Claudio Bozzato discovered multiple security issues in gtkwave, a file
waveform viewer for VCD (Value Change Dump) files, which may result in the
execution of arbitrary code if malformed files are opened.
Security issues were discovered in Chromium, which could result
in the execution of arbitrary code, denial of service or information
disclosure.
libdwarf-0.9.2-1.fc40
Update to latest upstream release.
Kentaro Kawane discovered that Cacti incorrectly handled user provided
input sent through request parameters to the graph_view.php script.
A remote authenticated attacker could use this issue to perform
SQL injection attacks.
dotnet7.0-7.0.117-1.fc38
This is the March 2024 update for .NET 7.
Release Notes: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.17/7.0.17.md
dotnet7.0-7.0.117-1.fc39
This is the March 2024 update for .NET 7.
Release Notes: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.17/7.0.17.md
python-pillow-10.3.0-1.fc39
Update to 10.3.0.
cockpit-311.2-1.fc38
sosreport: Fix command injection with crafted report names [CVE-2024-2947]
What is the vulnerability/attack?
A malicious code was discovered embedded in the XZ Utils which is a data compression software included in major Linux distributions. This vulnerability tracked under CVE-2024-3094 is a result of a supply chain attack on the versions 5.6.0 and 5.6.1 of the related tools and libraries. A security researcher found the malicious code when he experienced an unexpected behavior which led to further investigation and discovery of the vulnerability.
What is the recommended Mitigation?
CISA has advised XZ Utils users to downgrade to an older version of the utility immediately (i.e., any version before 5.6.0) and update their installations and packages according to distribution maintainer directions. Major Linux distributions and package maintainers have published guidance on updating. Please see the link and refer to individual distribution and package advisories for the latest information and remediation guidance.
What FortiGuard Coverage is available?
The situation is still developing; the FortiGuard team will update the threat signal and provide more information on related protections as they are released. FortiGuard Incident Response team can be engaged to help with any suspected compromise.
A directory traversal vulnerability was discovered in py7zr, a library
and command-line utility to process 7zip archives.
