FEDORA-2024-6a879cfa63

Packages in this update:

chromium-122.0.6261.57-1.fc38

Update description:

Update to 122.0.6261.57

High CVE-2024-1669: Out of bounds memory access in Blink
High CVE-2024-1670: Use after free in Mojo
Medium CVE-2024-1671: Inappropriate implementation in Site Isolation
Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy
Medium CVE-2024-1673: Use after free in Accessibility
Medium CVE-2024-1674: Inappropriate implementation in Navigation
Medium CVE-2024-1675: Insufficient policy enforcement in Download
Low CVE-2024-1676: Inappropriate implementation in Navigation

Read More

FEDORA-2024-bc8ea2c2cb

Packages in this update:

firefox-123.0-1.fc39

Update description:

New upstream release (123.0)

Read More

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-1547,
CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1553, CVE-2024-1554,
CVE-2024-1555, CVE-2024-1557)

Alfred Peters discovered that Firefox did not properly manage memory when
storing and re-accessing data on a networking channel. An attacker could
potentially exploit this issue to cause a denial of service.
(CVE-2024-1546)

Johan Carlsson discovered that Firefox incorrectly handled Set-Cookie
response headers in multipart HTTP responses. An attacker could
potentially exploit this issue to inject arbitrary cookie values.
(CVE-2024-1551)

Gary Kwong discovered that Firefox incorrectly generated codes on 32-bit
ARM devices, which could lead to unexpected numeric conversions or
undefined behaviour. An attacker could possibly use this issue to cause a
denial of service. (CVE-2024-1552)

Ronald Crane discovered that Firefox did not properly manage memory when
accessing the built-in profiler. An attacker could potentially exploit
this issue to cause a denial of service. (CVE-2024-1556)

Read More

It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)

Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)

Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)

Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)

Read More

This update fixes multiple vulnerabilities in Imagemagick: Various memory
handling problems and cases of missing or incomplete input sanitising
may result in denial of service, memory disclosure or potentially the
execution of arbitrary code if malformed image files are processed.

https://security-tracker.debian.org/tracker/DSA-5628-1

Read More

FEDORA-2024-4adf990562

Packages in this update:

chromium-122.0.6261.57-1.fc39

Update description:

update to 122.0.6261.57

High CVE-2024-1669: Out of bounds memory access in Blink
High CVE-2024-1670: Use after free in Mojo
Medium CVE-2024-1671: Inappropriate implementation in Site Isolation
Medium CVE-2024-1672: Inappropriate implementation in Content Security Policy
Medium CVE-2024-1673: Use after free in Accessibility
Medium CVE-2024-1674: Inappropriate implementation in Navigation
Medium CVE-2024-1675: Insufficient policy enforcement in Download
Low CVE-2024-1676: Inappropriate implementation in Navigation

Read More

Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution.

Mozilla Firefox is a web browser used to access the Internet.
Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.
Mozilla Thunderbird is an email client.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More

FEDORA-2024-04b568cd49

Packages in this update:

dotnet7.0-7.0.116-1.fc38

Update description:

This is the February 2024 update for .NET 7.

Release Notes:
– Runtime: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.16/7.0.16.md
– SDK: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.16/7.0.116.md

Read More

FEDORA-2024-a66f05d20f

Packages in this update:

dotnet7.0-7.0.116-1.fc39

Update description:

This is the February 2024 update for .NET 7.

Release Notes:
– Runtime: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.16/7.0.16.md
– SDK: https://github.com/dotnet/core/blob/main/release-notes/7.0/7.0.16/7.0.116.md

Read More

FEDORA-2024-b2db508cc2

Packages in this update:

dotnet8.0-8.0.102-1.fc38

Update description:

This is the February 2024 update for .NET 8.

Release Notes:
– Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.2/8.0.2.md
– SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.2/8.0.102.md

Add -dbg subpackages and move all managed symbol files into those packages

Read More