This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-21371.
It was discovered that the Hotspot component of OpenJDK 8 was not properly
performing bounds when handling certain UTF-8 strings, which could lead to
a buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2024-21131)
It was discovered that the Hotspot component of OpenJDK 8 could be made to
run into an infinite loop. If an automated system were tricked into
processing excessively large symbols, an attacker could possibly use this
issue to cause a denial of service. (CVE-2024-21138)
It was discovered that the Hotspot component of OpenJDK 8 did not properly
perform range check elimination. An attacker could possibly use this issue
to cause a denial of service, execute arbitrary code or bypass Java
sandbox restrictions. (CVE-2024-21140)
Yakov Shafranovich discovered that the Concurrency component of OpenJDK 8
incorrectly performed header validation in the Pack200 archive format. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2024-21144)
Sergey Bylokhov discovered that OpenJDK 8 did not properly manage memory
when handling 2D images. An attacker could possibly use this issue to
obtain sensitive information. (CVE-2024-21145)
It was discovered that the Hotspot component of OpenJDK 8 incorrectly
handled memory when performing range check elimination under certain
circumstances. An attacker could possibly use this issue to cause a
denial of service, execute arbitrary code or bypass Java sandbox
restrictions. (CVE-2024-21147)
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
mingw-qt6-qtbase-6.7.2-3.fc40
Apply fix for CVE-2024-39936
mingw-qt5-qtbase-5.15.14-4.fc40
Apply fix for CVE-2024-39936
Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
orc-0.4.39-1.fc40
Update to 0.4.39
389-ds-base-2.4.6-1.fc39
* Tue Jul 30 2024 Viktor Ashirov <vashirov@redhat.com> – 2.4.6-1
– Update to 2.4.6
– Resolves: CVE-2024-1062 (rhbz#2261884)
– Resolves: CVE-2024-2199 (rhbz#2283632)
– Resolves: CVE-2024-3657 (rhbz#2283631)
– Resolves: CVE-2024-5953 (rhbz#2292109)
It was discovered that the Python ssl module contained a memory race
condition when handling the APIs to obtain the CA certificates and
certificate store statistics. This could possibly result in applications
obtaining wrong results, leading to various SSL issues. (CVE-2024-0397)
It was discovered that the Python ipaddress module contained incorrect
information about which IP address ranges were considered “private” or
“globally reachable”. This could possibly result in applications applying
incorrect security policies. (CVE-2024-4032)
golang-github-dvsekhvalnov-jose2go-1.7.0-1.fc41
Automatic update for golang-github-dvsekhvalnov-jose2go-1.7.0-1.fc41.
* Tue Jul 30 2024 Mikel Olasagasti Uranga <mikel@olasagasti.info> – 1.7.0-1
– Update to 1.7.0 – Closes rhbz#1922010 rhbz#2255966 rhbz#2300742
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> – 1.3-18
– Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
