Read Time:1 Second
Post Content
Category Archives: Advisories
FreeBSD-EN-24:06.wireguard
FreeBSD-EN-24:05.tty
DSA-5648-1 chromium – security update
Read Time:9 Second
Security issues were discovered in Chromium, which could result
in the execution of arbitrary code, denial of service or information
disclosure.
chromium-123.0.6312.86-1.fc39
Read Time:17 Second
FEDORA-2024-0bb0e8f2a0
Packages in this update:
chromium-123.0.6312.86-1.fc39
Update description:
update to 123.0.6312.86
Critical CVE-2024-2883: Use after free in ANGLE
High CVE-2024-2885: Use after free in Dawn
High CVE-2024-2886: Use after free in WebCodecs
High CVE-2024-2887: Type Confusion in WebAssembly
chromium-123.0.6312.86-1.fc38
Read Time:17 Second
FEDORA-2024-b4dab205d7
Packages in this update:
chromium-123.0.6312.86-1.fc38
Update description:
update to 123.0.6312.86
Critical CVE-2024-2883: Use after free in ANGLE
High CVE-2024-2885: Use after free in Dawn
High CVE-2024-2886: Use after free in WebCodecs
High CVE-2024-2887: Type Confusion in WebAssembly
USN-6686-5: Linux kernel (Intel IoTG) vulnerabilities
Read Time:1 Minute, 57 Second
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
It was discovered that a race condition existed in the Cypress touchscreen
driver in the Linux kernel during device removal, leading to a use-after-
free vulnerability. A physically proximate attacker could use this to cause
a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2023-4134)
黄思聪 discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel did not properly handle certain memory allocation failure
conditions, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-46343)
It was discovered that the io_uring subsystem in the Linux kernel contained
a race condition, leading to a null pointer dereference vulnerability. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2023-46862)
It was discovered that a race condition existed in the Bluetooth subsystem
of the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-51779)
It was discovered that a race condition existed in the Rose X.25 protocol
implementation in the Linux kernel, leading to a use-after- free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51782)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel
did not properly handle connect command payloads in certain situations,
leading to an out-of-bounds read vulnerability. A remote attacker could use
this to expose sensitive information (kernel memory). (CVE-2023-6121)
It was discovered that the VirtIO subsystem in the Linux kernel did not
properly initialize memory in some situations. A local attacker could use
this to possibly expose sensitive information (kernel memory).
(CVE-2024-0340)
Dan Carpenter discovered that the netfilter subsystem in the Linux kernel
did not store data in properly sized memory locations. A local user could
use this to cause a denial of service (system crash). (CVE-2024-0607)
USN-6715-1: unixODBC vulnerability
Read Time:7 Second
It was discovered that unixODBC incorrectly handled certain bytes.
An attacker could use this issue to execute arbitrary code or cause
a crash.
Application is Vulnerable to Session Fixation
Read Time:20 Second
Posted by YOGESH BHANDAGE on Mar 27
*Vulnerability Name – *Application is Vulnerable to Session Fixation
*Vulnerable URL: *www.fusionpbx.com
*Overview of the Vulnerability*
Session fixation is a security vulnerability that occurs when an attacker
sets or fixes a user’s session identifier, manipulating the authentication
process. Typically exploited in web applications, this vulnerability allows
the attacker to force a user’s session ID to a known value, granting…
APPLE-SA-03-25-2024-1 Safari 17.4.1
Read Time:24 Second
Posted by Apple Product Security via Fulldisclosure on Mar 27
APPLE-SA-03-25-2024-1 Safari 17.4.1
Safari 17.4.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214094.
Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.
WebRTC
Available for: macOS Monterey and macOS Ventura
Impact: Processing an image may lead to arbitrary code execution…