FusionOS-SA-2023-2001 Moderate FusionOS CVE-2022-44267:ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. CVE-2022-44268:ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). FusionOS ImageMagick-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2002 Important FusionOS CVE-2022-4743:A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. FusionOS SDL2-2.0.12-5.u1.fos23.x86_64.rpm SDL2-devel-2.0.12-5.u1.fos23.x86_64.rpm SDL2-static-2.0.12-5.u1.fos23.x86_64.rpm SDL2-2.0.12-5.u1.fos23.aarch64.rpm SDL2-devel-2.0.12-5.u1.fos23.aarch64.rpm SDL2-static-2.0.12-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2003 Moderate FusionOS CVE-2022-37704:Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure. CVE-2022-37705:A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported), FusionOS amanda-3.5.1-23.u2.fos23.x86_64.rpm amanda-help-3.5.1-23.u2.fos23.noarch.rpm amanda-3.5.1-23.u2.fos23.aarch64.rpm FusionOS-SA-2023-2004 Important FusionOS CVE-2023-24998:Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. FusionOS apache-commons-fileupload-1.4-2.u1.fos23.noarch.rpm apache-commons-fileupload-help-1.4-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2005 Critical FusionOS CVE-2022-24963:Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0. FusionOS apr-1.7.0-6.u1.fos23.x86_64.rpm apr-devel-1.7.0-6.u1.fos23.x86_64.rpm apr-help-1.7.0-6.u1.fos23.noarch.rpm apr-1.7.0-6.u1.fos23.aarch64.rpm apr-devel-1.7.0-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2006 Critical FusionOS CVE-2022-25147:Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. FusionOS apr-util-1.6.1-14.u1.fos23.x86_64.rpm apr-util-devel-1.6.1-14.u1.fos23.x86_64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.x86_64.rpm apr-util-odbc-1.6.1-14.u1.fos23.x86_64.rpm apr-util-1.6.1-14.u1.fos23.aarch64.rpm apr-util-devel-1.6.1-14.u1.fos23.aarch64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.aarch64.rpm apr-util-odbc-1.6.1-14.u1.fos23.aarch64.rpm FusionOS-SA-2023-2007 Important FusionOS CVE-2022-41704:A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16. CVE-2022-42890:A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16. FusionOS batik-1.10-8.u1.fos23.noarch.rpm batik-help-1.10-8.u1.fos23.noarch.rpm FusionOS-SA-2023-2008 Critical FusionOS CVE-2021-33641:When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free). CVE-2021-33642:When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. FusionOS byacc-2.0.20210808-4.u1.fos23.x86_64.rpm byacc-help-2.0.20210808-4.u1.fos23.noarch.rpm byacc-2.0.20210808-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2009 Moderate FusionOS CVE-2022-4904:A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. FusionOS c-ares-1.18.1-5.u2.fos23.x86_64.rpm c-ares-devel-1.18.1-5.u2.fos23.x86_64.rpm c-ares-help-1.18.1-5.u2.fos23.noarch.rpm c-ares-1.18.1-5.u2.fos23.aarch64.rpm c-ares-devel-1.18.1-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2010 Important FusionOS CVE-2022-3650:A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. FusionOS ceph-16.2.7-14.u6.fos23.x86_64.rpm ceph-base-16.2.7-14.u6.fos23.x86_64.rpm cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-mds-16.2.7-14.u6.fos23.x86_64.rpm ceph-mon-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-dashboard-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-diskprediction-local-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-modules-core-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-rook-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-k8sevents-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-fuse-16.2.7-14.u6.fos23.x86_64.rpm cephfs-mirror-16.2.7-14.u6.fos23.x86_64.rpm rbd-fuse-16.2.7-14.u6.fos23.x86_64.rpm rbd-mirror-16.2.7-14.u6.fos23.x86_64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.x86_64.rpm rbd-nbd-16.2.7-14.u6.fos23.x86_64.rpm ceph-radosgw-16.2.7-14.u6.fos23.x86_64.rpm cephfs-top-16.2.7-14.u6.fos23.noarch.rpm ceph-osd-16.2.7-14.u6.fos23.x86_64.rpm librados2-16.2.7-14.u6.fos23.x86_64.rpm librados-devel-16.2.7-14.u6.fos23.x86_64.rpm libradospp-devel-16.2.7-14.u6.fos23.x86_64.rpm librgw2-16.2.7-14.u6.fos23.x86_64.rpm librgw-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rgw-16.2.7-14.u6.fos23.x86_64.rpm python3-rados-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.x86_64.rpm librbd1-16.2.7-14.u6.fos23.x86_64.rpm librbd-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rbd-16.2.7-14.u6.fos23.x86_64.rpm libcephfs2-16.2.7-14.u6.fos23.x86_64.rpm libcephfs-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-cephfs-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-test-16.2.7-14.u6.fos23.x86_64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.x86_64.rpm ceph-grafana-dashboards-16.2.7-14.u6.fos23.noarch.rpm ceph-prometheus-alerts-16.2.7-14.u6.fos23.noarch.rpm ceph-16.2.7-14.u6.fos23.aarch64.rpm ceph-base-16.2.7-14.u6.fos23.aarch64.rpm ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-mds-16.2.7-14.u6.fos23.aarch64.rpm ceph-mon-16.2.7-14.u6.fos23.aarch64.rpm ceph-mgr-16.2.7-14.u6.fos23.aarch64.rpm ceph-fuse-16.2.7-14.u6.fos23.aarch64.rpm cephfs-mirror-16.2.7-14.u6.fos23.aarch64.rpm rbd-fuse-16.2.7-14.u6.fos23.aarch64.rpm rbd-mirror-16.2.7-14.u6.fos23.aarch64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.aarch64.rpm rbd-nbd-16.2.7-14.u6.fos23.aarch64.rpm ceph-radosgw-16.2.7-14.u6.fos23.aarch64.rpm ceph-osd-16.2.7-14.u6.fos23.aarch64.rpm librados2-16.2.7-14.u6.fos23.aarch64.rpm librados-devel-16.2.7-14.u6.fos23.aarch64.rpm libradospp-devel-16.2.7-14.u6.fos23.aarch64.rpm librgw2-16.2.7-14.u6.fos23.aarch64.rpm librgw-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rgw-16.2.7-14.u6.fos23.aarch64.rpm python3-rados-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.aarch64.rpm librbd1-16.2.7-14.u6.fos23.aarch64.rpm librbd-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rbd-16.2.7-14.u6.fos23.aarch64.rpm libcephfs2-16.2.7-14.u6.fos23.aarch64.rpm libcephfs-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-cephfs-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-test-16.2.7-14.u6.fos23.aarch64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.aarch64.rpm FusionOS-SA-2023-2011 Critical FusionOS CVE-2023-20032:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. CVE-2023-20052:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. FusionOS clamav-0.103.8-1.fos23.x86_64.rpm clamav-devel-0.103.8-1.fos23.x86_64.rpm clamav-help-0.103.8-1.fos23.x86_64.rpm clamav-filesystem-0.103.8-1.fos23.noarch.rpm clamav-data-0.103.8-1.fos23.noarch.rpm clamav-update-0.103.8-1.fos23.x86_64.rpm clamd-0.103.8-1.fos23.x86_64.rpm clamav-milter-0.103.8-1.fos23.x86_64.rpm clamav-0.103.8-1.fos23.aarch64.rpm clamav-devel-0.103.8-1.fos23.aarch64.rpm clamav-help-0.103.8-1.fos23.aarch64.rpm clamav-update-0.103.8-1.fos23.aarch64.rpm clamd-0.103.8-1.fos23.aarch64.rpm clamav-milter-0.103.8-1.fos23.aarch64.rpm FusionOS-SA-2023-2012 Important FusionOS CVE-2022-23471:containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. CVE-2023-25153:containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. CVE-2023-25173:containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups. FusionOS containerd-1.6.9-1.u3.fos23.x86_64.rpm containerd-stress-1.6.9-1.u3.fos23.x86_64.rpm containerd-1.6.9-1.u3.fos23.aarch64.rpm containerd-stress-1.6.9-1.u3.fos23.aarch64.rpm FusionOS-SA-2023-2013 Moderate FusionOS CVE-2021-4122:It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium. FusionOS cryptsetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.x86_64.rpm veritysetup-2.4.1-4.u2.fos23.x86_64.rpm integritysetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-help-2.4.1-4.u2.fos23.noarch.rpm cryptsetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.aarch64.rpm veritysetup-2.4.1-4.u2.fos23.aarch64.rpm integritysetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2014 Important FusionOS CVE-2022-43551:A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. CVE-2022-43552:A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. CVE-2023-23914:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on. CVE-2023-23915:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS. CVE-2023-23916:An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. FusionOS curl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-devel-7.79.1-14.u4.fos23.x86_64.rpm curl-help-7.79.1-14.u4.fos23.noarch.rpm curl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-devel-7.79.1-14.u4.fos23.aarch64.rpm FusionOS-SA-2023-2015 Important FusionOS CVE-2023-0401:A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data. FusionOS edk2-devel-202011-11.u1.fos23.x86_64.rpm python3-edk2-devel-202011-11.u1.fos23.noarch.rpm edk2-help-202011-11.u1.fos23.noarch.rpm edk2-ovmf-202011-11.u1.fos23.noarch.rpm edk2-devel-202011-11.u1.fos23.aarch64.rpm FusionOS-SA-2023-2016 Important FusionOS CVE-2022-48337:GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input. CVE-2022-48338:An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed. FusionOS emacs-27.2-9.u1.fos23.x86_64.rpm emacs-devel-27.2-9.u1.fos23.x86_64.rpm emacs-lucid-27.2-9.u1.fos23.x86_64.rpm emacs-nox-27.2-9.u1.fos23.x86_64.rpm emacs-common-27.2-9.u1.fos23.x86_64.rpm emacs-terminal-27.2-9.u1.fos23.noarch.rpm emacs-filesystem-27.2-9.u1.fos23.noarch.rpm emacs-help-27.2-9.u1.fos23.noarch.rpm emacs-27.2-9.u1.fos23.aarch64.rpm emacs-devel-27.2-9.u1.fos23.aarch64.rpm emacs-lucid-27.2-9.u1.fos23.aarch64.rpm emacs-nox-27.2-9.u1.fos23.aarch64.rpm emacs-common-27.2-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2017 Important FusionOS CVE-2022-40899:An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. FusionOS python3-future-0.18.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2018 Critical FusionOS CVE-2023-22490:Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs. CVE-2023-23946:Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. CVE-2022-41903:Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. CVE-2022-23521:Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2022-41953:Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources. FusionOS git-2.33.0-9.u2.fos23.x86_64.rpm git-core-2.33.0-9.u2.fos23.x86_64.rpm git-daemon-2.33.0-9.u2.fos23.x86_64.rpm git-gui-2.33.0-9.u2.fos23.noarch.rpm gitk-2.33.0-9.u2.fos23.noarch.rpm git-web-2.33.0-9.u2.fos23.noarch.rpm git-svn-2.33.0-9.u2.fos23.noarch.rpm git-email-2.33.0-9.u2.fos23.noarch.rpm perl-Git-2.33.0-9.u2.fos23.noarch.rpm perl-Git-SVN-2.33.0-9.u2.fos23.noarch.rpm git-help-2.33.0-9.u2.fos23.noarch.rpm git-2.33.0-9.u2.fos23.aarch64.rpm git-core-2.33.0-9.u2.fos23.aarch64.rpm git-daemon-2.33.0-9.u2.fos23.aarch64.rpm FusionOS-SA-2023-2019 Critical FusionOS CVE-2023-0687:** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. FusionOS glibc-2.34-113.u11.fos23.x86_64.rpm glibc-common-2.34-113.u11.fos23.x86_64.rpm glibc-all-langpacks-2.34-113.u11.fos23.x86_64.rpm glibc-locale-source-2.34-113.u11.fos23.x86_64.rpm glibc-locale-archive-2.34-113.u11.fos23.x86_64.rpm glibc-devel-2.34-113.u11.fos23.x86_64.rpm nscd-2.34-113.u11.fos23.x86_64.rpm nss_modules-2.34-113.u11.fos23.x86_64.rpm glibc-nss-devel-2.34-113.u11.fos23.x86_64.rpm libnsl-2.34-113.u11.fos23.x86_64.rpm glibc-debugutils-2.34-113.u11.fos23.x86_64.rpm glibc-help-2.34-113.u11.fos23.noarch.rpm glibc-compat-2.17-2.34-113.u11.fos23.x86_64.rpm glibc-2.34-113.u11.fos23.aarch64.rpm glibc-common-2.34-113.u11.fos23.aarch64.rpm glibc-all-langpacks-2.34-113.u11.fos23.aarch64.rpm glibc-locale-source-2.34-113.u11.fos23.aarch64.rpm glibc-locale-archive-2.34-113.u11.fos23.aarch64.rpm glibc-devel-2.34-113.u11.fos23.aarch64.rpm nscd-2.34-113.u11.fos23.aarch64.rpm nss_modules-2.34-113.u11.fos23.aarch64.rpm glibc-nss-devel-2.34-113.u11.fos23.aarch64.rpm libnsl-2.34-113.u11.fos23.aarch64.rpm glibc-debugutils-2.34-113.u11.fos23.aarch64.rpm glibc-compat-2.17-2.34-113.u11.fos23.aarch64.rpm FusionOS-SA-2023-2020 Important FusionOS CVE-2021-43618:GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. FusionOS gmp-6.2.1-2.u1.fos23.x86_64.rpm gmp-devel-6.2.1-2.u1.fos23.x86_64.rpm gmp-c++-6.2.1-2.u1.fos23.x86_64.rpm gmp-6.2.1-2.u1.fos23.aarch64.rpm gmp-devel-6.2.1-2.u1.fos23.aarch64.rpm gmp-c++-6.2.