Read Time:7 Second
FEDORA-EPEL-2024-5ef433f7ed
Packages in this update:
chromium-122.0.6261.69-1.el7
Update description:
Update to 122.0.6261.69
Category Archives: Advisories
ZDI-24-208: Microsoft Azure MCR VSTS CLI vstscli Uncontrolled Search Path Element Remote Code Execution Vulnerability
Read Time:11 Second
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MCR VSTS CLI for Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
ZDI-24-207: Apple macOS VideoToolbox Out-Of-Bounds Write Remote Code Execution Vulnerability
Read Time:18 Second
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must receive a malicious image file that is written to the local filesystem. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-42902.
ZDI-24-206: Apple macOS ImageIO MPO Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
Read Time:16 Second
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the ImageIO library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The ZDI has assigned a CVSS rating of 3.3. The following CVEs are assigned: CVE-2023-42888.
USN-6654-1: Roundcube Webmail vulnerability
Read Time:10 Second
It was discovered that Roundcube Webmail incorrectly sanitized characters
in the linkrefs text messages. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. (CVE-2023-43770)
GLSA 202402-31: GNU Aspell: Heap Buffer Overflow
GLSA 202402-30: Glances: Arbitrary Code Execution
GLSA 202402-32: btrbk: Remote Code Execution
GLSA 202402-33: PyYAML: Arbitrary Code Execution
DSA-5632-1 composer – security update
Read Time:17 Second
It was discovered that composer, a dependency manager for the PHP
language, processed files in the local working directory. This could
lead to local privilege escalation or malicious code execution. Due to
a technical issue this email was not sent on 2024-02-26 like it should
have.