Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.

https://security-tracker.debian.org/tracker/DSA-5824-1

Read More

FEDORA-EPEL-2024-08d8c17c5d

Packages in this update:

python-virtualenv-20.21.1-14.el9

Update description:

Security fix for CVE-2024-53899
Fix for virtualenv –seeder pip –python=python3.12

Read More

USN-7117-1 fixed vulnerabilities in needrestart. The update introduced a
regression in needrestart. This update fixes the problem for LXC
containers.

We apologize for the inconvenience.

Original advisory details:

Qualys discovered that needrestart passed unsanitized data to a library
(libmodule-scandeps-perl) which expects safe input. A local attacker could
possibly use this issue to execute arbitrary code as root.
(CVE-2024-11003)

Qualys discovered that the library libmodule-scandeps-perl incorrectly
parsed perl code. This could allow a local attacker to execute arbitrary
shell commands. (CVE-2024-10224)

Qualys discovered that needrestart incorrectly used the PYTHONPATH
environment variable to spawn a new Python interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48990)

Qualys discovered that needrestart incorrectly checked the path to the
Python interpreter. A local attacker could possibly use this issue to win
a race condition and execute arbitrary code as root. (CVE-2024-48991)

Qualys discovered that needrestart incorrectly used the RUBYLIB
environment variable to spawn a new Ruby interpreter. A local attacker
could possibly use this issue to execute arbitrary code as root.
(CVE-2024-48992)

Read More

FEDORA-2024-be6ea1ce44

Packages in this update:

python3.13-3.13.1-1.fc40

Update description:

This is the first maintenance release of Python 3.13

Python 3.13 is the newest major release of the Python programming language, and it contains many new features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

Security content in this release

gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-125140: Remove the current directory from sys.path when using PyREPL.

Read More

FEDORA-2024-3c18fe0d93

Packages in this update:

python3.13-3.13.1-1.fc41
python3-docs-3.13.1-1.fc41

Update description:

This is the first maintenance release of Python 3.13

Python 3.13 is the newest major release of the Python programming language, and it contains many new features and optimizations compared to Python 3.12. 3.13.1 is the latest maintenance release, containing almost 400 bugfixes, build improvements and documentation changes since 3.13.0.

Security content in this release

gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-125140: Remove the current directory from sys.path when using PyREPL.

Read More

It was discovered that Apache Shiro used a static cipher within the
“Remember Me” feature inside authentication by default. An attacker could
possibly use this issue to achieve remote code execution or obtain
sensitive information.

Read More

It was discovered that Ghostscript incorrectly handled parsing certain PS
files. An attacker could use this issue to cause Ghostscript to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Read More

FEDORA-2024-cae0bcc133

Packages in this update:

python3.10-3.10.16-1.fc41

Update description:

Python 3.10.16 security release.

Security content in this release

gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-103848: Added checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format.

Read More

FEDORA-2024-1a493abc67

Packages in this update:

python3.10-3.10.16-1.fc40

Update description:

Python 3.10.16 security release.

Security content in this release

gh-122792: Changed IPv4-mapped ipaddress.IPv6Address to consistently use the mapped IPv4 address value for deciding properties. Properties which have their behavior fixed are is_multicast, is_reserved, is_link_local, is_global, and is_unspecified.
CVE-2024-9287: gh-124651: Properly quote template strings in venv activation scripts.
gh-103848: Added checks to ensure that [ bracketed ] hosts found by urllib.parse.urlsplit() are of IPv6 or IPvFuture format.

Read More

FEDORA-2024-39f0ccfbc3

Packages in this update:

python3.10-3.10.16-1.fc42

Update description:

Automatic update for python3.10-3.10.16-1.fc42.

Changelog

* Wed Dec 4 2024 Charalampos Stratakis <cstratak@redhat.com> – 3.10.16-1
– Update to 3.10.16
– Security fix for CVE-2024-9287
Resolves: rhbz#2321654
* Wed Sep 11 2024 Miro Hrončok <mhroncok@redhat.com> – 3.10.15-2
– Fix ThreadedVSOCKSocketStreamTest

Read More