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2021 Critical FusionOS CVE-2021-44716:net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. CVE-2022-23772:Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23773:cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags. CVE-2022-23806:Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. CVE-2022-24921:regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. CVE-2022-41717:An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. FusionOS golang-1.19.4-1.u1.fos23.x86_64.rpm golang-help-1.19.4-1.u1.fos23.noarch.rpm golang-devel-1.19.4-1.u1.fos23.noarch.rpm golang-1.19.4-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2022 Critical FusionOS CVE-2023-0056:An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability. CVE-2023-25725:HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. FusionOS haproxy-2.6.6-2.u1.fos23.x86_64.rpm haproxy-help-2.6.6-2.u1.fos23.noarch.rpm haproxy-2.6.6-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2023 Important FusionOS CVE-2023-25193:hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. FusionOS harfbuzz-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-help-2.8.2-4.u1.fos23.noarch.rpm harfbuzz-2.8.2-4.u1.fos23.aarch64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2024 Critical FusionOS CVE-2006-2001:Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector. CVE-2022-36760:Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. CVE-2022-37436:Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. CVE-2023-25690:Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server. CVE-2023-27522:HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client. FusionOS httpd-2.4.51-15.u5.fos23.x86_64.rpm httpd-devel-2.4.51-15.u5.fos23.x86_64.rpm httpd-help-2.4.51-15.u5.fos23.noarch.rpm httpd-filesystem-2.4.51-15.u5.fos23.noarch.rpm httpd-tools-2.4.51-15.u5.fos23.x86_64.rpm mod_ssl-2.4.51-15.u5.fos23.x86_64.rpm mod_md-2.4.51-15.u5.fos23.x86_64.rpm mod_proxy_html-2.4.51-15.u5.fos23.x86_64.rpm mod_ldap-2.4.51-15.u5.fos23.x86_64.rpm mod_session-2.4.51-15.u5.fos23.x86_64.rpm httpd-2.4.51-15.u5.fos23.aarch64.rpm httpd-devel-2.4.51-15.u5.fos23.aarch64.rpm httpd-tools-2.4.51-15.u5.fos23.aarch64.rpm mod_ssl-2.4.51-15.u5.fos23.aarch64.rpm mod_md-2.4.51-15.u5.fos23.aarch64.rpm mod_proxy_html-2.4.51-15.u5.fos23.aarch64.rpm mod_ldap-2.4.51-15.u5.fos23.aarch64.rpm mod_session-2.4.51-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2025 Important FusionOS CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. FusionOS jackson-databind-2.9.8-9.u1.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u1.fos23.noarch.rpm FusionOS-SA-2023-2026 Critical FusionOS CVE-2014-125087:A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480. FusionOS java-xmlbuilder-1.1-1.u1.fos23.noarch.rpm java-xmlbuilder-help-1.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2027 Moderate FusionOS CVE-2021-28168:Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. FusionOS jersey-2.29.1-1.u1.fos23.noarch.rpm jersey-test-framework-2.29.1-1.u1.fos23.noarch.rpm jersey-javadoc-2.29.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2028 Important FusionOS CVE-2022-46663:In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. FusionOS less-590-4.u1.fos23.x86_64.rpm less-help-590-4.u1.fos23.noarch.rpm less-590-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2029 Important FusionOS CVE-2022-44617:A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-46285:A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library. CVE-2022-4883:A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. FusionOS libXpm-3.5.13-4.u1.fos23.x86_64.rpm libXpm-devel-3.5.13-4.u1.fos23.x86_64.rpm libXpm-help-3.5.13-4.u1.fos23.noarch.rpm libXpm-3.5.13-4.u1.fos23.aarch64.rpm libXpm-devel-3.5.13-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2030 Moderate FusionOS CVE-2021-36976:libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). FusionOS libarchive-3.5.2-6.u3.fos23.x86_64.rpm libarchive-devel-3.5.2-6.u3.fos23.x86_64.rpm libarchive-help-3.5.2-6.u3.fos23.noarch.rpm bsdtar-3.5.2-6.u3.fos23.x86_64.rpm bsdcpio-3.5.2-6.u3.fos23.x86_64.rpm bsdcat-3.5.2-6.u3.fos23.x86_64.rpm libarchive-3.5.2-6.u3.fos23.aarch64.rpm libarchive-devel-3.5.2-6.u3.fos23.aarch64.rpm bsdtar-3.5.2-6.u3.fos23.aarch64.rpm bsdcpio-3.5.2-6.u3.fos23.aarch64.rpm bsdcat-3.5.2-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2031 Critical FusionOS CVE-2022-47629:Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. FusionOS libksba-1.6.0-3.u1.fos23.x86_64.rpm libksba-devel-1.6.0-3.u1.fos23.x86_64.rpm libksba-help-1.6.0-3.u1.fos23.noarch.rpm libksba-1.6.0-3.u1.fos23.aarch64.rpm libksba-devel-1.6.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2032 Moderate FusionOS CVE-2023-27371:GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. FusionOS libmicrohttpd-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-help-0.9.75-4.u1.fos23.noarch.rpm libmicrohttpd-0.9.75-4.u1.fos23.aarch64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2033 Moderate FusionOS CVE-2023-23009:Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. FusionOS libreswan-4.5-3.u1.fos23.x86_64.rpm libreswan-help-4.5-3.u1.fos23.x86_64.rpm libreswan-4.5-3.u1.fos23.aarch64.rpm libreswan-help-4.5-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2034 Important FusionOS CVE-2022-48281:processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. CVE-2023-0795:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0796:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0797:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0798:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0799:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0800:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0801:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0802:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0803:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0804:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. FusionOS libtiff-4.3.0-24.u2.fos23.x86_64.rpm libtiff-devel-4.3.0-24.u2.fos23.x86_64.rpm libtiff-static-4.3.0-24.u2.fos23.x86_64.rpm libtiff-tools-4.3.0-24.u2.fos23.x86_64.rpm libtiff-help-4.3.0-24.u2.fos23.noarch.rpm libtiff-4.3.0-24.u2.fos23.aarch64.rpm libtiff-devel-4.3.0-24.u2.fos23.aarch64.rpm libtiff-static-4.3.0-24.u2.fos23.aarch64.rpm libtiff-tools-4.3.0-24.u2.fos23.aarch64.rpm FusionOS-SA-2023-2035 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-help-4.0.3-2022102413.u4.fos23.noarch.rpm lxc-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.aarch64.rpm FusionOS-SA-2023-2036 Moderate FusionOS CVE-2022-44792:handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2022-44793:handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. FusionOS net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-libs-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-devel-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-perl-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-gui-5.9.1-5.u1.fos23.x86_64.rpm python3-net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-help-5.9.1-5.u1.fos23.noarch.rpm net-snmp-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-libs-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-devel-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-perl-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-gui-5.9.1-5.u1.fos23.aarch64.rpm python3-net-snmp-5.9.1-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2037 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS nodejs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-devel-12.22.11-4.u1.fos23.x86_64.rpm nodejs-libs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.x86_64.rpm nodejs-docs-12.22.11-4.u1.fos23.noarch.rpm nodejs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-devel-12.22.11-4.u1.fos23.aarch64.rpm nodejs-libs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2038 Critical FusionOS CVE-2023-25136:OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible." FusionOS openssh-8.8p1-19.u6.fos23.x86_64.rpm openssh-clients-8.8p1-19.u6.fos23.x86_64.rpm openssh-server-8.8p1-19.u6.fos23.x86_64.rpm openssh-keycat-8.8p1-19.u6.fos23.x86_64.rpm openssh-askpass-8.8p1-19.u6.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.x86_64.rpm openssh-help-8.8p1-19.u6.fos23.noarch.rpm openssh-8.8p1-19.u6.fos23.aarch64.rpm openssh-clients-8.8p1-19.u6.fos23.aarch64.rpm openssh-server-8.8p1-19.u6.fos23.aarch64.rpm openssh-keycat-8.8p1-19.u6.fos23.aarch64.rpm openssh-askpass-8.8p1-19.u6.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2039 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openssl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-libs-1.1.1m-18.u3.fos23.x86_64.rpm openssl-perl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-devel-1.1.1m-18.u3.fos23.x86_64.rpm openssl-help-1.1.1m-18.u3.fos23.noarch.rpm openssl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-libs-1.1.1m-18.u3.fos23.aarch64.rpm openssl-perl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-devel-1.1.1m-18.u3.fos23.aarch64.rpm FusionOS-SA-2023-2040 Critical FusionOS CVE-2022-4338:An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. FusionOS openvswitch-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-devel-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-help-2.12.4-2.u1.fos23.x86_64.rpm python3-openvswitch-2.12.4-2.u1.fos23.noarch.rpm openvswitch-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-devel-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-help-2.12.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2041 Important FusionOS CVE-2022-47021:A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts. FusionOS opusfile-0.11-5.u1.fos23.x86_64.rpm opusfile-devel-0.11-5.u1.fos23.x86_64.rpm opusfile-0.11-5.u1.fos23.aarch64.rpm opusfile-devel-0.11-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2042 Moderate FusionOS CVE-2022-3560:A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. FusionOS pesign-115-4.u1.fos23.x86_64.rpm pesign-help-115-4.u1.fos23.x86_64.rpm pesign-115-4.u1.fos23.aarch64.rpm pesign-help-115-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2043 Moderate FusionOS CVE-2023-24056:In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. FusionOS pkgconf-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-devel-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-help-1.8.0-3.u1.fos23.noarch.rpm pkgconf-1.8.0-3.u1.fos23.aarch64.rpm pkgconf-devel-1.8.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2044 Moderate FusionOS CVE-2022-37337:A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. FusionOS poppler-0.90.0-4.u1.fos23.x86_64.rpm poppler-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-doc-0.90.0-4.u1.fos23.noarch.rpm poppler-qt5-0.90.0-4.u1.