145300 matches found
firefox: thunderbird: Sandbox escape in the DOM: Navigation component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Navigation component...
firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Storage: Quota Manager component...
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...
firefox: thunderbird: Information disclosure in the Networking: JAR component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: JAR component...
firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component...
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the XPCOM component...
firefox: thunderbird: Privilege escalation in the Address Bar component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Address Bar component...
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component...
firefox: Sandbox escape due to use-after-free in the Graphics component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Graphics component...
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the JavaScript: WebAssembly component...
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component...
firefox: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: WebAssembly component...
firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Graphics component...
Important: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
firefox: thunderbird: Information disclosure in the Networking component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking component...
firefox: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Canvas2D component...
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Privilege escalation in the DLL Services component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DLL Services component...
firefox: thunderbird: Privilege escalation in the DOM: Service Workers component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Service Workers component...
firefox: thunderbird: Same-origin policy bypass in the WebExtensions component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the WebExtensions component...
firefox: firefox: Sandbox escape via use-after-free in DOM component
A flaw was found in Firefox. A use-after-free memory flaw in the Document Object Model DOM Core and HTML component allows a remote attacker to perform a sandbox escape. By enticing a user to visit a specially crafted web page, an attacker can leverage this vulnerability to execute arbitrary code...
firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...
firefox: thunderbird: Uninitialized memory in the Audio/Video component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Uninitialized memory in the Audio/Video component...
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Internationalization component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to incorrect boundary conditions in the Internationalization component...
firefox: Privilege escalation due to use-after-free in the Graphics: WebRender component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation due to use-after-free in the Graphics: WebRender component...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openshell: openshell-0.1.6-0.1.hum1 aarch64, x8664 openshell-gateway-0.1.6-0.1.hum1 aarch64, x8664 python3-openshell-0.1.6-0.1.hum1 aarch64, x8664 openshell-0.1.6-0.1.hum1.src src Security Fixes:...
russh: russh: Denial of Service via unbounded memory allocation in extension handling
A flaw was found in russh. An unbounded memory allocation issue allows a malicious Secure Shell SSH server to cause a Denial of Service DoS on connecting clients. By repeatedly sending crafted pre-authentication extension packets, the server forces the client to store an unlimited number of...
russh: russh: Denial of Service via resource exhaustion in SSH agent
A flaw was found in russh. When processing key addition requests containing lifetime constraints, the Secure Shell SSH agent server spawns a separate long-lived task for repeated constraint records and fails to roll back tasks if subsequent parsing fails. An attacker capable of communicating with...
russh: russh: Denial of service via zero maximum packet size
A flaw was found in russh. An authenticated remote client or a malicious server can cause a denial of service DoS by declaring a maximum packet size of zero during SSH channel negotiation. The affected system accepts this value, causing asynchronous write operations to hang indefinitely and...
russh: russh: Denial of Service via uncontrolled memory consumption in SSH agent
A flaw was found in russh. This vulnerability can lead to a Denial of Service DoS due to unbounded memory consumption in the SSH agent service. A local process or a remote user with access to a forwarded agent socket can repeatedly submit keys containing an excessive number of confirmation...
russh: russh: Unauthorized key signing via SSH agent confirmation bypass
A flaw was found in russh. When processing signing requests for SSH keys configured to require explicit confirmation, the SSH agent server component fails to invoke the confirmation check and automatically returns success. A local process or remote user with access to the forwarded SSH agent sock...
libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure,...
libxml2: double-free/UAF in libxml2 Python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the xmlSnprintfElements function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited...
Important: Red Hat Security Advisory: libxml2 security update
An update for libxml2 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...
libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the xmlDictAddQString function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its...
libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...
Important: Red Hat Security Advisory: python-jwt security update
An update for python-jwt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
Important: Red Hat Security Advisory: kernel security update
An update for the kernel is now available for NVIDIA on RHEL 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Important: Red Hat Security Advisory: libsoup security update
An update for libsoup is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...
libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used th...
libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap...
libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow...
libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth
A flaw was found in libsoup. When max-incoming-payload-size is unlimited 0, SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data...