR: User doesn't have permission for given Destination path"...

CVE-2024-4978 Malicious Code in Justice AV Solutions (JAVS) Viewer

Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands...

Apache Tomcat 9.0.0.M1 < 9.0.0.M21

The version of Tomcat installed on the remote host is prior to 9.0.0.M21. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.0.m21security-9 advisory. - The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an err...

Apache Tomcat 8.0.0.RC1 < 8.0.44

The version of Tomcat installed on the remote host is prior to 8.0.44. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat8.0.44security-8 advisory. - The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error pag...

Apache Tomcat 7.0.0 < 7.0.78

The version of Tomcat installed on the remote host is prior to 7.0.78. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat7.0.78security-7 advisory. - The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error pag...

perl-Convert-ASN1: allows remote attackers to cause an infinite loop via unexpected input

perl-Convert-ASN1 aka the Convert::ASN1 module for Perl through 0.27 allows remote attackers to cause an infinite loop via unexpected input...

ALSA-2024:3049 Moderate: perl-Convert-ASN1 security update

Convert::ASN1 encodes and decodes ASN.1 data structures using BER/DER rules. Security Fixes: perl-Convert-ASN1: allows remote attackers to cause an infinite loop via unexpected input CVE-2013-7488 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Potentially Undefined Behavior

firefox is vulnerable to potentially undefined behavior. The vulnerability is due to bypassing move semantics, leading to undefined behavior, which attackers can exploit to cause unexpected crashes or execute arbitrary code...

The vulnerability of the PowerScale OneFS operating system, related to the improper handling of unexpected data types, allows a attacker to trigger a service failure.

The vulnerability of the PowerScale OneFS operating system is related to the improper handling of unexpected data types. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...