It was discovered that Ghostscript incorrectly handled parsing certain PS
files. An attacker could use this issue to cause Ghostscript to crash,
resulting in a denial of service, or possibly execute arbitrary code.
python3.10-3.10.16-1.fc41
Python 3.10.16 security release.
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-103848: Added checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format.
python3.10-3.10.16-1.fc40
Python 3.10.16 security release.
gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-103848: Added checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format.
python3.10-3.10.16-1.fc42
Automatic update for python3.10-3.10.16-1.fc42.
* Wed Dec 4 2024 Charalampos Stratakis <cstratak@redhat.com> – 3.10.16-1
– Update to 3.10.16
– Security fix for CVE-2024-9287
Resolves: rhbz#2321654
* Wed Sep 11 2024 Miro Hrončok <mhroncok@redhat.com> – 3.10.15-2
– Fix ThreadedVSOCKSocketStreamTest
What is the attack?ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application’s configuration. Successful exploitation allows attackers to create accounts, upload web shells, and embed malicious JavaScript. ProjectSend is a free, open-source software that lets you share files with your clients with privacy. CVE-2024-11680 has been added to CISA Known Exploited Catalog (KEV) on December 4, 2024.What is the recommended Mitigation?ProjectSend has released a patch for CVE-2024-11680. Organizations that have not implemented the latest patch are advised to do so immediately.According to VulnCheck, it found that only 1% of users were using the patched version of ProjectSend (r1750).Public exploits for CVE-2024-11680 are available, and since the exploitation is confirmed, companies must assess exposure, implement fixes and take appropriate action.What FortiGuard Coverage is available?FortiGuard recommends users to apply the patch and follow any mitigation steps provided by the vendor if not done already.The FortiGuard Incident Response team can be engaged to help with any suspected compromise.FortiGuard IPS protection is being reviewed to block any attack attempts related to CVE-2024-11680.
chromium-131.0.6778.108-1.fc41
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.el9
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.el10_0
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.fc40
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
chromium-131.0.6778.108-1.el8
Update to 131.0.6778.108
High CVE-2024-12053: Type Confusion in V8
