Posted by malvuln on Apr 18
Discovery / credits: Malvuln – malvuln.com (c) 2022https://malvuln.com/advisory/9a8150938bff3a17fa0169c3dc6dae85.txt
Threat: Backdoor.Win32.Loselove
Posted by malvuln on Apr 18
Discovery / credits: Malvuln – malvuln.com (c) 2022https://malvuln.com/advisory/92f7f9495ffd56d05a5acf395c9e0097.txt
Threat: HackTool.Win32.Delf.vs
FEDORA-2022-2fec5f30be
Packages in this update:
git-2.34.3-1.fc34
Update description:
Update to 2.34.3 (release notes )
This release addresses CVE-2022-24765 . Per the release announcement:
On multi-user machines, Git users might find themselves unexpectedly in a Git worktree, e.g. when another user created a repository in C:.git, in a mounted network drive or in a scratch space. Merely having a Git-aware prompt that runs git status (or git diff) and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user.
A broad “escape hatch” is available in cases where all the repositories you may enter are considered safe, regardless of their ownership. Quoting another release announcement:
* can be used as the value for the safe.directory variable to signal that the user considers that any directory is safe.
Read Time: 2 Minute, 4 Second
FEDORA-2022-5cbd6de569
Packages in this update:
bettercap-2.28-9.fc34
Update description:
Rebuild for CVE-2022-27191
Read Time: 2 Minute, 13 Second
FEDORA-2022-3a63897745
Packages in this update:
bettercap-2.28-9.fc35
Update description:
Rebuild for CVE-2022-27191
Read Time: 2 Minute, 42 Second
FEDORA-2022-08ae2dd481
Packages in this update:
bettercap-2.28-9.fc36
Update description:
Rebuild for CVE-2022-27191
Fix FTBFS Close: rhbz#2045471
FEDORA-2022-3759ebabd2
Packages in this update:
git-2.35.3-1.fc35
Update description:
Update to 2.35.3 (release notes )
This release addresses CVE-2022-24765 . Per the release announcement:
On multi-user machines, Git users might find themselves unexpectedly in a Git worktree, e.g. when another user created a repository in C:.git, in a mounted network drive or in a scratch space. Merely having a Git-aware prompt that runs git status (or git diff) and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user.
A broad “escape hatch” is available in cases where all the repositories you may enter are considered safe, regardless of their ownership. Quoting another release announcement:
* can be used as the value for the safe.directory variable to signal that the user considers that any directory is safe.
Read Time: 2 Minute, 42 Second
FEDORA-2022-aa33c22e7a
Packages in this update:
bettercap-2.28-9.fc37
Update description:
Rebuild for CVE-2022-27191
FEDORA-2022-e99ae504f5
Packages in this update:
git-2.36.0-1.fc36
Update description:
Update to 2.36.0 (release notes )
Among the changes, this release includes changes to address CVE-2022-24765 . Per the release announcement:
On multi-user machines, Git users might find themselves unexpectedly in a Git worktree, e.g. when another user created a repository in C:.git, in a mounted network drive or in a scratch space. Merely having a Git-aware prompt that runs git status (or git diff) and navigating to a directory which is supposedly not a Git worktree, or opening such a directory in an editor or IDE such as VS Code or Atom, will potentially run commands defined by that other user.
A broad “escape hatch” is available in cases where all the repositories you may enter are considered safe, regardless of their ownership. Quoting another release announcement:
* can be used as the value for the safe.directory variable to signal that the user considers that any directory is safe.
An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. A specially crafted malformed file can trigger an arbitrary out-of-bounds memory access that could lead to the disclosure of sensitive information. This vulnerability could be used to bypass mitigations and aid additional exploitation. To trigger this vulnerability, the victim needs to access an attacker-provided file.
Posts navigation
News, Advisories and much more
