FEDORA-2024-51e55a7065

Packages in this update:

micropython-1.22.2-1.fc38

Update description:

Update to 1.22.2
Security fixes for CVE-2023-7158 and CVE-2023-7152

Read More

What is the vulnerability?

Cyber threat actors are actively targeting Linear eMerge E3-Series to exploit a 5-year-old critical vulnerability. The vulnerability tracked as CVE-2019-7256 is a command injection flaw that could allow an attacker to cause remote code execution and full access to the system.

The Nice Linear eMerge E3-Series is a popular access control system used in various commercial and industrial environments worldwide which underscores the importance of the potential widespread impact of this vulnerability.

What is the recommended Mitigation?

Nice has released a security bulletin that advises users to apply the latest firmware to mitigate the risk and recommends defensive measures to minimize the risk of exploitation. https://linear-solutions.com/wp-content/uploads/Service-Bulletin-for-Telephone-Entry-Products-04-12-2023.pdf

What FortiGuard Coverage is available?

FortiGuard Labs has an existing IPS signature “Linear.eMerge.card_scan_decoder.php.Command.Injection” to block any attack attempts targeting the vulnerability and has an OT virtual patch available for auto-patching.
Fortinet customers remain protected by the vulnerability; however, it is recommended to apply firmware patches released by the vendor to mitigate any risks.

Read More

FEDORA-2024-9f2a705459

Packages in this update:

micropython-1.22.2-1.fc41

Update description:

Automatic update for micropython-1.22.2-1.fc41.

Changelog

* Fri Mar 22 2024 Charalampos Stratakis <cstratak@redhat.com> – 1.22.2-1
– Update to 1.22.2
– Security fixes for CVE-2023-7158 and CVE-2023-7152
– Fixes: rhbz#2256176, rhbz#2256178, rhbz#2259215
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> – 1.21.0-3
– Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> – 1.21.0-2
– Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

Read More

FEDORA-EPEL-2024-5e764f8789

Packages in this update:

opensmtpd-7.4.0p1-1.el9

Update description:

opensmtpd: 7.4.0p1 release

Read More

FEDORA-2024-28fde3feb7

Packages in this update:

opensmtpd-7.4.0p1-1.fc40

Update description:

opensmtpd: 7.4.0p1 release

Read More

FEDORA-2024-dd32f390b3

Packages in this update:

podman-4.9.4-1.fc39

Update description:

Security fix for CVE-2024-1753

Automatic update for podman-4.9.4-1.fc39.

Changelog for podman

* Mon Mar 25 2024 Packit <hello@packit.dev> – 5:4.9.4-1
– [packit] 4.9.4 upstream release

* Fri Mar 01 2024 Debarshi Ray <rishi@fedoraproject.org> – 5:4.9.3-5
– Show the toolbox RPMs used to run the tests

* Fri Mar 01 2024 Debarshi Ray <rishi@fedoraproject.org> – 5:4.9.3-4
– Avoid running out of storage space when running the Toolbx tests

* Fri Mar 01 2024 Debarshi Ray <rishi@fedoraproject.org> – 5:4.9.3-3
– Silence warnings about deprecated grep(1) use in test logs

* Fri Mar 01 2024 Debarshi Ray <rishi@fedoraproject.org> – 5:4.9.3-2
– Update how Toolbx is spelt

Read More

FEDORA-2024-8409b5fa8e

Packages in this update:

podman-4.9.4-1.fc38

Update description:

Security fix for CVE-2024-1753

Automatic update for podman-4.9.4-1.fc38.

Changelog for podman

* Mon Mar 25 2024 Packit <hello@packit.dev> – 5:4.9.4-1
– [packit] 4.9.4 upstream release

Read More

Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-0743, CVE-2024-2611,
CVE-2024-2614)

Hubert Kario discovered that Thunderbird had a timing side-channel when
performing RSA decryption. A remote attacker could possibly use this
issue to recover sensitive information. (CVE-2023-5388)

Gary Kwong discovered that Thunderbird incorrectly updated return
registers for JIT code on Armv7-A systems. An attacker could potentially
exploit this issue to execute arbitrary code. (CVE-2024-2607)

Ronald Crane discovered that Thunderbird did not properly manage memory
during character encoding. An attacker could potentially exploit this
issue to cause a denial of service. (CVE-2024-2608)

Georg Felber and Marco Squarcina discovered that Thunderbird incorrectly
handled html and body tags. An attacker who was able to inject markup into
a page otherwise protected by a Content Security Policy may have been able
obtain sensitive information. (CVE-2024-2610)

Ronald Crane discovered a use-after-free in Thunderbird when handling code
in SafeRefPtr. An attacker could potentially exploit this issue to cause a
denial of service, or execute arbitrary code. (CVE-2024-2612)

Ryan VanderMeulen and Dan Minor discovered that Thunderbird did not
properly manage memory conditions in ICU. An attacker could potentially
exploit this issue to cause a denial of service. (CVE-2024-2616)

Read More

USN-6588-1 fixed a vulnerability in PAM. This update
provides the corresponding updates for Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

Original advisory details:

Matthias Gerstner discovered that the PAM pam_namespace module incorrectly
handled special files when performing directory checks. A local attacker
could possibly use this issue to cause PAM to stop responding, resulting in
a denial of service.

Read More

A vulnerability has been discovered in multiple Apple products which could allow for Arbitrary Code Execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More