w3m-0.5.3-63.git20230121.fc38
Added upstream patch to fix out-of-bounds access due to multiple backspaces to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)
w3m-0.5.3-63.git20230121.fc40
Added upstream patch to fix out-of-bounds access due to multiple backspaces to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)
w3m-0.5.3-63.git20230121.fc39
Added upstream patch to fix out-of-bounds access due to multiple backspaces to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)
Reima Ishii discovered that the nested KVM implementation for Intel x86
processors in the Linux kernel did not properly validate control registers
in certain situations. An attacker in a guest VM could use this to cause a
denial of service (guest crash). (CVE-2023-30456)
It was discovered that the Quick Fair Queueing scheduler implementation in
the Linux kernel did not properly handle network packets in certain
conditions, leading to a use after free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-4921)
It was discovered that a race condition existed in the SCSI Emulex
LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF
and re-scanning an HBA FCF table, leading to a null pointer dereference
vulnerability. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-24855)
libreoffice-24.2.1.2-5.fc40
Patch for kf6/Qt6 scaling
Updated conditionals for kf* subpackages
24.2.1.2, include kf6.
Zhen Zhou discovered that Vim did not properly manage memory. An
attacker could possibly use this issue to cause a denial of service
postgresql-jdbc-42.7.3-1.fc40
This rebase fixes CVE-2024-1597.
It was discovered that Bash incorrectly handled certain memory operations
when processing commands. If a user or automated system were tricked into
running a specially crafted bash file, a remote attacker could use this
issue to cause Bash to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 8 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 8 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2024-20926)
It was discovered that OpenJDK 8 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
webkitgtk-2.44.0-2.fc39
Upgrade to 2.44.0:
Make the DOM accessibility tree reachable from UI process with GTK4.
Removed the X11 and WPE renderers in favor of DMA-BUF.
Improved vblank synchronization when rendering.
Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
Fix gamepads detection by correctly handling focused window in GTK4.
CVE-2024-23263, CVE-2024-23280, CVE-2024-23284
