Fedora Project Fedora 40

serial: mxs-auart: add spinlock around changing cts state

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.

drm/amdgpu: validate the parameters of bo mapping operations more clearly

drm: nv04: Fix out of bounds access

firewire: nosy: ensure user_length is taken into account when fetching packet contents

speakup: Avoid crash on very long word

netfilter: nft_set_pipapo: walk over current view on netlink dump

init/main.c: Fix potential static_command_line memory overflow

Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map.

netfilter: nf_tables: restore set elements when delete set fails

drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2

btrfs: make sure that WRITTEN is set on all metadata blocks

netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

r8169: fix LED-related deadlock on module removal

Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)

Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Apache Tomcat: HTTP/2 header handling DoS

x86: Incorrect logic for BTC/SRSO mitigations

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Denial of service when trimming EDE text on positive replies

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

TCPDF version <=6.6.5 is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted HTML page with a crafted color.

A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected.

An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A maliciously crafted webpage may be able to fingerprint the user.

FreeRDP rdp_write_logon_info_v1 NULL access

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.

CBOR2 decoder has potential buffer overflow

FreeRDP zgfx_decompress out of memory vulnerability

libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.

An excessive memory use issue (CWE-770) exists in Email-MIME, before version 1.954, which can cause denial of service when parsing multipart MIME messages. The patch set (from 2020 and 2024) limits excessive depth and the total number of parts.

Libdwarf: crashes randomly on fuzzed object

Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet