Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Mozilla Thunderbird 128.2.3 MFSA 2024-43 bsc1229821 CVE-2024-8394: Crash when aborting verification of OTR chat. CVE-2024-8385: WASM type confusion involving ArrayTypes. CVE-2024-8381: Type confusion when looking up a property name in...

kernel: usb-storage: alauda: Fix uninit-value in alauda_check_media()

An uninitialized value vulnerability was found in the alauda USB storage driver in the Linux kernel. In alaudacheckmedia, the function does not verify that USB transfer operations succeeded before using the received data. If a transfer fails, uninitialized memory may be accessed, leading to...

GHSA-2WQ5-G96F-MV3V Ouch! allows a segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...

Ouch! allows a segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...

PT-2024-40036 · Ouch · Ouch

Name of the Vulnerable Software and Affected Versions: ouch affected versions not specified Description: The issue arises when attempting to decompress a file using ouch. It involves reaching the function ouch::archive::zip::convert zip date time, which contains an unsafe function, transmute. Thi...

RUSTSEC-2024-0374 Segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...

Segmentation fault due to use of uninitialized memory

When trying to decompress a file using "ouch", we can reach the function "ouch::archive::zip::convertzipdatetime". In the function, there is a unsafe function, "transmute". Once the "transmute" function is called to convert the type of "month" object, the address of the object is changed to the...

CLSA-2024-1726651745 kernel: Fix of 4 CVEs

drm/vmwgfx: Validate the box size for the snooped cursor CVE-2022-36280 - USB: eneusb6250: Allocate enough memory for full object CVE-2023-45862 - Bluetooth: L2CAP: Fix attempting to access uninitialized memory CVE-2022-42895 - stm class: Fix a double free in stmregisterdevice CVE-2024-38627...

Important: firefox

Issue Overview: Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox 129, Firefox ESR 115.14, Firefox ESR 128.1, Thunderbird 128.1, and Thunderbird...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly validating link sizes, which could lead to uninitialized memory accesses...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly initialize args.context before nfsd4encodefattr4, which could result in the release of...

UBUNTU-CVE-2024-8654

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3...

MongoDB Server 安全漏洞

MongoDB Server is a set of open source NoSQL databases from the American company MongoDB. The database provides collection-oriented storage, dynamic querying, data replication and automatic failover. A security vulnerability exists in MongoDB Server versions v6.0 through 6.0.3 that stems from...

mongodb -- MongoDB Server access to non-initialized memory

[email protected] reports: MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage...

openSUSE Security Advisory (SUSE-SU-2024:3112-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-8178

The ctlwritebuffer and ctlreadbuffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which...

FreeBSD 安全漏洞

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. A security vulnerability exists in FreeBSD, which stems from the ctlwritebuffer and ctlreadbuffer functions allocating memory for return to user space without initializing it...

CVE-2024-45004

CVE-2024-45004 affects the Linux kernel KEYS: trusted: dcp path. The bug leaks the blob encryption key (BEK) plaintext on export because BEK decryption occurs in-place in the key blob; subsequent reads output the BEK in plain text. The issue arises when importing a DCP-based trusted key and expor...

FreeBSD : md4c -- DoS attack (f2b1da2e-6178-11ef-8a7d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f2b1da2e-6178-11ef-8a7d-b42e991fc52e advisory. [email protected] reports: mdanalyzeline in md4c.c in md4c 0.4.7 allows attackers to trigger use of...

The vulnerability of the nf_osf_find() function in the netfilter component of the Linux operating system allows a hacker to compromise the confidentiality of the system.

The vulnerability of the nfosffind function in the netfilter component of the Linux operating system is related to the copying of uninitialized memory areas into nftosf, which can be exploited to leak outdated kernel stack data. Exploiting this vulnerability could allow an attacker to compromise...