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-utils-0.90.0-4.u1.fos23.x86_64.rpm poppler-help-0.90.0-4.u1.fos23.noarch.rpm poppler-0.90.0-4.u1.fos23.aarch64.rpm poppler-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-utils-0.90.0-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2045 Important FusionOS CVE-2022-4603:** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario. FusionOS ppp-2.4.9-5.u3.fos23.x86_64.rpm ppp-devel-2.4.9-5.u3.fos23.x86_64.rpm ppp-help-2.4.9-5.u3.fos23.noarch.rpm ppp-2.4.9-5.u3.fos23.aarch64.rpm ppp-devel-2.4.9-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2046 Moderate FusionOS CVE-2023-23931:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. FusionOS python3-cryptography-36.0.1-2.u1.fos23.x86_64.rpm python-cryptography-help-36.0.1-2.u1.fos23.noarch.rpm python3-cryptography-36.0.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2047 Important FusionOS CVE-2022-40898:An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. FusionOS python3-wheel-0.37.0-2.u1.fos23.noarch.rpm python-wheel-wheel-0.37.0-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2048 Important FusionOS CVE-2021-33621:The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. FusionOS ruby-3.0.3-128.u1.fos23.x86_64.rpm ruby-devel-3.0.3-128.u1.fos23.x86_64.rpm rubygems-3.2.32-128.u1.fos23.noarch.rpm rubygems-devel-3.2.32-128.u1.fos23.noarch.rpm rubygem-rake-13.0.3-128.u1.fos23.noarch.rpm rubygem-rbs-1.4.0-128.u1.fos23.noarch.rpm ruby-irb-3.0.3-128.u1.fos23.noarch.rpm rubygem-rdoc-6.3.3-128.u1.fos23.noarch.rpm ruby-help-3.0.3-128.u1.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-128.u1.fos23.noarch.rpm rubygem-io-console-0.5.7-128.u1.fos23.x86_64.rpm rubygem-json-2.5.1-128.u1.fos23.x86_64.rpm rubygem-minitest-5.14.2-128.u1.fos23.noarch.rpm rubygem-openssl-2.2.1-128.u1.fos23.x86_64.rpm rubygem-power_assert-1.2.0-128.u1.fos23.noarch.rpm rubygem-psych-3.3.2-128.u1.fos23.x86_64.rpm rubygem-test-unit-3.3.7-128.u1.fos23.noarch.rpm rubygem-rexml-3.2.5-128.u1.fos23.noarch.rpm rubygem-rss-0.2.9-128.u1.fos23.noarch.rpm rubygem-typeprof-0.15.2-128.u1.fos23.noarch.rpm ruby-3.0.3-128.u1.fos23.aarch64.rpm ruby-devel-3.0.3-128.u1.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.aarch64.rpm rubygem-io-console-0.5.7-128.u1.fos23.aarch64.rpm rubygem-json-2.5.1-128.u1.fos23.aarch64.rpm rubygem-openssl-2.2.1-128.u1.fos23.aarch64.rpm rubygem-psych-3.3.2-128.u1.fos23.aarch64.rpm FusionOS-SA-2023-2049 Important FusionOS CVE-2022-44566:A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. CVE-2023-22794:A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment. FusionOS rubygem-activerecord-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-activerecord-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2050 Important FusionOS CVE-2023-22796:A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability. FusionOS rubygem-activesupport-6.1.4.1-5.u2.fos23.noarch.rpm rubygem-activesupport-doc-6.1.4.1-5.u2.fos23.noarch.rpm FusionOS-SA-2023-2051 Important FusionOS CVE-2023-22799:A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately. FusionOS rubygem-globalid-0.4.2-4.u1.fos23.noarch.rpm rubygem-globalid-doc-0.4.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2052 Important FusionOS CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS shim-15.6-9.u4.fos23.x86_64.rpm shim-15.6-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2053 Important FusionOS CVE-2022-25857:The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. CVE-2022-38749:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38751:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38752:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-41854:Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. FusionOS snakeyaml-1.32-1.u1.fos23.noarch.rpm snakeyaml-javadoc-1.32-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2054 Important FusionOS CVE-2023-22809:In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. CVE-2023-27320:This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided. FusionOS sudo-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u3.fos23.noarch.rpm sudo-1.9.8p2-10.u3.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u3.fos23.aarch64.rpm FusionOS-SA-2023-2055 Moderate FusionOS CVE-2022-4415:A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. FusionOS systemd-249-46.u7.fos23.x86_64.rpm systemd-devel-249-46.u7.fos23.x86_64.rpm systemd-libs-249-46.u7.fos23.x86_64.rpm systemd-udev-249-46.u7.fos23.x86_64.rpm systemd-container-249-46.u7.fos23.x86_64.rpm systemd-resolved-249-46.u7.fos23.x86_64.rpm systemd-nspawn-249-46.u7.fos23.x86_64.rpm systemd-networkd-249-46.u7.fos23.x86_64.rpm systemd-timesyncd-249-46.u7.fos23.x86_64.rpm systemd-pam-249-46.u7.fos23.x86_64.rpm systemd-help-249-46.u7.fos23.noarch.rpm systemd-249-46.u7.fos23.aarch64.rpm systemd-devel-249-46.u7.fos23.aarch64.rpm systemd-libs-249-46.u7.fos23.aarch64.rpm systemd-udev-249-46.u7.fos23.aarch64.rpm systemd-container-249-46.u7.fos23.aarch64.rpm systemd-resolved-249-46.u7.fos23.aarch64.rpm systemd-nspawn-249-46.u7.fos23.aarch64.rpm systemd-networkd-249-46.u7.fos23.aarch64.rpm systemd-timesyncd-249-46.u7.fos23.aarch64.rpm systemd-pam-249-46.u7.fos23.aarch64.rpm FusionOS-SA-2023-2056 Important FusionOS CVE-2022-48303:GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. FusionOS tar-1.34-4.u1.fos23.x86_64.rpm tar-help-1.34-4.u1.fos23.noarch.rpm tar-1.34-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2057 Important FusionOS CVE-2022-47016:** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. FusionOS tmux-3.2a-3.u1.fos23.x86_64.rpm tmux-help-3.2a-3.u1.fos23.noarch.rpm tmux-3.2a-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2058 Important FusionOS CVE-2022-42252:If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. CVE-2021-43980:The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. FusionOS tomcat-9.0.10-29.u4.fos23.noarch.rpm tomcat-jsvc-9.0.10-29.u4.fos23.noarch.rpm tomcat-help-9.0.10-29.u4.fos23.noarch.rpm FusionOS-SA-2023-2059 Moderate FusionOS CVE-2023-22745:tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. FusionOS tpm2-tss-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-help-3.1.0-3.u1.fos23.noarch.rpm tpm2-tss-3.1.0-3.u1.fos23.aarch64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2060 Important FusionOS CVE-2023-0051:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2023-0054:Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. CVE-2023-0049:Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0288:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2022-47024:A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. CVE-2023-0433:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-1170:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1175:Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. FusionOS vim-common-9.0-11.u4.fos23.x86_64.rpm vim-minimal-9.0-11.u4.fos23.x86_64.rpm vim-enhanced-9.0-11.u4.fos23.x86_64.rpm vim-filesystem-9.0-11.u4.fos23.noarch.rpm vim-X11-9.0-11.u4.fos23.x86_64.rpm vim-common-9.0-11.u4.fos23.aarch64.rpm vim-minimal-9.0-11.u4.fos23.aarch64.rpm vim-enhanced-9.0-11.u4.fos23.aarch64.rpm vim-X11-9.0-11.u4.fos23.aarch64.rpm FusionOS-SA-2023-2061 Important FusionOS CVE-2022-3724:Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows CVE-2023-0416:GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0411:Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0413:Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0415:iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0417:Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2022-4344:Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4345:Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2023-0412:TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-1161:ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-1.u1.fos23.x86_64.rpm wireshark-devel-3.6.11-1.u1.fos23.x86_64.rpm wireshark-help-3.6.11-1.u1.fos23.x86_64.rpm wireshark-3.6.11-1.u1.fos23.aarch64.rpm wireshark-devel-3.6.11-1.u1.fos23.aarch64.rpm wireshark-help-3.6.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2062 Important FusionOS CVE-2023-0494:A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. FusionOS xorg-x11-server-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-source-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.aarch64.rpm FusionOS-SA-2023-2063 Important FusionOS CVE-2022-41966:XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. FusionOS xstream-1.4.18-3.u2.fos23.noarch.rpm xstream-javadoc-1.4.18-3.u2.fos23.noarch.rpm xstream-hibernate-1.4.18-3.u2.fos23.noarch.rpm xstream-benchmark-1.4.18-3.u2.fos23.noarch.rpm xstream-parent-1.4.18-3.u2.fos23.noarch.rpm FusionOS-SA-2023-2064 Moderate FusionOS CVE-2023-1289:A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. CVE-2023-1906:A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2065 Moderate FusionOS CVE-2023-1981:It was discovered that the avahi deamon can be locally crashed by a dbus call made by an unprivileged user, causing a denial of service. FusionOS avahi-0.8-15.u1.fos23.x86_64.rpm avahi-tools-0.8-15.u1.fos23.x86_64.rpm avahi-ui-0.8-15.u1.fos23.x86_64.rpm avahi-autoipd-0.8-15.u1.fos23.x86_64.rpm avahi-dnsconfd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.x86_64.rpm avahi-devel-0.8-15.u1.fos23.x86_64.rpm avahi-glib-0.8-15.u1.fos23.x86_64.rpm avahi-glib-devel-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-devel-0.8-15.u1.fos23.x86_64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.x86_64.rpm avahi-ui-devel-0.8-15.u1.fos23.x86_64.rpm avahi-libs-0.8-15.u1.fos23.x86_64.rpm avahi-help-0.8-15.u1.fos23.noarch.rpm avahi-0.8-15.u1.fos23.aarch64.rpm avahi-tools-0.8-15.u1.fos23.aarch64.rpm avahi-ui-0.8-15.u1.fos23.aarch64.rpm avahi-autoipd-0.8-15.u1.fos23.aarch64.rpm avahi-dnsconfd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.aarch64.rpm avahi-devel-0.8-15.u1.fos23.aarch64.rpm avahi-glib-0.8-15.u1.fos23.aarch64.rpm avahi-glib-devel-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-devel-0.8-15.u1.fos23.aarch64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.aarch64.rpm avahi-ui-devel-0.8-15.u1.fos23.aarch64.rpm avahi-libs-0.8-15.u1.fos23.aarch64.rpm FusionOS-SA-2023-2066 Important FusionOS CVE-2023-27349:This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. FusionOS bluez-5.54-17.u2.fos23.x86_64.rpm bluez-libs-5.54-17.u2.fos23.x86_64.rpm bluez-devel-5.54-17.u2.fos23.x86_64.rpm bluez-help-5.54-17.u2.fos23.noarch.rpm bluez-cups-5.54-17.u2.fos23.x86_64.rpm bluez-5.54-17.u2.fos23.aarch64.rpm bluez-libs-5.54-17.u2.fos23.aarch64.rpm bluez-devel-5.54-17.u2.fos23.aarch64.rpm bluez-cups-5.54-17.u2.fos23.aarch64.rpm FusionOS-SA-2023-2067 Critical FusionOS CVE-2023-27533:curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the servernegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data. CVE-2023-27534:to-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse. CVE-2023-27535:libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. CVE-2023-27536:libcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. CVE-2023-27538:libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily. FusionOS curl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-devel-7.79.1-15.u5.fos23.x86_64.rpm curl-help-7.79.1-15.u5.fos23.noarch.rpm curl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-devel-7.79.1-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2068 Important FusionOS CVE-2023-30630:Dmidecode reports information about your system's hardware as described in your system BIOS according to the SMBIOS/DMI standard (see a sample output). This information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).DMI data can be used to enable or disable specific portions of kernel code depending on the specific hardware. Thus, one use of dmidecode is for kernel developers to detect system "signatures" and add them to the kernel source code when needed. FusionOS dmidecode-3.4-3.u1.fos23.x86_64.rpm dmidecode-3.4-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2069 Important FusionOS CVE-2023-28450:An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. FusionOS dnsmasq-2.86-5.u2.fos23.x86_64.rpm dnsmasq-help-2.86-5.u2.fos23.x86_64.rpm dnsmasq-2.86-5.u2.fos23.aarch64.rpm dnsmasq-help-2.86-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2070 Important FusionOS CVE-2023-28617:Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more. FusionOS emacs-27.2-10.u2.fos23.x86_64.rpm emacs-devel-27.2-10.u2.fos23.x86_64.rpm emacs-lucid-27.2-10.u2.fos23.x86_64.rpm emacs-nox-27.2-10.u2.fos23.x86_64.rpm emacs-common-27.2-10.u2.fos23.x86_64.rpm emacs-terminal-27.2-10.u2.fos23.noarch.rpm emacs-filesystem-27.2-10.u2.fos23.noarch.rpm emacs-help-27.2-10.u2.fos23.noarch.rpm emacs-27.2-10.u2.fos23.aarch64.rpm emacs-devel-27.2-10.u2.fos23.aarch64.rpm emacs-lucid-27.2-10.u2.fos23.aarch64.rpm emacs-nox-27.2-10.u2.fos23.aarch64.rpm emacs-common-27.2-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2071 Important FusionOS CVE-2023-2004:FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats FusionOS freetype-2.12.1-2.u1.fos23.x86_64.rpm freetype-demos-2.12.1-2.u1.fos23.x86_64.rpm freetype-devel-2.12.1-2.u1.fos23.x86_64.rpm freetype-help-2.12.1-2.u1.fos23.noarch.rpm freetype-2.12.1-2.u1.fos23.aarch64.rpm freetype-demos-2.12.1-2.u1.fos23.aarch64.rpm freetype-devel-2.12.