Fedora Project Fedora 39

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function.

GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.

Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.

Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable denial of service via local access.

Mismatched Memory Management Routines in editcap

Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()

Shim: out-of-bound read in verify_buffer_sbat()

Sqlite: use-after-free bug in jsonparseaddnodearray

Use After Free in editcap

Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

c-ares out of bounds read in ares__read_line()

Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c

W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)

Xorg-x11-server: selinux unlabeled glx pbuffer

Kernel: null pointer dereference vulnerability in nft_dynset_init()

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout

Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y. This allows local attackers to gain access to system secrets otherwise only readable by root.

comedi: vmk80xx: fix incomplete endpoint checking

tun: limit printing rate when illegal packet received by tun dev

Kernel: stack overflow problem in open vswitch kernel module leading to dos

Potential segfault due to NULL pointer dereference in libvips

Out-of-bounds read in some Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentially enable information disclosure via local access.

Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.

dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX bytes, and crash, because of a missing check for struct dm_ioctl.target_count.

drm/amdkfd: Fix memory leak in create_process failure

netfilter: flowtable: incorrect pppoe tuple

AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

clk: Get runtime PM before walking tree during disable_unused

net/mlx5e: Prevent deadlock while disabling aRFS

mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled

Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

Moodle: stored xss in quiz grading report via user id number

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access