FEDORA-2024-9cc0e0c63e
Packages in this update:
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc39
Update description:
Update golang-gvisor to 20240408.0
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc39
Update golang-gvisor to 20240408.0
golang-gvisor-20240408.0-1.20240418git9e5a99b.fc40
Update golang-gvisor to 20240408.0
python-reportlab-4.2.0-1.fc39
Release 4.2.0
python-reportlab-4.2.0-1.fc40
Release 4.2.0
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– JFS file system;
– BPF subsystem;
– Netfilter;
(CVE-2023-52600, CVE-2024-26589, CVE-2024-26591, CVE-2024-26581,
CVE-2023-52603)
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– JFS file system;
– Netfilter;
(CVE-2024-26581, CVE-2023-52600, CVE-2023-52603)
Posted by malvuln on Apr 19
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/6cc630843cabf23621375830df474bc5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Threat: Backdoor.Win32.Dumador.c
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware runs an FTP server on TCP port 10000. Third-party
adversaries who can reach the server can send a specially crafted payload
triggering…
Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 19
SEC Consult Vulnerability Lab Security Advisory < 20240418-0 >
=======================================================================
title: Broken authorization
product: Dreamehome app
vulnerable version: <=2.1.5 (iOS)
fixed version: none, see solution
CVE number: –
impact: medium
homepage: https://www.dreametech.com
found: 2024-01-17…
Posted by Pawel Karwowski via Fulldisclosure on Apr 19
Resending! Thank you for your efforts.
GitHub – pawlokk/mindmanager-poc: public disclosure<https://github.com/pawlokk/mindmanager-poc>
Affected application: MindManager23_setup.exe
Platform: Windows
Issue: Local Privilege Escalation via MSI installer Repair Mode (EXE hijacking race condition)
Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz (Eviden Red Team)
Proposed mitigation:…
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– JFS file system;
– BPF subsystem;
– Netfilter;
(CVE-2023-52603, CVE-2023-52600, CVE-2024-26581, CVE-2024-26589)