Category Archives: Advisories

Advisories

ZDI-24-1422: Nikon NEF Codec Thumbnail Provider NRW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Read Time:17 Second

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nikon NEF Codec. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2024-8025.

Read More

Advisories

A Vulnerability in Fortinet FortiManager Could Allow for Remote Code Execution

Read Time:30 Second

A vulnerability has been discovered in Fortinet FortiManager which could allow for remote code execution. FortiManager is a network and security management tool that provides centralized management of Fortinet devices from a single console. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the system. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More

Advisories

thunderbird-128.3.3-1.fc41

Read Time:27 Second

FEDORA-2024-a078d86829

Packages in this update:

thunderbird-128.3.3-1.fc41

Update description:

Update to 128.3.3

https://www.thunderbird.net/en-US/thunderbird/128.3.3esr/releasenotes/

Update to 128.3.2

https://www.thunderbird.net/en-US/thunderbird/128.3.2esr/releasenotes/

Update to 128.3.1

https://www.thunderbird.net/en-US/thunderbird/128.3.1esr/releasenotes/

Update to 128.3.0

https://www.mozilla.org/en-US/security/advisories/mfsa2024-49/
https://www.thunderbird.net/en-US/thunderbird/128.3.0esr/releasenotes/

Read More

Advisories

USN-7082-1: libheif vulnerability

Read Time:16 Second

Gerrard Tai discovered that libheif did not properly validate certain
images, leading to out-of-bounds read and write vulnerability. If a user
or automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service or to
obtain sensitive information.

Read More

Advisories

USN-7081-1: Go vulnerabilities

Read Time:47 Second

It was discovered that the Go net/http module did not properly handle
responses to requests with an “Expect: 100-continue” header under certain
circumstances. An attacker could possibly use this issue to cause a denial
of service. (CVE-2024-24791)

It was discovered that the Go parser module did not properly handle deeply
nested literal values. An attacker could possibly use this issue to cause
a panic resulting in a denial of service. (CVE-2024-34155)

It was discovered that the Go encoding/gob module did not properly handle
message decoding under certain circumstances. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34156)

It was discovered that the Go build module did not properly handle certain
build tag lines with deeply nested expressions. An attacker could possibly
use this issue to cause a panic resulting in a denial of service.
(CVE-2024-34158)

Read More