Fedora Project Fedora 38

Denial of service when trimming EDE text on positive replies

Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0

named may terminate unexpectedly under high DNS-over-TLS query load

An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.

The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excessive length of an HTTP header in a client handshake. The length affects both how many times a parse is attempted (e.g., thousands of times) and the average amount of data for each parse attempt (e.g., millions of bytes).

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).

Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

Incorrect offset calculation leading to denial of service in FreeRDP

A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and send them to BGP peers running frr-bgpd, resulting in DoS.

Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service

FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data

0-byte UDP payload DoS in c-ares

FreeRDP Null Pointer Dereference leading denial of service

An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.

Keylime: registrar is subject to a dos against ssl connections

Gnutls: rejects certificate chain with distributed trust

latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.

Parsing large DNS messages may cause excessive CPU load

FreeRDP Global-Buffer-Overflow in ncrush_decompress

An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. A maliciously crafted webpage may be able to fingerprint the user.

A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .

An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero.

Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled

Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution

Apache Traffic Server: s3_auth plugin problem with hash calculation

Improper header name validation in guzzlehttp/psr7

FreeRDP rdp_write_logon_info_v1 NULL access

LibHTP unbounded folded header handling leads to denial service

Heap-based Buffer Overflow in vim/vim

Heap buffer overflow in WebAudio in Google Chrome prior to 124.0.6367.155 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av_hwframe_ctx_init function.

CBOR2 decoder has potential buffer overflow

Linux: netback processing of zero-length transmit fragment

A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog .

FreeRDP zgfx_decompress out of memory vulnerability

crafted traffic can cause denial of service