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2072 Moderate FusionOS CVE-2023-24593:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. CVE-2023-25180:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. FusionOS glib2-2.72.2-9.u4.fos23.x86_64.rpm glib2-devel-2.72.2-9.u4.fos23.x86_64.rpm glib2-static-2.72.2-9.u4.fos23.x86_64.rpm glib2-tests-2.72.2-9.u4.fos23.x86_64.rpm glib2-help-2.72.2-9.u4.fos23.noarch.rpm glib2-2.72.2-9.u4.fos23.aarch64.rpm glib2-devel-2.72.2-9.u4.fos23.aarch64.rpm glib2-static-2.72.2-9.u4.fos23.aarch64.rpm glib2-tests-2.72.2-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2073 Important FusionOS CVE-2023-26253:In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. FusionOS glusterfs-10.0-8.u1.fos23.x86_64.rpm glusterfs-cli-10.0-8.u1.fos23.x86_64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.x86_64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-fuse-10.0-8.u1.fos23.x86_64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.x86_64.rpm libglusterfs0-10.0-8.u1.fos23.x86_64.rpm libglusterfs-devel-10.0-8.u1.fos23.x86_64.rpm libgfapi0-10.0-8.u1.fos23.x86_64.rpm libgfapi-devel-10.0-8.u1.fos23.x86_64.rpm libgfchangelog0-10.0-8.u1.fos23.x86_64.rpm libgfchangelog-devel-10.0-8.u1.fos23.x86_64.rpm libgfrpc0-10.0-8.u1.fos23.x86_64.rpm libgfrpc-devel-10.0-8.u1.fos23.x86_64.rpm libgfxdr0-10.0-8.u1.fos23.x86_64.rpm libgfxdr-devel-10.0-8.u1.fos23.x86_64.rpm libglusterd0-10.0-8.u1.fos23.x86_64.rpm python3-gluster-10.0-8.u1.fos23.x86_64.rpm glusterfs-resource-agents-10.0-8.u1.fos23.noarch.rpm glusterfs-server-10.0-8.u1.fos23.x86_64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.x86_64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-events-10.0-8.u1.fos23.x86_64.rpm glusterfs-10.0-8.u1.fos23.aarch64.rpm glusterfs-cli-10.0-8.u1.fos23.aarch64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.aarch64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-fuse-10.0-8.u1.fos23.aarch64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.aarch64.rpm libglusterfs0-10.0-8.u1.fos23.aarch64.rpm libglusterfs-devel-10.0-8.u1.fos23.aarch64.rpm libgfapi0-10.0-8.u1.fos23.aarch64.rpm libgfapi-devel-10.0-8.u1.fos23.aarch64.rpm libgfchangelog0-10.0-8.u1.fos23.aarch64.rpm libgfchangelog-devel-10.0-8.u1.fos23.aarch64.rpm libgfrpc0-10.0-8.u1.fos23.aarch64.rpm libgfrpc-devel-10.0-8.u1.fos23.aarch64.rpm libgfxdr0-10.0-8.u1.fos23.aarch64.rpm libgfxdr-devel-10.0-8.u1.fos23.aarch64.rpm libglusterd0-10.0-8.u1.fos23.aarch64.rpm python3-gluster-10.0-8.u1.fos23.aarch64.rpm glusterfs-server-10.0-8.u1.fos23.aarch64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.aarch64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-events-10.0-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2074 Important FusionOS CVE-2023-0361:A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. FusionOS gnutls-3.7.2-7.u1.fos23.x86_64.rpm gnutls-devel-3.7.2-7.u1.fos23.x86_64.rpm gnutls-utils-3.7.2-7.u1.fos23.x86_64.rpm gnutls-help-3.7.2-7.u1.fos23.noarch.rpm gnutls-3.7.2-7.u1.fos23.aarch64.rpm gnutls-devel-3.7.2-7.u1.fos23.aarch64.rpm gnutls-utils-3.7.2-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2075 Important FusionOS CVE-2023-25950:HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition. FusionOS haproxy-2.6.6-3.u2.fos23.x86_64.rpm haproxy-help-2.6.6-3.u2.fos23.noarch.rpm haproxy-2.6.6-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2076 Critical FusionOS CVE-2018-13867:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c. CVE-2018-14031:An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5T_copy in H5T.c. CVE-2018-16438:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in H5L_extern_query at H5Lexternal.c. CVE-2019-8396:A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2." CVE-2020-10812:An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service. CVE-2021-37501:Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c. FusionOS hdf5-1.12.1-4.u3.fos23.x86_64.rpm hdf5-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-1.12.1-4.u3.fos23.aarch64.rpm hdf5-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2077 Important FusionOS CVE-2022-2047:In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CVE-2022-2048:In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. FusionOS jetty-9.4.16-3.u1.fos23.noarch.rpm jetty-client-9.4.16-3.u1.fos23.noarch.rpm jetty-continuation-9.4.16-3.u1.fos23.noarch.rpm jetty-http-9.4.16-3.u1.fos23.noarch.rpm jetty-http-spi-9.4.16-3.u1.fos23.noarch.rpm jetty-io-9.4.16-3.u1.fos23.noarch.rpm jetty-jaas-9.4.16-3.u1.fos23.noarch.rpm jetty-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-security-9.4.16-3.u1.fos23.noarch.rpm jetty-server-9.4.16-3.u1.fos23.noarch.rpm jetty-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-util-9.4.16-3.u1.fos23.noarch.rpm jetty-webapp-9.4.16-3.u1.fos23.noarch.rpm jetty-jmx-9.4.16-3.u1.fos23.noarch.rpm jetty-xml-9.4.16-3.u1.fos23.noarch.rpm jetty-project-9.4.16-3.u1.fos23.noarch.rpm jetty-deploy-9.4.16-3.u1.fos23.noarch.rpm jetty-annotations-9.4.16-3.u1.fos23.noarch.rpm jetty-ant-9.4.16-3.u1.fos23.noarch.rpm jetty-cdi-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-client-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-server-9.4.16-3.u1.fos23.noarch.rpm jetty-infinispan-9.4.16-3.u1.fos23.noarch.rpm jetty-jaspi-9.4.16-3.u1.fos23.noarch.rpm jetty-jndi-9.4.16-3.u1.fos23.noarch.rpm jetty-jspc-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-plus-9.4.16-3.u1.fos23.noarch.rpm jetty-proxy-9.4.16-3.u1.fos23.noarch.rpm jetty-rewrite-9.4.16-3.u1.fos23.noarch.rpm jetty-servlets-9.4.16-3.u1.fos23.noarch.rpm jetty-spring-9.4.16-3.u1.fos23.noarch.rpm jetty-start-9.4.16-3.u1.fos23.noarch.rpm jetty-unixsocket-9.4.16-3.u1.fos23.noarch.rpm jetty-util-ajax-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-api-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-client-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-common-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-server-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-client-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-server-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-nosql-9.4.16-3.u1.fos23.noarch.rpm jetty-httpservice-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-warurl-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-alpn-9.4.16-3.u1.fos23.noarch.rpm jetty-quickstart-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-client-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-server-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-client-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-common-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-hpack-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-http-client-transport-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-server-9.4.16-3.u1.fos23.noarch.rpm jetty-jstl-9.4.16-3.u1.fos23.noarch.rpm jetty-javadoc-9.4.16-3.u1.fos23.noarch.rpm FusionOS-SA-2023-2078 Important FusionOS CVE-2023-1370:[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software. FusionOS json-smart-2.2-2.u1.fos23.noarch.rpm json-smart-javadoc-2.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2079 Important FusionOS CVE-2022-36280:An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-4269:A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. CVE-2022-48423:In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur. CVE-2022-48424:In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. CVE-2022-48425:In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2023-0266:A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e CVE-2023-1079:A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. CVE-2023-1249:A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. CVE-2023-1281:Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. CVE-2023-1380:in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1382:A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. CVE-2023-1513:A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. CVE-2023-1611:A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea CVE-2023-1670:A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2023-1855:A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. CVE-2023-1859:A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. CVE-2023-1872:A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit CVE-2023-1989:A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. CVE-2023-1990:A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. CVE-2023-1998:The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. CVE-2023-2006:A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel. CVE-2023-28327:Reference:https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/https://lore.kernel.org/netdev/20221127012412.37969-3-kuniyu@amazon.com/T/ CVE-2023-28328:A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28466:do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). CVE-2023-30456:An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. CVE-2023-30772:The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. FusionOS kernel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm FusionOS-SA-2023-2080 Important FusionOS CVE-2020-12762:json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. FusionOS libfastjson-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-devel-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-0.99.9-3.u1.fos23.aarch64.rpm libfastjson-devel-0.99.