webkitgtk-2.46.0-1.fc39

Read Time:25 Second

FEDORA-2024-01501ccce2

Packages in this update:

webkitgtk-2.46.0-1.fc39

Update description:

Use Skia instead of cairo for 2D rendering and enable GPU rendering by default.
Enable offscreen canvas by default.
Add support for system tracing with Sysprof.
Implement printing using the Print portal.
Add new API to load settings from a config file.
Add a new setting to enable or disable the 2D canvas acceleration (enabled by default).
Undeprecate console messages API and make it available in 6.0 API.

Read More

chromium-129.0.6668.58-1.fc41

Read Time:22 Second

FEDORA-2024-b85d941d78

Packages in this update:

chromium-129.0.6668.58-1.fc41

Update description:

update to 129.0.6668.58

High CVE-2024-8904: Type Confusion in V8
Medium CVE-2024-8905: Inappropriate implementation in V8
Medium CVE-2024-8906: Incorrect security UI in Downloads
Medium CVE-2024-8907: Insufficient data validation in Omnibox
Low CVE-2024-8908: Inappropriate implementation in Autofill
Low CVE-2024-8909: Inappropriate implementation in UI

Read More

chromium-129.0.6668.58-1.el8

Read Time:22 Second

FEDORA-EPEL-2024-2cc55c9f93

Packages in this update:

chromium-129.0.6668.58-1.el8

Update description:

update to 129.0.6668.58

High CVE-2024-8904: Type Confusion in V8
Medium CVE-2024-8905: Inappropriate implementation in V8
Medium CVE-2024-8906: Incorrect security UI in Downloads
Medium CVE-2024-8907: Insufficient data validation in Omnibox
Low CVE-2024-8908: Inappropriate implementation in Autofill
Low CVE-2024-8909: Inappropriate implementation in UI

Read More

USN-7023-1: Git vulnerabilities

Read Time:58 Second

Maxime Escourbiac and Yassine Bengana discovered that Git incorrectly
handled some gettext machinery. An attacker could possibly use this issue
to allows the malicious placement of crafted messages. This issue was fixed
in Ubuntu 16.04 LTS. (CVE-2023-25815)

It was discovered that Git incorrectly handled certain submodules.
An attacker could possibly use this issue to execute arbitrary code.
This issue was fixed in Ubuntu 18.04 LTS. (CVE-2024-32002)

It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code. This
issue was fixed in Ubuntu 18.04 LTS. (CVE-2024-32004, CVE-2024-32465)

It was discovered that Git incorrectly handled local clones with hardlinked
files/directories. An attacker could possibly use this issue to place a
specialized repository on their target’s local system. This issue was fixed
in Ubuntu 18.04 LTS. (CVE-2024-32020)

It was discovered that Git incorrectly handled certain symlinks. An
attacker could possibly use this issue to impact availability and
integrity creating hardlinked arbitrary files into users repository’s
objects/directory. This issue was fixed in Ubuntu 18.04 LTS.
(CVE-2024-32021)

Read More

Stored XSS in “Edit Profile” – htmlyv2.9.9

Read Time:24 Second

Posted by Andrey Stoykov on Sep 18

# Exploit Title: Stored XSS in “Edit Profile” – htmlyv2.9.9
# Date: 9/2024
# Exploit Author: Andrey Stoykov
# Version: 2.9.9
# Tested on: Ubuntu 22.04
# Blog:
https://msecureltd.blogspot.com/2024/09/friday-fun-pentest-series-11-stored-xss.html

Stored XSS #1:

Steps to Reproduce:

1. Login as author
2. Browse to “Edit Profile”
3. In “Content” field add payload “><img src=x onerror=alert(1)>
4. Then…

Read More