Category Archives: Advisories

Advisories

xen-4.17.4-1.fc39

Read Time:20 Second

FEDORA-2024-4357ec611d

Packages in this update:

xen-4.17.4-1.fc39

Update description:

x86: Native Branch History Injection [XSA-456, CVE-2024-2201]
update to xen 4.17.4, remove patches now included upstream
rebase xen.gcc12.fixes.patch
x86 HVM hypercalls may trigger Xen bug check [XSA-454, CVE-2023-46842]
x86: Incorrect logic for BTC/SRSO mitigations [XSA-455, CVE-2024-31142]

Read More

Advisories

WordPress 6.5.2 Maintenance and Security Release

Read Time:1 Minute, 46 Second

Note: Due to an issue with the initial package, WordPress 6.5.1 was not released. 6.5.2 is the first minor release for WordPress 6.5.

This security and maintenance release features 2 bug fixes on Core, 12 bug fixes for the Block Editor, and 1 security fix.

Because this is a security release, it is recommended that you update your sites immediately. Backports are also available for other major WordPress releases, 6.1 and later.

You can download WordPress 6.5.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 6.5.2 is a short-cycle release. The next major release will be version 6.6 and is currently planned for 16 July 2024.

Security updates included in this release

The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

Thank you to these WordPress contributors

This release was led by John Blackbourn, Isabel Brison, and Aaron Jorbin.

WordPress 6.5.2 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Aki Hamano, Andrei Draganescu, Artemio Morales, Caleb Burks, colind, Daniel Richards, Dominik Schilling, Fabian Kägy, George Mamadashvili, Greg Ziółkowski, Isabel Brison, Jb Audras, Joe McGill, John Blackbourn, Jonathan Desrosiers, Lovekesh Kumar, Matias Benedetto, Mukesh Panchal, Pascal Birchler, Peter Wilson, Sean Fisher, Sergey Biryukov, Scott Reilly

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core channel. Need help? Check out the Core Contributor Handbook.

Thanks to John Blackbourn, Ehtisham S., Jb Audras, and Angela Jin for proofreading.

Read More

Advisories

xen-4.18.2-1.fc40

Read Time:18 Second

FEDORA-2024-a46df5ba2f

Packages in this update:

xen-4.18.2-1.fc40

Update description:

x86: Native Branch History Injection [XSA-456, CVE-2024-2201]
update to xen 4.18.2, remove patches now included upstream
x86 HVM hypercalls may trigger Xen bug check [XSA-454, CVE-2023-46842]
x86: Incorrect logic for BTC/SRSO mitigations [XSA-455, CVE-2024-31142]

Read More

Advisories

USN-6721-2: X.Org X Server regression

Read Time:28 Second

USN-6721-1 fixed vulnerabilities in X.Org X Server. That fix was incomplete
resulting in a regression. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that X.Org X Server incorrectly handled certain data.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2024-31080, CVE-2024-31081, CVE-2024-31082)

It was discovered that X.Org X Server incorrectly handled certain glyphs.
An attacker could possibly use this issue to cause a crash or expose sensitive
information. (CVE-2024-31083)

Read More

Advisories

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Read Time:1 Minute, 4 Second

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

Adobe After Effects is a digital visual effects, motion graphics, and compositing application.
Adobe Photoshop is a raster graphics editor.
Adobe Commerce is a flexible and scalable commerce platform that lets you create personalized B2B and B2C experiences.
Adobe InDesign is a desktop publishing and page layout designing software application.
Adobe Experience Manager is an all-in-one software suite used for content and asset management.
Adobe Media Encoder is an audio/video media processing program that allows users to convert files into other types of files.
Adobe Bridge is used to preview, organize, edit, and publish assets.
Adobe Illustrator is a vector graphics editor and design software.
Adobe Animate is used to create vector graphics and interactive content.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights

Read More

Advisories

Critical Patches Issued for Microsoft Products, April 09, 2024

Read Time:24 Second

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More