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2081 Moderate FusionOS CVE-2023-0614:The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. FusionOS libldb-2.6.1-2.u1.fos23.x86_64.rpm libldb-devel-2.6.1-2.u1.fos23.x86_64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.x86_64.rpm libldb-help-2.6.1-2.u1.fos23.noarch.rpm libldb-2.6.1-2.u1.fos23.aarch64.rpm libldb-devel-2.6.1-2.u1.fos23.aarch64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2082 Important FusionOS CVE-2023-26769:Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c. FusionOS liblouis-3.7.0-5.u2.fos23.x86_64.rpm liblouis-devel-3.7.0-5.u2.fos23.x86_64.rpm liblouis-utils-3.7.0-5.u2.fos23.x86_64.rpm liblouis-help-3.7.0-5.u2.fos23.noarch.rpm python3-louis-3.7.0-5.u2.fos23.noarch.rpm liblouis-3.7.0-5.u2.fos23.aarch64.rpm liblouis-devel-3.7.0-5.u2.fos23.aarch64.rpm liblouis-utils-3.7.0-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2083 Moderate FusionOS CVE-2023-28484:In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. CVE-2023-29469:An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). FusionOS libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-devel-2.9.14-5.u1.fos23.x86_64.rpm python3-libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-help-2.9.14-5.u1.fos23.noarch.rpm libxml2-2.9.14-5.u1.fos23.aarch64.rpm libxml2-devel-2.9.14-5.u1.fos23.aarch64.rpm python3-libxml2-2.9.14-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2084 Important FusionOS CVE-2021-45985:In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. FusionOS lua-5.4.3-11.u2.fos23.x86_64.rpm lua-devel-5.4.3-11.u2.fos23.x86_64.rpm lua-help-5.4.3-11.u2.fos23.noarch.rpm lua-5.4.3-11.u2.fos23.aarch64.rpm lua-devel-5.4.3-11.u2.fos23.aarch64.rpm FusionOS-SA-2023-2085 Important FusionOS CVE-2022-44370:NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 FusionOS nasm-2.15.05-5.u2.fos23.x86_64.rpm nasm-help-2.15.05-5.u2.fos23.noarch.rpm nasm-2.15.05-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2086 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. FusionOS openssl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-libs-1.1.1m-19.u5.fos23.x86_64.rpm openssl-perl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-devel-1.1.1m-19.u5.fos23.x86_64.rpm openssl-help-1.1.1m-19.u5.fos23.noarch.rpm openssl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-libs-1.1.1m-19.u5.fos23.aarch64.rpm openssl-perl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-devel-1.1.1m-19.u5.fos23.aarch64.rpm FusionOS-SA-2023-2087 Important FusionOS CVE-2023-1668:A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow. FusionOS openvswitch-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-devel-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-help-2.12.4-3.u2.fos23.x86_64.rpm python3-openvswitch-2.12.4-3.u2.fos23.noarch.rpm openvswitch-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-devel-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-help-2.12.4-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2088 Moderate FusionOS CVE-2022-40897:Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. FusionOS python-setuptools-59.4.0-5.u1.fos23.noarch.rpm python3-setuptools-59.4.0-5.u1.fos23.noarch.rpm python-setuptools-help-59.4.0-5.u1.fos23.noarch.rpm FusionOS-SA-2023-2089 Important FusionOS CVE-2023-24329:An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. FusionOS python3-3.9.9-24.u3.fos23.x86_64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.x86_64.rpm python3-devel-3.9.9-24.u3.fos23.x86_64.rpm python3-debug-3.9.9-24.u3.fos23.x86_64.rpm python3-help-3.9.9-24.u3.fos23.noarch.rpm python3-3.9.9-24.u3.fos23.aarch64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.aarch64.rpm python3-devel-3.9.9-24.u3.fos23.aarch64.rpm python3-debug-3.9.9-24.u3.fos23.aarch64.rpm FusionOS-SA-2023-2090 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis5-5.0.7-5.u1.fos23.x86_64.rpm redis5-devel-5.0.7-5.u1.fos23.x86_64.rpm redis5-doc-5.0.7-5.u1.fos23.noarch.rpm redis5-5.0.7-5.u1.fos23.aarch64.rpm redis5-devel-5.0.7-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2091 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis6-6.2.7-2.u1.fos23.x86_64.rpm redis6-devel-6.2.7-2.u1.fos23.x86_64.rpm redis6-doc-6.2.7-2.u1.fos23.noarch.rpm redis6-6.2.7-2.u1.fos23.aarch64.rpm redis6-devel-6.2.7-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2092 Important FusionOS CVE-2023-28755:A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. CVE-2023-28756:A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. FusionOS ruby-3.0.3-129.u2.fos23.x86_64.rpm ruby-devel-3.0.3-129.u2.fos23.x86_64.rpm rubygems-3.2.32-129.u2.fos23.noarch.rpm rubygems-devel-3.2.32-129.u2.fos23.noarch.rpm rubygem-rake-13.0.3-129.u2.fos23.noarch.rpm rubygem-rbs-1.4.0-129.u2.fos23.noarch.rpm ruby-irb-3.0.3-129.u2.fos23.noarch.rpm rubygem-rdoc-6.3.3-129.u2.fos23.noarch.rpm ruby-help-3.0.3-129.u2.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-129.u2.fos23.noarch.rpm rubygem-io-console-0.5.7-129.u2.fos23.x86_64.rpm rubygem-json-2.5.1-129.u2.fos23.x86_64.rpm rubygem-minitest-5.14.2-129.u2.fos23.noarch.rpm rubygem-openssl-2.2.1-129.u2.fos23.x86_64.rpm rubygem-power_assert-1.2.0-129.u2.fos23.noarch.rpm rubygem-psych-3.3.2-129.u2.fos23.x86_64.rpm rubygem-test-unit-3.3.7-129.u2.fos23.noarch.rpm rubygem-rexml-3.2.5-129.u2.fos23.noarch.rpm rubygem-rss-0.2.9-129.u2.fos23.noarch.rpm rubygem-typeprof-0.15.2-129.u2.fos23.noarch.rpm ruby-3.0.3-129.u2.fos23.aarch64.rpm ruby-devel-3.0.3-129.u2.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.aarch64.rpm rubygem-io-console-0.5.7-129.u2.fos23.aarch64.rpm rubygem-json-2.5.1-129.u2.fos23.aarch64.rpm rubygem-openssl-2.2.1-129.u2.fos23.aarch64.rpm rubygem-psych-3.3.2-129.u2.fos23.aarch64.rpm FusionOS-SA-2023-2093 Important FusionOS CVE-2023-28642:runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. FusionOS runc-1.1.3-11.u3.fos23.x86_64.rpm runc-1.1.3-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2094 Moderate FusionOS CVE-2023-24626:socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. FusionOS screen-4.9.0-2.u1.fos23.x86_64.rpm screen-help-4.9.0-2.u1.fos23.noarch.rpm screen-4.9.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2095 Low FusionOS CVE-2023-29383:In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. FusionOS shadow-4.9-9.u3.fos23.x86_64.rpm shadow-subid-devel-4.9-9.u3.fos23.x86_64.rpm shadow-help-4.9-9.u3.fos23.noarch.rpm shadow-4.9-9.u3.fos23.aarch64.rpm shadow-subid-devel-4.9-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2096 Important FusionOS CVE-2022-46908:SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. FusionOS sqlite-3.37.2-5.u2.fos23.x86_64.rpm sqlite-devel-3.37.2-5.u2.fos23.x86_64.rpm sqlite-help-3.37.2-5.u2.fos23.noarch.rpm sqlite-3.37.2-5.u2.fos23.aarch64.rpm sqlite-devel-3.37.2-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2097 Moderate FusionOS CVE-2023-28486:Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28487:Sudo before 1.9.13 does not escape control characters in sudoreplay output. FusionOS sudo-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u4.fos23.noarch.rpm sudo-1.9.8p2-10.u4.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2098 Moderate FusionOS CVE-2023-1801:The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. FusionOS tcpdump-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-help-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-4.99.1-6.u1.fos23.aarch64.rpm tcpdump-help-4.99.1-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2099 Moderate FusionOS CVE-2023-28708:When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. FusionOS tomcat-9.0.10-30.u5.fos23.noarch.rpm tomcat-jsvc-9.0.10-30.u5.fos23.noarch.rpm tomcat-help-9.0.10-30.u5.fos23.noarch.rpm FusionOS-SA-2023-2100 Important FusionOS CVE-2023-1108:A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. FusionOS undertow-1.4.0-4.u1.fos23.noarch.rpm undertow-javadoc-1.4.0-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2101 Moderate FusionOS CVE-2023-1264:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. FusionOS vim-common-9.0-12.u5.fos23.x86_64.rpm vim-minimal-9.0-12.u5.fos23.x86_64.rpm vim-enhanced-9.0-12.u5.fos23.x86_64.rpm vim-filesystem-9.0-12.u5.fos23.noarch.rpm vim-X11-9.0-12.u5.fos23.x86_64.rpm vim-common-9.0-12.u5.fos23.aarch64.rpm vim-minimal-9.0-12.u5.fos23.aarch64.rpm vim-enhanced-9.0-12.u5.fos23.aarch64.rpm vim-X11-9.0-12.u5.fos23.aarch64.rpm FusionOS-SA-2023-2102 Important FusionOS CVE-2023-1992:RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1993:LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1994:GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-3.u2.fos23.x86_64.rpm wireshark-devel-3.6.11-3.u2.fos23.x86_64.rpm wireshark-help-3.6.11-3.u2.fos23.x86_64.rpm wireshark-3.6.11-3.u2.fos23.aarch64.rpm wireshark-devel-3.6.11-3.u2.fos23.aarch64.rpm wireshark-help-3.6.11-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2103 Important FusionOS CVE-2023-1393:A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. FusionOS xorg-x11-server-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-source-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.aarch64.rpm FusionOS-SA-2023-2104 Important FusionOS CVE-2022-4899:A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. FusionOS zstd-1.5.0-4.u2.fos23.x86_64.rpm zstd-devel-1.5.0-4.u2.fos23.x86_64.rpm zstd-help-1.5.0-4.u2.fos23.noarch.rpm zstd-1.5.0-4.u2.fos23.aarch64.rpm zstd-devel-1.5.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2105 Moderate FusionOS CVE-2023-1729:A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash. FusionOS LibRaw-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-devel-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-0.20.2-6.u1.fos23.aarch64.rpm LibRaw-devel-0.20.2-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2106 Important FusionOS CVE-2022-3736 :BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3924:This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3094:Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1. FusionOS bind-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-license-9.16.23-14.u3.fos23.noarch.rpm bind-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-14.u3.fos23.noarch.rpm bind-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-chroot-9.16.23-14.u3.fos23.x86_64.rpm python3-bind-9.16.23-14.u3.fos23.noarch.rpm bind-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-chroot-9.16.23-14.u3.fos23.aarch64.rpm FusionOS-SA-2023-2107 Important FusionOS CVE-2023-25815:In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`. CVE-2023-29007:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. CVE-2023-25652:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. FusionOS git-2.33.0-11.u3.fos23.x86_64.rpm git-core-2.33.0-11.u3.fos23.x86_64.rpm git-daemon-2.33.0-11.u3.fos23.x86_64.rpm git-gui-2.33.0-11.u3.fos23.noarch.rpm gitk-2.33.0-11.u3.fos23.noarch.rpm git-web-2.33.0-11.u3.fos23.noarch.rpm git-svn-2.33.0-11.u3.fos23.noarch.rpm git-email-2.33.0-11.u3.fos23.noarch.rpm perl-Git-2.33.0-11.u3.fos23.noarch.rpm perl-Git-SVN-2.33.0-11.u3.fos23.noarch.rpm git-help-2.33.0-11.u3.fos23.noarch.rpm git-2.33.0-11.u3.fos23.aarch64.rpm git-core-2.33.0-11.u3.fos23.aarch64.rpm git-daemon-2.33.0-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2108 Critical FusionOS CVE-2023-29400:Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. CVE-2023-24540:Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. CVE-2023-24539:Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input. CVE-2023-24538:Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. CVE-2023-24537:Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow. CVE-2023-24536:Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=. CVE-2023-24534:HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers. CVE-2023-24532:The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh. CVE-2022-41725:A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. CVE-2022-41724:Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). CVE-2022-41723:A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. CVE-2022-41722:A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b". FusionOS