Read Time:7 Second
FEDORA-2024-49df7093ac
Packages in this update:
python-aiohttp-3.10.5-3.fc41
Update description:
Security fix for CVE-2024-52304
Category Archives: Advisories
DSA-5816-1 libmodule-scandeps-perl – security update
Read Time:18 Second
The Qualys Threat Research Unit discovered that libmodule-scandeps-perl,
a Perl module to recursively scan Perl code for dependencies, allows an
attacker to execute arbitrary shell commands via specially crafted file
names.
Details can be found in the Qualys advisory at
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
DSA-5815-1 needrestart – security update
Read Time:39 Second
The Qualys Threat Research Unit discovered several local privilege
escalation vulnerabilities in needrestart, a utility to check which
daemons need to be restarted after library upgrades. A local attacker
can execute arbitrary code as root by tricking needrestart into running
the Python interpreter with an attacker-controlled PYTHONPATH
environment variable (CVE-2024-48990) or running the Ruby interpreter
with an attacker-controlled RUBYLIB environment variable
(CVE-2024-48992). Additionally a local attacker can trick needrestart
into running a fake Python interpreter (CVE-2024-48991) or cause
needrestart to call the Perl module Module::ScanDeps with
attacker-controlled files (CVE-2024-11003).
Details can be found in the Qualys advisory at
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt
libsndfile-1.2.2-5.fc41
Read Time:8 Second
FEDORA-2024-1318318e7a
Packages in this update:
libsndfile-1.2.2-5.fc41
Update description:
fix crash in in ogg vorbis (#2322326) (CVE-2024-50612)
Multiple Vulnerabilities in Palo Alto PAN-OS Could Allow for Authentication Bypass
Read Time:17 Second
Multiple vulnerabilities have been discovered in Palo Alto PAN-OS, the most severe of which could allow for authentication bypass. PAN-OS is the software that runs all Palo Alto Networks next-generation firewalls. Successful exploitation could allow for authentication bypass with administrator privileges. An attacker could then install programs; view, change, or delete data.
libsndfile-1.2.2-5.fc42
Read Time:15 Second
FEDORA-2024-bb1826234a
Packages in this update:
libsndfile-1.2.2-5.fc42
Update description:
Automatic update for libsndfile-1.2.2-5.fc42.
Changelog
* Mon Nov 18 2024 Michal Hlavinka <mhlavink@redhat.com> – 1.2.2-5
– fix crash in in ogg vorbis (rhbz#2322326) (CVE-2024-50612)
libsndfile-1.2.2-4.fc40
Read Time:8 Second
FEDORA-2024-3ae3a47901
Packages in this update:
libsndfile-1.2.2-4.fc40
Update description:
fix crash in in ogg vorbis (rhbz#2322326) (CVE-2024-50612)
USN-7114-1: GLib vulnerability
Read Time:8 Second
It was discovered that Glib incorrectly handled certain trailing
characters. An attacker could possibly use this issue to cause
a crash or other undefined behavior.
USN-7104-1: curl vulnerability
Read Time:11 Second
It was discovered that curl could overwrite the HSTS expiry of the parent
domain with the subdomain’s HSTS entry. This could lead to curl switching
back to insecure HTTP earlier than otherwise intended, resulting in
information exposure.
USN-7113-1: WebKitGTK vulnerabilities
Read Time:15 Second
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.