Multiple vulnerabilities have been discovered in the Xen hypervisor, which
could result in privilege escalation. In addition this updates provides
mitigations for the Retbleed speculative execution attack and the
MMIO stale data vulnerabilities.
python-notebook-6.4.11-3.fc36
Security fix for CVE-2022-24785 and CVE-2022-31129.
python-notebook-6.4.0-4.fc35
Security fix for CVE-2022-24785 and CVE-2022-31129.
python-ujson-5.4.0-1.el9
Security fix for CVE-2022-31116 and CVE-2022-31117.
Added
Add support for arbitrary size integers
Fixed
CVE-2022-31116: Replace wchar_t string decoding implementation with a uint32_t-based one; fix handling of surrogates on decoding
CVE-2022-31117: Potential double free of buffer during string decoding
Fix memory leak on encoding errors when the buffer was resized
Integer parsing: always detect overflows
Fix handling of surrogates on encoding
python-ujson-5.4.0-1.fc36
Security fix for CVE-2022-31116 and CVE-2022-31117.
Added
Add support for arbitrary size integers
Fixed
CVE-2022-31116: Replace wchar_t string decoding implementation with a uint32_t-based one; fix handling of surrogates on decoding
CVE-2022-31117: Potential double free of buffer during string decoding
Fix memory leak on encoding errors when the buffer was resized
Integer parsing: always detect overflows
Fix handling of surrogates on encoding
A denial of service vulnerability exists in some Xiaomi models of phones. The vulnerability is caused by heap overflow and can be exploited by attackers to make remote denial of service.
grafana-9.0.2-3.fc37
Automatic update for grafana-9.0.2-3.fc37.
* Thu Jul 14 2022 Andreas Gerstmayr <agerstmayr@redhat.com> 9.0.2-3
– fix quoting in grafana-cli wrapper script (rhbz#2107046)
It was discovered that HTTP-Daemon incorrectly handled certain crafted
requests. A remote attacker could possibly use this issue to perform an
HTTP Request Smuggling attack.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
python-notebook-6.4.11-3.fc37
Automatic update for python-notebook-6.4.11-3.fc37.
* Wed Jul 13 2022 Miro Hrončok <mhroncok@redhat.com> – 6.4.11-3
– Fix CVE-2022-24785 and CVE-2022-31129 in bundled moment
– Fixes: rhbz#2075263