golang-1.19.4-1.u2.fos23.x86_64.rpm golang-help-1.19.4-1.u2.fos23.noarch.rpm golang-devel-1.19.4-1.u2.fos23.noarch.rpm golang-1.19.4-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2109 Important FusionOS CVE-2023-1829:A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. CVE-2022-4382:A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. CVE-2023-0458:A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. CVE-2023-2269:A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2483:In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. This could lead to a use-after-free. CVE-2023-31436:qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-2176:A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. CVE-2023-2194:An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-2166:A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. CVE-2023-2007:The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. FusionOS kernel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm FusionOS-SA-2023-2110 Important FusionOS CVE-2023-28625:mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`. FusionOS mod_auth_openidc-2.4.13.2-1.fos23.x86_64.rpm mod_auth_openidc-2.4.13.2-1.fos23.aarch64.rpm FusionOS-SA-2023-2111 Critical FusionOS CVE-2022-37434:zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). FusionOS mysql-8.0.29-2.u1.fos23.x86_64.rpm mysql-libs-8.0.29-2.u1.fos23.x86_64.rpm mysql-config-8.0.29-2.u1.fos23.x86_64.rpm mysql-common-8.0.29-2.u1.fos23.x86_64.rpm mysql-errmsg-8.0.29-2.u1.fos23.x86_64.rpm mysql-server-8.0.29-2.u1.fos23.x86_64.rpm mysql-devel-8.0.29-2.u1.fos23.x86_64.rpm mysql-test-8.0.29-2.u1.fos23.x86_64.rpm mysql-help-8.0.29-2.u1.fos23.x86_64.rpm mysql-8.0.29-2.u1.fos23.aarch64.rpm mysql-libs-8.0.29-2.u1.fos23.aarch64.rpm mysql-config-8.0.29-2.u1.fos23.aarch64.rpm mysql-common-8.0.29-2.u1.fos23.aarch64.rpm mysql-errmsg-8.0.29-2.u1.fos23.aarch64.rpm mysql-server-8.0.29-2.u1.fos23.aarch64.rpm mysql-devel-8.0.29-2.u1.fos23.aarch64.rpm mysql-test-8.0.29-2.u1.fos23.aarch64.rpm mysql-help-8.0.29-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2112 Important FusionOS CVE-2023-31484:CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. FusionOS perl-5.34.0-7.u1.fos23.x86_64.rpm perl-libs-5.34.0-7.u1.fos23.x86_64.rpm perl-devel-5.34.0-7.u1.fos23.x86_64.rpm perl-help-5.34.0-7.u1.fos23.noarch.rpm perl-5.34.0-7.u1.fos23.aarch64.rpm perl-libs-5.34.0-7.u1.fos23.aarch64.rpm perl-devel-5.34.0-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2113 Important FusionOS CVE-2022-38023:Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-37966:Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability CVE-2022-37967:Windows Kerberos Elevation of Privilege Vulnerability FusionOS samba-4.17.5-2.fos23.x86_64.rpm samba-libs-4.17.5-2.fos23.x86_64.rpm samba-client-4.17.5-2.fos23.x86_64.rpm samba-common-4.17.5-2.fos23.x86_64.rpm samba-common-tools-4.17.5-2.fos23.x86_64.rpm samba-dc-4.17.5-2.fos23.x86_64.rpm samba-dc-provision-4.17.5-2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.x86_64.rpm samba-devel-4.17.5-2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-2.fos23.x86_64.rpm libsmbclient-4.17.5-2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-2.fos23.x86_64.rpm libwbclient-4.17.5-2.fos23.x86_64.rpm libwbclient-devel-4.17.5-2.fos23.x86_64.rpm python3-samba-4.17.5-2.fos23.x86_64.rpm python3-samba-test-4.17.5-2.fos23.x86_64.rpm python3-samba-dc-4.17.5-2.fos23.x86_64.rpm samba-pidl-4.17.5-2.fos23.noarch.rpm samba-test-4.17.5-2.fos23.x86_64.rpm samba-usershares-4.17.5-2.fos23.x86_64.rpm samba-winbind-4.17.5-2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-2.fos23.x86_64.rpm ctdb-4.17.5-2.fos23.x86_64.rpm samba-help-4.17.5-2.fos23.x86_64.rpm samba-4.17.5-2.fos23.aarch64.rpm samba-libs-4.17.5-2.fos23.aarch64.rpm samba-client-4.17.5-2.fos23.aarch64.rpm samba-common-4.17.5-2.fos23.aarch64.rpm samba-common-tools-4.17.5-2.fos23.aarch64.rpm samba-dc-4.17.5-2.fos23.aarch64.rpm samba-dc-provision-4.17.5-2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.aarch64.rpm samba-devel-4.17.5-2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-2.fos23.aarch64.rpm libsmbclient-4.17.5-2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-2.fos23.aarch64.rpm libwbclient-4.17.5-2.fos23.aarch64.rpm libwbclient-devel-4.17.5-2.fos23.aarch64.rpm python3-samba-4.17.5-2.fos23.aarch64.rpm python3-samba-test-4.17.5-2.fos23.aarch64.rpm python3-samba-dc-4.17.5-2.fos23.aarch64.rpm samba-test-4.17.5-2.fos23.aarch64.rpm samba-usershares-4.17.5-2.fos23.aarch64.rpm samba-winbind-4.17.5-2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-2.fos23.aarch64.rpm ctdb-4.17.5-2.fos23.aarch64.rpm samba-help-4.17.5-2.fos23.aarch64.rpm FusionOS-SA-2023-2114 Important FusionOS CVE-2023-34151:A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). CVE-2023-34153:A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. FusionOS ImageMagick-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2115 Important FusionOS CVE-2023-31130:c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. CVE-2023-32067:c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. CVE-2023-31124:c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. CVE-2023-31147:c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. FusionOS c-ares-1.18.1-7.u3.fos23.x86_64.rpm c-ares-devel-1.18.1-7.u3.fos23.x86_64.rpm c-ares-help-1.18.1-7.u3.fos23.noarch.rpm c-ares-1.18.1-7.u3.fos23.aarch64.rpm c-ares-devel-1.18.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2116 Moderate FusionOS CVE-2022-2084:Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. CVE-2023-1786:Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. FusionOS cloud-init-21.4-16.u8.fos23.noarch.rpm cloud-init-help-21.4-16.u8.fos23.noarch.rpm FusionOS-SA-2023-2117 Low FusionOS CVE-2015-1197:cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. FusionOS cpio-2.13-8.u1.fos23.x86_64.rpm cpio-help-2.13-8.u1.fos23.noarch.rpm cpio-2.13-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2118 Moderate FusionOS CVE-2023-32324:OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. FusionOS cups-2.4.0-7.u2.fos23.x86_64.rpm cups-client-2.4.0-7.u2.fos23.x86_64.rpm cups-devel-2.4.0-7.u2.fos23.x86_64.rpm cups-libs-2.4.0-7.u2.fos23.x86_64.rpm cups-filesystem-2.4.0-7.u2.fos23.noarch.rpm cups-lpd-2.4.0-7.u2.fos23.x86_64.rpm cups-ipptool-2.4.0-7.u2.fos23.x86_64.rpm cups-printerapp-2.4.0-7.u2.fos23.x86_64.rpm cups-help-2.4.0-7.u2.fos23.noarch.rpm cups-2.4.0-7.u2.fos23.aarch64.rpm cups-client-2.4.0-7.u2.fos23.aarch64.rpm cups-devel-2.4.0-7.u2.fos23.aarch64.rpm cups-libs-2.4.0-7.u2.fos23.aarch64.rpm cups-lpd-2.4.0-7.u2.fos23.aarch64.rpm cups-ipptool-2.4.0-7.u2.fos23.aarch64.rpm cups-printerapp-2.4.0-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2119 Important FusionOS CVE-2023-24805:cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. FusionOS cups-filters-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-devel-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-help-1.28.9-3.u1.fos23.noarch.rpm cups-filters-1.28.9-3.u1.fos23.aarch64.rpm cups-filters-devel-1.28.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2120 Moderate FusionOS CVE-2023-28322:An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. CVE-2023-28320:A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. CVE-2023-28321:An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. FusionOS curl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-devel-7.79.1-19.u9.fos23.x86_64.rpm curl-help-7.79.1-19.u9.fos23.noarch.rpm curl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-devel-7.79.1-19.u9.fos23.aarch64.rpm FusionOS-SA-2023-2121 Critical FusionOS CVE-2023-28879:In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. FusionOS ghostscript-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-devel-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-help-9.55.0-2.u1.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-devel-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2122 Important FusionOS CVE-2022-42003:In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CVE-2020-36518:jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. FusionOS jackson-databind-2.9.8-9.u3.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u3.fos23.noarch.rpm FusionOS-SA-2023-2123 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2124 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-11-openjdk-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.aarch64.rpm FusionOS-SA-2023-2125 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-17-openjdk-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2126 Important FusionOS CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2022-45693:Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. CVE-2022-40149:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. FusionOS jettison-1.3.7-1.u2.fos23.noarch.rpm jettison-javadoc-1.3.7-1.u2.fos23.noarch.rpm FusionOS-SA-2023-2127 Important FusionOS CVE-2023-3141:A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-22998:In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). CVE-2023-34256:An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. CVE-2022-48502:An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. CVE-2023-25012:The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. CVE-2023-2985:A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-3111:A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2022-1015:A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2023-2124:An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-32269:An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. CVE-2023-2002:A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. CVE-2023-26544:In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. CVE-2023-0459:Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. FusionOS kernel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm FusionOS-SA-2023-2128 Low FusionOS CVE-2023-2602:A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. CVE-2023-2603:A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. FusionOS libcap-2.61-5.u1.fos23.x86_64.rpm libcap-devel-2.61-5.u1.fos23.x86_64.rpm libcap-help-2.61-5.u1.fos23.noarch.rpm libcap-2.61-5.u1.fos23.aarch64.rpm libcap-devel-2.61-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2129 Important FusionOS CVE-2023-30570:pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. FusionOS libreswan-4.11-1.u1.fos23.x86_64.rpm libreswan-help-4.11-1.u1.fos23.x86_64.rpm libreswan-4.11-1.u1.fos23.aarch64.rpm libreswan-help-4.