Category Archives: Advisories

Advisories

USN-6966-2: Firefox regressions

Read Time:1 Minute, 9 Second

USN-6966-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-7518,
CVE-2024-7521, CVE-2024-7524, CVE-2024-7526, CVE-2024-7527, CVE-2024-7528,
CVE-2024-7529, CVE-2024-7530, CVE-2024-7531)

It was discovered that Firefox did not properly manage certain memory
operations when processing graphics shared memory. An attacker could
potentially exploit this issue to escape the sandbox. (CVE-2024-7519)

Nan Wang discovered that Firefox did not properly handle type check in
WebAssembly. An attacker could potentially exploit this issue to execute
arbitrary code. (CVE-2024-7520)

Irvan Kurniawan discovered that Firefox did not properly check an
attribute value in the editor component, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-7522)

Rob Wu discovered that Firefox did not properly check permissions when
creating a StreamFilter. An attacker could possibly use this issue to
modify response body of requests on any site using a web extension.
(CVE-2024-7525)

Read More

Advisories

USN-6944-2: curl vulnerability

Read Time:24 Second

USN-6944-1 fixed CVE-2024-7264 for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. This update provides the corresponding fix for
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

Original advisory details:

Dov Murik discovered that curl incorrectly handled parsing ASN.1
Generalized Time fields. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
sensitive memory contents.

Read More

Advisories

USN-6970-1: exfatprogs vulnerability

Read Time:14 Second

It was discovered that exfatprogs incorrectly handled certain memory
operations. If a user or automated system were tricked into handling
specially crafted exfat partitions, a remote attacker could use this issue
to cause exfatprogs to crash, resulting in a denial of service, or possibly
execute arbitrary code.

Read More

Advisories

USN-6969-1: Cacti vulnerabilities

Read Time:2 Minute, 0 Second

It was discovered that Cacti did not properly apply checks to the “Package
Import” feature. An attacker could possibly use this issue to perform
arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu
22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-25641)

It was discovered that Cacti did not properly sanitize values when using
javascript based API. A remote attacker could possibly use this issue to
inject arbitrary javascript code resulting into cross-site scripting
vulnerability. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-29894)

It was discovered that Cacti did not properly sanitize values when managing
data queries. A remote attacker could possibly use this issue to inject
arbitrary javascript code resulting into cross-site scripting
vulnerability. (CVE-2024-31443)

It was discovered that Cacti did not properly sanitize values when reading
tree rules with Automation API. A remote attacker could possibly use this
issue to inject arbitrary javascript code resulting into cross-site
scripting vulnerability. (CVE-2024-31444)

It was discovered that Cacti did not properly sanitize
“get_request_var(‘filter’)” values in the “api_automation.php” file. A
remote attacker could possibly use this issue to perform SQL injection
attacks. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-31445)

It was discovered that Cacti did not properly sanitize data stored in
“form_save()” function in the “graph_template_inputs.php” file. A remote
attacker could possibly use this issue to perform SQL injection attacks.
(CVE-2024-31458)

It was discovered that Cacti did not properly validate the file urls from
the lib/plugin.php file. An attacker could possibly use this issue to
perform arbitrary code execution. (CVE-2024-31459)

It was discovered that Cacti did not properly validate the data stored in
the “automation_tree_rules.php”. A remote attacker could possibly use this
issue to perform SQL injection attacks. This issue only affected Ubuntu
24.04 LTS, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS and Ubuntu 18.04 LTS.
(CVE-2024-31460)

It was discovered that Cacti did not properly verify the user password.
An attacker could possibly use this issue to bypass authentication
mechanism. This issue only affected Ubuntu 24.04 LTS, Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-34360)

Read More