Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– GPU drivers;
– Network drivers;
– SCSI drivers;
– F2FS file system;
– BPF subsystem;
– IPv4 networking;
(CVE-2024-42160, CVE-2024-42159, CVE-2024-42224, CVE-2024-41009,
CVE-2024-42154, CVE-2024-42228)
USN-7034-1 updated ca-certificates. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
The ca-certificates package contained outdated CA certificates.
This update refreshes the included certificates to those contained
in the 2.64 version of the Mozilla certificate authority bundle.
It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– MIPS architecture;
– PowerPC architecture;
– x86 architecture;
– ACPI drivers;
– Serial ATA and Parallel ATA drivers;
– Drivers core;
– GPIO subsystem;
– GPU drivers;
– Greybus drivers;
– HID subsystem;
– I2C subsystem;
– IIO subsystem;
– InfiniBand drivers;
– Media drivers;
– VMware VMCI Driver;
– Network drivers;
– Pin controllers subsystem;
– S/390 drivers;
– SCSI drivers;
– USB subsystem;
– JFFS2 file system;
– JFS file system;
– File systems infrastructure;
– NILFS2 file system;
– IOMMU subsystem;
– Sun RPC protocol;
– Netfilter;
– Memory management;
– B.A.T.M.A.N. meshing protocol;
– CAN network layer;
– Ceph Core library;
– Networking core;
– IPv4 networking;
– IPv6 networking;
– IUCV driver;
– MAC80211 subsystem;
– NET/ROM layer;
– Network traffic control;
– SoC Audio for Freescale CPUs drivers;
(CVE-2024-41034, CVE-2024-40984, CVE-2024-40987, CVE-2024-42119,
CVE-2024-42224, CVE-2024-42101, CVE-2024-42096, CVE-2024-41095,
CVE-2024-42087, CVE-2024-42104, CVE-2024-42148, CVE-2024-39495,
CVE-2024-40980, CVE-2024-42223, CVE-2024-40961, CVE-2024-40988,
CVE-2024-42127, CVE-2024-42090, CVE-2024-42236, CVE-2024-40995,
CVE-2024-41007, CVE-2024-40968, CVE-2024-40901, CVE-2024-42097,
CVE-2024-41041, CVE-2024-36974, CVE-2024-42115, CVE-2024-40978,
CVE-2024-38619, CVE-2024-41049, CVE-2024-41035, CVE-2024-41044,
CVE-2024-42154, CVE-2024-39499, CVE-2024-42070, CVE-2024-40959,
CVE-2024-39487, CVE-2024-42157, CVE-2024-40916, CVE-2024-42076,
CVE-2024-41087, CVE-2024-42094, CVE-2024-42124, CVE-2024-40905,
CVE-2024-42145, CVE-2024-40963, CVE-2024-36894, CVE-2024-40942,
CVE-2024-42092, CVE-2024-42153, CVE-2024-41089, CVE-2024-40912,
CVE-2023-52887, CVE-2024-40934, CVE-2024-41006, CVE-2024-39501,
CVE-2024-42084, CVE-2024-39506, CVE-2024-39509, CVE-2024-40943,
CVE-2024-42106, CVE-2024-42093, CVE-2024-40902, CVE-2024-42086,
CVE-2024-40958, CVE-2024-39502, CVE-2024-42232, CVE-2024-42089,
CVE-2024-37078, CVE-2024-39469, CVE-2024-41046, CVE-2024-42102,
CVE-2024-40974, CVE-2024-39505, CVE-2024-40960, CVE-2024-42105,
CVE-2024-40932, CVE-2024-40904, CVE-2024-40981, CVE-2024-39503,
CVE-2024-41097, CVE-2024-40941, CVE-2024-36978, CVE-2023-52803,
CVE-2024-40945)
cjson-1.7.18-1.fc40
Update to new upstream version (closes rhbz#2237124)
Thomas Stangner discovered a permission vulnerability in the Apache
Portable Runtime (APR) library. A local attacker could possibly use this
issue to read named shared memory segments, potentially exposing sensitive
application data.
cjson-1.7.18-1.fc41
Update to new upstream version (closes rhbz#2237124)
cjson-1.7.18-1.fc42
Automatic update for cjson-1.7.18-1.fc42.
* Thu Sep 26 2024 Fabian Affolter <mail@fabian-affolter.ch> – 1.7.18-1
– Update to new upstream version (closes rhbz#2237124)
– Fix rhbz#2277268, closes rhbz#2277269
python-gcsfs-2024.9.0-1.fc41
Update to new upstream version (closes rhbz#2237124)
It was discovered that OpenJPEG could enter a large loop and continuously
print warning messages when given specially crafted input. An attacker
could potentially use this issue to cause a denial of service.
This vulnerability allows remote attackers to delete arbitrary files within sensitive directories on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.3. The following CVEs are assigned: CVE-2024-9257.