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2130 Moderate FusionOS CVE-2023-1667:A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-2283:A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. FusionOS libssh-0.9.6-7.u2.fos23.x86_64.rpm libssh-devel-0.9.6-7.u2.fos23.x86_64.rpm libssh-help-0.9.6-7.u2.fos23.noarch.rpm libssh-0.9.6-7.u2.fos23.aarch64.rpm libssh-devel-0.9.6-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2131 Moderate FusionOS CVE-2023-1916:A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. CVE-2023-2731:A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service. FusionOS libtiff-4.3.0-25.u4.fos23.x86_64.rpm libtiff-devel-4.3.0-25.u4.fos23.x86_64.rpm libtiff-static-4.3.0-25.u4.fos23.x86_64.rpm libtiff-tools-4.3.0-25.u4.fos23.x86_64.rpm libtiff-help-4.3.0-25.u4.fos23.noarch.rpm libtiff-4.3.0-25.u4.fos23.aarch64.rpm libtiff-devel-4.3.0-25.u4.fos23.aarch64.rpm libtiff-static-4.3.0-25.u4.fos23.aarch64.rpm libtiff-tools-4.3.0-25.u4.fos23.aarch64.rpm FusionOS-SA-2023-2132 Important FusionOS CVE-2023-1017:An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. CVE-2023-1018:An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. FusionOS libtpms-0.7.3-8.u1.fos23.x86_64.rpm libtpms-devel-0.7.3-8.u1.fos23.x86_64.rpm libtpms-0.7.3-8.u1.fos23.aarch64.rpm libtpms-devel-0.7.3-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2133 Moderate FusionOS CVE-2023-1999:There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. FusionOS libwebp-1.2.1-3.u1.fos23.x86_64.rpm libwebp-tools-1.2.1-3.u1.fos23.x86_64.rpm libwebp-devel-1.2.1-3.u1.fos23.x86_64.rpm libwebp-java-1.2.1-3.u1.fos23.x86_64.rpm libwebp-help-1.2.1-3.u1.fos23.noarch.rpm libwebp-1.2.1-3.u1.fos23.aarch64.rpm libwebp-tools-1.2.1-3.u1.fos23.aarch64.rpm libwebp-devel-1.2.1-3.u1.fos23.aarch64.rpm libwebp-java-1.2.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2134 Critical FusionOS CVE-2018-16487:A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype. CVE-2018-3721:lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects. CVE-2019-10744:Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. CVE-2020-8203:Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. FusionOS lodash-3.10.1-1.u1.fos23.noarch.rpm js-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-node-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cli-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-add-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-after-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraycopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayevery-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayfilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraymap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ary-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-assign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-at-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-attempt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseassign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseclone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecompareascending-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecreate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedelay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedifference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefindindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseflatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseforright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefunctions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseget-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseisequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basepullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baserandom-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basereduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseslice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basetostring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseuniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basevalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-before-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindcallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cacheindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-callback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-camelcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-capitalize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ceil-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-chunk-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clonedeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compact-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-constant-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-countby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-create-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createaggregator-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createassigner-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcache-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcompounder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createpadding-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createwrapper-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curry-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curryright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-debounce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-deburr-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaults-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaultsdeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defer-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-delay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-difference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-drop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-droprightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-endswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escaperegexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-every-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-fill-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-filter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-find-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlast-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findwhere-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-first-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flattendeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-floor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flow-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flowright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forinright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forown-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forownright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-functions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-get-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-getnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-groupby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-has-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-identity-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-includes-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-initial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-inrange-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-intersection-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invert-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invoke-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invokepath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarguments-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isboolean-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isdate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iselement-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isempty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iserror-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfinite-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfunction-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isiterateecall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnan-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnumber-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isregexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isstring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-istypedarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isundefined-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-kebabcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keysin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-last-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lastindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-map-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapkeys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapvalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-max-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-memoize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-merge-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-method-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-methodof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-min-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mixin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-modargs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-negate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-noop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-now-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-omit-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-once-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pad-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pairs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-parseint-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partialright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partition-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pick-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbyarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbycallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pluck-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-property-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-propertyof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-random-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-range-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rearg-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduceright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reevaluate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reinterpolate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-remove-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-repeat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-replaceholders-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rest-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-restparam-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-result-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-round-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sample-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-set-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-shuffle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-size-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-slice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-snakecase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-some-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-spread-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sum-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-support-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-take-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takeright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takerightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takewhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-template-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-templatesettings-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-throttle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-times-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toiterable-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-topath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-transform-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trim-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trunc-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-union-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniqueid-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzipwith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-values-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-valuesin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-where-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-without-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-words-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-wrap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-xor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipwith-3.10.