FEDORA-2024-4c6304b6fa

Packages in this update:

webkitgtk-2.46.1-1.fc40

Update description:

Fix login QR code not shown in WhatsApp web.
Disable PSON by default again in GTK 3 API versions.
Disable DMABuf video sink by default to prevent file descriptor leaks.
Fix several crashes and rendering issues.

Use Skia instead of cairo for 2D rendering and enable GPU rendering by default.
Enable offscreen canvas by default.
Add support for system tracing with Sysprof.
Implement printing using the Print portal.
Add new API to load settings from a config file.
Add a new setting to enable or disable the 2D canvas acceleration (enabled by default).
Undeprecate console messages API and make it available in 6.0 API.

Read More

Suyue Guo discovered that Vim incorrectly handled memory when flushing the
typeahead buffer, leading to heap-buffer-overflow. An attacker could
possibly use this issue to cause a denial of service.

Read More

USN-7041-1 fixed a vulnerability in CUPS. This update provides
the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

Simone Margaritelli discovered that CUPS incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.

Read More

USN-6964-1 fixed a vulnerability in ORC. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Noriko Totsuka discovered that ORC incorrectly handled certain
specially crafted files. An attacker could possibly use this issue
to execute arbitrary code.

Read More

USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)

It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)

It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)

It was discovered that the Python http.cookies module incorrectly handled
parsing cookies that contained backslashes for quoted characters. A remote
attacker could possibly use this issue to cause Python to consume
resources, leading to a denial of service. (CVE-2024-7592)

It was discovered that the Python zipfile module incorrectly handled
certain malformed zip files. A remote attacker could possibly use this
issue to cause Python to stop responding, resulting in a denial of
service. (CVE-2024-8088)

Read More

Vladimír Čunát discovered that Knot Resolver incorrectly handled input
during DNSSEC validation. A remote attacker could possibly use this issue
to bypass certain validations. (CVE-2019-10190)

Vladimír Čunát discovered that Knot Resolver incorrectly handled input
during DNSSEC validation. A remote attacker could possibly use this issue
to downgrade DNSSEC-secure domains to a DNSSEC-insecure state, resulting
in a domain hijacking attack. (CVE-2019-10191)

Vladimír Čunát discovered that Knot Resolver incorrectly handled certain
DNS replies with many resource records. An attacker could possibly use
this issue to consume system resources, resulting in a denial of service.
(CVE-2019-19331)

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Knot
Resolver incorrectly handled certain queries. A remote attacker could
use this issue to perform an amplification attack directed at a target.
(CVE-2020-12667)

Read More

Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 30

<<< application/pkcs7-signature; name=”smime.p7s”: Unrecognized >>>

Read More

It was discovered that Flatpak incorrectly handled certain persisted
directories. An attacker could possibly use this issue to read
and write files in locations it would not normally have access to.
A patch was also needed to Bubblewrap in order to avoid race
conditions caused by this fix.

Read More

FEDORA-2024-851219f5e3

Packages in this update:

crosswords-0.3.13.3-4.fc41

Update description:

Update to 0.3.13.3 and fix gresource generation

Read More

FEDORA-2024-78e43b4de6

Packages in this update:

perl-App-cpanminus-1.7047-2.fc39

Update description:

Patch the code to use https instead of http (CVE-2024-45321)

Read More