Category Archives: Advisories

Advisories

perl-Clipboard-0.29-1.fc41

Read Time:17 Second

FEDORA-2024-966c267928

Packages in this update:

perl-Clipboard-0.29-1.fc41

Update description:

Automatic update for perl-Clipboard-0.29-1.fc41.

Changelog

* Wed Apr 10 2024 Xavier Bachelot <xavier@bachelot.org> – 0.29-1
– Update to 0.29 (RHBZ#2273832)
– Fixes RHBZ#2257224 and RHBZ#2257225
– Convert License: to SPDX

Read More

Advisories

USN-6727-1: NSS vulnerabilities

Read Time:39 Second

It was discovered that NSS incorrectly handled padding when checking PKCS#1
certificates. A remote attacker could possibly use this issue to perform
Bleichenbacher-like attacks and recover private data. This issue only
affected Ubuntu 20.04 LTS. (CVE-2023-4421)

It was discovered that NSS had a timing side-channel when performing RSA
decryption. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-5388)

It was discovered that NSS had a timing side-channel when using certain
NIST curves. A remote attacker could possibly use this issue to recover
private data. (CVE-2023-6135)

The NSS package contained outdated CA certificates. This update refreshes
the NSS package to version 3.98 which includes the latest CA certificate
bundle and other security improvements.

Read More

Advisories

wordpress-6.5.2-1.fc40

Read Time:20 Second

FEDORA-2024-e6d3143991

Packages in this update:

wordpress-6.5.2-1.fc40

Update description:

Upstream annoucement: WordPress 6.5.2 Maintenance and Security Release

Security updates included in this release

A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

Upstream announcement: WordPress 6.5 “Regina”

Read More

Advisories

wordpress-6.5.2-1.fc39

Read Time:20 Second

FEDORA-2024-8ffb095abb

Packages in this update:

wordpress-6.5.2-1.fc39

Update description:

Upstream annoucement: WordPress 6.5.2 Maintenance and Security Release

Security updates included in this release

A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

Upstream announcement: WordPress 6.5 “Regina”

Read More

Advisories

wordpress-6.5.2-1.el9

Read Time:21 Second

FEDORA-EPEL-2024-7c7a65fa6c

Packages in this update:

wordpress-6.5.2-1.el9

Update description:

Upstream annoucement: WordPress 6.5.2 Maintenance and Security Release

Security updates included in this release

A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

Upstream announcement: WordPress 6.5 “Regina”

Read More

Advisories

wordpress-6.4.4-1.fc38

Read Time:17 Second

FEDORA-2024-0a2f144348

Packages in this update:

wordpress-6.4.4-1.fc38

Update description:

WordPress 6.4.4 Security Release

Security updates included in this release

A cross-site scripting (XSS) vulnerability affecting the Avatar block type; reported by John Blackbourn of the WordPress security team. Many thanks to Mat Rollings for assisting with the research.

Read More

Advisories

USN-6719-2: util-linux vulnerability

Read Time:21 Second

USN-6719-1 fixed a vulnerability in util-linux. Unfortunately, it was
discovered that the fix did not fully address the issue. This update
removes the setgid permission bit from the wall and write utilities.

Original advisory details:

Skyler Ferrante discovered that the util-linux wall command did not filter
escape sequences from command line arguments. A local attacker could
possibly use this issue to obtain sensitive information.

Read More

Advisories

php-8.2.18-1.fc38

Read Time:2 Minute, 2 Second

FEDORA-2024-39d50cc975

Packages in this update:

php-8.2.18-1.fc38

Update description:

PHP version 8.2.18 (11 Apr 2024)

Core:

Fixed bug GH-13612 (Corrupted memory in destructor with weak references). (nielsdos)
Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). (Remi)
Fixed bug GH-13670 (GC does not scale well with a lot of objects created in destructor). (Arnaud)

DOM:

Add some missing ZPP checks. (nielsdos)
Fix potential memory leak in XPath evaluation results. (nielsdos)
Fix phpdoc for DOMDocument load methods. (VincentLanglet)

FPM

Fix incorrect check in fpm_shm_free(). (nielsdos)

GD:

Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). (Michael Orlitzky)

Gettext:

Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. (David Carlier)

MySQLnd:

Fix GH-13452 (Fixed handshake response [mysqlnd]). (Saki Takamachi)
Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

Opcache:

Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null). (Arnaud, Dmitry)
Fixed GH-13712 (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded). (Bob)

PDO:

Fix various PDORow bugs. (Girgias)

Random:

Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown modes). (timwolla)
Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used). (timwolla)

Session:

Fixed bug GH-13680 (Segfault with session_decode and compilation error). (nielsdos)

Sockets:

Fixed bug GH-13604 (socket_getsockname returns random characters in the end of the socket name). (David Carlier)

SPL:

Fixed bug GH-13531 (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15). (nielsdos)
Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). (nielsdos)

Standard:

Fixed bug GH-11808 (Live filesystem modified by tests). (nielsdos)
Fixed GH-13402 (Added validation of n in $additional_headers of mail()). (SakiTakamachi)
Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows). (divinity76)
Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)

XML:

Fixed bug GH-13517 (Multiple test failures when building with –with-expat). (nielsdos)

Read More

Advisories

php-8.2.18-1.fc39

Read Time:2 Minute, 2 Second

FEDORA-2024-b46619f761

Packages in this update:

php-8.2.18-1.fc39

Update description:

PHP version 8.2.18 (11 Apr 2024)

Core:

Fixed bug GH-13612 (Corrupted memory in destructor with weak references). (nielsdos)
Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). (Remi)
Fixed bug GH-13670 (GC does not scale well with a lot of objects created in destructor). (Arnaud)

DOM:

Add some missing ZPP checks. (nielsdos)
Fix potential memory leak in XPath evaluation results. (nielsdos)
Fix phpdoc for DOMDocument load methods. (VincentLanglet)

FPM

Fix incorrect check in fpm_shm_free(). (nielsdos)

GD:

Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). (Michael Orlitzky)

Gettext:

Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. (David Carlier)

MySQLnd:

Fix GH-13452 (Fixed handshake response [mysqlnd]). (Saki Takamachi)
Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)

Opcache:

Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null). (Arnaud, Dmitry)
Fixed GH-13712 (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded). (Bob)

PDO:

Fix various PDORow bugs. (Girgias)

Random:

Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown modes). (timwolla)
Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used). (timwolla)

Session:

Fixed bug GH-13680 (Segfault with session_decode and compilation error). (nielsdos)

Sockets:

Fixed bug GH-13604 (socket_getsockname returns random characters in the end of the socket name). (David Carlier)

SPL:

Fixed bug GH-13531 (Unable to resize SplfixedArray after being unserialized in PHP 8.2.15). (nielsdos)
Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). (nielsdos)

Standard:

Fixed bug GH-11808 (Live filesystem modified by tests). (nielsdos)
Fixed GH-13402 (Added validation of n in $additional_headers of mail()). (SakiTakamachi)
Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows). (divinity76)
Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)

XML:

Fixed bug GH-13517 (Multiple test failures when building with –with-expat). (nielsdos)

Read More