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2135 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-help-4.0.3-2022102419.u6.fos23.noarch.rpm lxc-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.aarch64.rpm FusionOS-SA-2023-2136 Important FusionOS CVE-2019-16869:Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. FusionOS netty3-3.10.6-6.u1.fos23.noarch.rpm FusionOS-SA-2023-2137 Moderate FusionOS CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26552:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26553:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26554:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26555:praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. FusionOS ntp-4.2.8p15-10.u2.fos23.x86_64.rpm ntp-perl-4.2.8p15-10.u2.fos23.noarch.rpm ntp-help-4.2.8p15-10.u2.fos23.noarch.rpm ntp-4.2.8p15-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2138 Important FusionOS CVE-2023-2953:A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. FusionOS openldap-2.6.0-6.u2.fos23.x86_64.rpm openldap-devel-2.6.0-6.u2.fos23.x86_64.rpm openldap-servers-2.6.0-6.u2.fos23.x86_64.rpm openldap-clients-2.6.0-6.u2.fos23.x86_64.rpm openldap-help-2.6.0-6.u2.fos23.noarch.rpm openldap-2.6.0-6.u2.fos23.aarch64.rpm openldap-devel-2.6.0-6.u2.fos23.aarch64.rpm openldap-servers-2.6.0-6.u2.fos23.aarch64.rpm openldap-clients-2.6.0-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2139 Important FusionOS CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. FusionOS openssl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-libs-1.1.1m-22.u7.fos23.x86_64.rpm openssl-perl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-devel-1.1.1m-22.u7.fos23.x86_64.rpm openssl-help-1.1.1m-22.u7.fos23.noarch.rpm openssl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-libs-1.1.1m-22.u7.fos23.aarch64.rpm openssl-perl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-devel-1.1.1m-22.u7.fos23.aarch64.rpm FusionOS-SA-2023-2140 Important FusionOS CVE-2023-30861:Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. FusionOS python3-flask-2.1.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2141 Moderate FusionOS CVE-2023-33733:Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval. FusionOS python3-reportlab-3.6.10-1.u1.fos23.x86_64.rpm python-reportlab-help-3.6.10-1.u1.fos23.noarch.rpm python3-reportlab-3.6.10-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2142 Moderate FusionOS CVE-2023-32681:Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. FusionOS python3-requests-2.26.0-8.u2.fos23.noarch.rpm python-requests-help-2.26.0-8.u2.fos23.noarch.rpm FusionOS-SA-2023-2143 Important FusionOS CVE-2023-32762:An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. ,CVE-2023-32763:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. CVE-2023-24607:Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. FusionOS qt5-qtbase-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-6.u2.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2144 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis5-5.0.7-5.u2.fos23.x86_64.rpm redis5-devel-5.0.7-5.u2.fos23.x86_64.rpm redis5-doc-5.0.7-5.u2.fos23.noarch.rpm redis5-5.0.7-5.u2.fos23.aarch64.rpm redis5-devel-5.0.7-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2145 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis6-6.2.7-2.u2.fos23.x86_64.rpm redis6-devel-6.2.7-2.u2.fos23.x86_64.rpm redis6-doc-6.2.7-2.u2.fos23.noarch.rpm redis6-6.2.7-2.u2.fos23.aarch64.rpm redis6-devel-6.2.7-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2146 Moderate FusionOS CVE-2018-14628:An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. FusionOS samba-4.17.5-3.u2.fos23.x86_64.rpm samba-libs-4.17.5-3.u2.fos23.x86_64.rpm samba-client-4.17.5-3.u2.fos23.x86_64.rpm samba-common-4.17.5-3.u2.fos23.x86_64.rpm samba-common-tools-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-provision-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.x86_64.rpm samba-devel-4.17.5-3.u2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-3.u2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-test-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-pidl-4.17.5-3.u2.fos23.noarch.rpm samba-test-4.17.5-3.u2.fos23.x86_64.rpm samba-usershares-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.x86_64.rpm ctdb-4.17.5-3.u2.fos23.x86_64.rpm samba-help-4.17.5-3.u2.fos23.x86_64.rpm samba-4.17.5-3.u2.fos23.aarch64.rpm samba-libs-4.17.5-3.u2.fos23.aarch64.rpm samba-client-4.17.5-3.u2.fos23.aarch64.rpm samba-common-4.17.5-3.u2.fos23.aarch64.rpm samba-common-tools-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-provision-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.aarch64.rpm samba-devel-4.17.5-3.u2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-test-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-test-4.17.5-3.u2.fos23.aarch64.rpm samba-usershares-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.aarch64.rpm ctdb-4.17.5-3.u2.fos23.aarch64.rpm samba-help-4.17.5-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2147 Important FusionOS CVE-2023-33204:sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. FusionOS sysstat-12.5.4-8.u2.fos23.x86_64.rpm sysstat-12.5.4-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2148 Moderate FusionOS CVE-2022-0563:A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. FusionOS util-linux-2.37.2-19.u6.fos23.x86_64.rpm libfdisk-2.37.2-19.u6.fos23.x86_64.rpm libsmartcols-2.37.2-19.u6.fos23.x86_64.rpm libmount-2.37.2-19.u6.fos23.x86_64.rpm libblkid-2.37.2-19.u6.fos23.x86_64.rpm uuidd-2.37.2-19.u6.fos23.x86_64.rpm libuuid-2.37.2-19.u6.fos23.x86_64.rpm util-linux-user-2.37.2-19.u6.fos23.x86_64.rpm python3-libmount-2.37.2-19.u6.fos23.x86_64.rpm util-linux-devel-2.37.2-19.u6.fos23.x86_64.rpm util-linux-help-2.37.2-19.u6.fos23.noarch.rpm util-linux-2.37.2-19.u6.fos23.aarch64.rpm libfdisk-2.37.2-19.u6.fos23.aarch64.rpm libsmartcols-2.37.2-19.u6.fos23.aarch64.rpm libmount-2.37.2-19.u6.fos23.aarch64.rpm libblkid-2.37.2-19.u6.fos23.aarch64.rpm uuidd-2.37.2-19.u6.fos23.aarch64.rpm libuuid-2.37.2-19.u6.fos23.aarch64.rpm util-linux-user-2.37.2-19.u6.fos23.aarch64.rpm python3-libmount-2.37.2-19.u6.fos23.aarch64.rpm util-linux-devel-2.37.2-19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2149 Important FusionOS CVE-2023-2609:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2610:Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. FusionOS vim-common-9.0-15.u8.fos23.x86_64.rpm vim-minimal-9.0-15.u8.fos23.x86_64.rpm vim-enhanced-9.0-15.u8.fos23.x86_64.rpm vim-filesystem-9.0-15.u8.fos23.noarch.rpm vim-X11-9.0-15.u8.fos23.x86_64.rpm vim-common-9.0-15.u8.fos23.aarch64.rpm vim-minimal-9.0-15.u8.fos23.aarch64.rpm vim-enhanced-9.0-15.u8.fos23.aarch64.rpm vim-X11-9.0-15.u8.fos23.aarch64.rpm FusionOS-SA-2023-2150 Important FusionOS CVE-2023-28204:A flaw was found in the webkitgtk package. An out of bounds read may be possible when processing malicious web content, which can lead to information disclosure. CVE-2023-32373:A use after free vulnerability was found in the webkitgtk package. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2023-32409:A flaw was found in the WebGPU, part of the Webkit project. This flaw allows a remote attacker to break out of the Web Content sandbox. FusionOS webkit2gtk3-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2151 Important FusionOS CVE-2023-0668:Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. CVE-2023-2855:Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2856:VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2857:BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2858:NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2879:GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-4.u3.fos23.x86_64.rpm wireshark-devel-3.6.11-4.u3.fos23.x86_64.rpm wireshark-help-3.6.11-4.u3.fos23.x86_64.rpm wireshark-3.6.11-4.u3.fos23.aarch64.rpm wireshark-devel-3.6.11-4.u3.fos23.aarch64.rpm wireshark-help-3.6.11-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2152 Important FusionOS CVE-2022-3550:A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. FusionOS xorg-x11-server-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-source-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.aarch64.rpm FusionOS-SA-2023-2153 Critical FusionOS CVE-2021-33454:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c. CVE-2021-33455:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33456:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33457:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33458:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33459:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. CVE-2021-33460:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33461:An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c. CVE-2021-33462:An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c. CVE-2021-33463:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c. CVE-2021-33464:An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33465:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33466:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33467:An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33468:An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c. CVE-2023-30402:yasm v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re CVE-2023-31972:yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. CVE-2023-31973:yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. CVE-2023-31974:yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. CVE-2023-31975:yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. FusionOS yasm-1.3.0-10.u1.fos23.x86_64.rpm yasm-1.3.0-10.u1.fos23.aarch64.rpm FusionOS-SA-2023-2154 Important FusionOS CVE-2022-35737:SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. FusionOS perl-DBD-SQLite-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-1.70-2.u1.fos23.aarch64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2155 Important FusionOS CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). FusionOS shim-15.6-9.u6.fos23.x86_64.rpm shim-15.6-9.u6.fos23.aarch64.rpm FusionOS-SA-2023-2156 Critical FusionOS CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. FusionOS syslinux-6.04-13.u1.fos23.x86_64.rpm syslinux-perl-6.04-13.u1.fos23.x86_64.rpm syslinux-devel-6.04-13.u1.fos23.x86_64.rpm syslinux-extlinux-6.04-13.u1.fos23.x86_64.rpm syslinux-tftpboot-6.04-13.u1.fos23.noarch.rpm syslinux-extlinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-efi64-6.04-13.u1.fos23.x86_64.rpm