Debian Debian Linux

libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing side channel.

Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.

Buffer Overflow occurs in xrdp

Buffer Overflow in xrdp

Buffer Overflow in xrdp

Out of Bound Write in xrdp

In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops the comparison when the first difference is spotted in the two signatures. (The fix uses gnutls_memcmp, which has constant-time execution.)

Buffer Overflow in xrdp

Integer Overflow in xrdp

crypto: xilinx - call finalize with bh disabled

9p/net: fix improper handling of bogus negative read/write replies

udp: do not accept non-tunnel GSO skbs landing in a tunnel

smb: client: fix use-after-free in crypt_message when using async crypto

nvme: avoid double free special payload

Heap Buffer overflow in Abseil

Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)

nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request

FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)

bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT

pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected.

scsi: lpfc: Fix buffer free/clear order in deferred receive path

scsi: target: iscsi: Fix timeout on deleted connection

ipv6: sr: Fix MAC comparison to be constant-time

ksmbd: fix Preauh_HashValue race condition

smb: client: fix use-after-free in cifs_oplock_break

tls: always refresh the queue when reading sock

netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

drbd: add missing kref_get in handle_write_conflicts

net, hsr: reject HSR frame if skb can't hold tag

PgBouncer default auth_query does not take Postgres password expiry into account

rpl: Fix use-after-free in rpl_do_srh_inline().

tls: separate no-async decryption request handling from async

libceph: fix invalid accesses to ceph_connection_v1_info

ppp: fix race conditions in ppp_fill_forward_path

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.