Fedora Project Fedora 39

Arbitrary Code Execution (ACE) Vulnerability

Mismatched Memory Management Routines in Wireshark

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

Perl: write past buffer end via illegal user-defined unicode property

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

Use After Free in vim/vim

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.

Ansible: template injection

Use After Free in vim/vim

Use After Free in vim/vim

Use After Free in vim/vim

FFmpeg v.n6.1-3-g466799d4f5 allows a buffer over-read at ff_gradfun_blur_line_movdqa_sse2, as demonstrated by a call to the set_encoder_id function in /fftools/ffmpeg_enc.c component.

Use-after-free in Linux kernel's fs/smb/client component

FFmpeg v.n6.1-3-g466799d4f5 allows memory consumption when using the colorcorrect filter, in the av_malloc function in libavutil/mem.c:105:9 component.

Xorg-x11-server: selinux context corruption

FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw_block_rectangle function of libavfilter/vf_codecview.c. This vulnerability allows attackers to cause undefined behavior or a Denial of Service (DoS) via crafted input.

serial: mxs-auart: add spinlock around changing cts state

Buffer Overflow vulnerability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via a floating point exception (FPE) error at libavfilter/vf_minterpolate.c:1078:60 in interpolate.

drm/amdgpu: validate the parameters of bo mapping operations more clearly

firewire: nosy: ensure user_length is taken into account when fetching packet contents

drm: nv04: Fix out of bounds access

speakup: Avoid crash on very long word

netfilter: nft_set_pipapo: walk over current view on netlink dump

init/main.c: Fix potential static_command_line memory overflow

Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c

Buffer Overflow vulenrability in Ffmpeg v.N113007-g8d24a28d06 allows a local attacker to execute arbitrary code via the libavcodec/jpegxl_parser.c in gen_alias_map.

netfilter: nf_tables: restore set elements when delete set fails

Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.

drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2

netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()

r8169: fix LED-related deadlock on module removal

Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium)

Potential authentication and CSRF tokens leak in JupyterLab

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations.

aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.

A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .