Category Archives: Advisories

Advisories

postgresql-jdbc-42.7.3-1.fc40

March 18, 2024

Read Time:7 Second

FEDORA-2024-ed884c3203

Packages in this update:

postgresql-jdbc-42.7.3-1.fc40

Update description:

This rebase fixes CVE-2024-1597.

Advisories

USN-6697-1: Bash vulnerability

March 18, 2024

Read Time:15 Second

It was discovered that Bash incorrectly handled certain memory operations
when processing commands. If a user or automated system were tricked into
running a specially crafted bash file, a remote attacker could use this
issue to cause Bash to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Advisories

USN-6696-1: OpenJDK 8 vulnerabilities

March 18, 2024

Read Time:1 Minute, 5 Second

Yi Yang discovered that the Hotspot component of OpenJDK 8 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)

It was discovered that the Hotspot component of OpenJDK 8 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)

It was discovered that the Hotspot component of OpenJDK 8 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)

Valentin Eudeline discovered that OpenJDK 8 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2024-20926)

It was discovered that OpenJDK 8 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)

Hubert Kario discovered that the TLS implementation in OpenJDK 8 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)

Advisories

webkitgtk-2.44.0-2.fc39

March 17, 2024

Read Time:24 Second

FEDORA-2024-ee43b83290

Packages in this update:

webkitgtk-2.44.0-2.fc39

Update description:

Upgrade to 2.44.0:

Make the DOM accessibility tree reachable from UI process with GTK4.
Removed the X11 and WPE renderers in favor of DMA-BUF.
Improved vblank synchronization when rendering.
Removed key event reinjection in GTK4 to make keyboard shortcuts work in web sites.
Fix gamepads detection by correctly handling focused window in GTK4.
CVE-2024-23263, CVE-2024-23280, CVE-2024-23284

Advisories