FusionOS-SA-2023-2001 Moderate FusionOS CVE-2022-44267:ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input. CVE-2022-44268:ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it). FusionOS ImageMagick-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.x86_64.rpm ImageMagick-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-help-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.0.28-6.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.0.28-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2002 Important FusionOS CVE-2022-4743:A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected. FusionOS SDL2-2.0.12-5.u1.fos23.x86_64.rpm SDL2-devel-2.0.12-5.u1.fos23.x86_64.rpm SDL2-static-2.0.12-5.u1.fos23.x86_64.rpm SDL2-2.0.12-5.u1.fos23.aarch64.rpm SDL2-devel-2.0.12-5.u1.fos23.aarch64.rpm SDL2-static-2.0.12-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2003 Moderate FusionOS CVE-2022-37704:Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure. CVE-2022-37705:A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program, which is a wrapper to run /usr/bin/tar with specific arguments that are controllable by the attacker. This program mishandles the arguments passed to tar binary (it expects that the argument name and value are separated with a space; however, separating them with an equals sign is also supported), FusionOS amanda-3.5.1-23.u2.fos23.x86_64.rpm amanda-help-3.5.1-23.u2.fos23.noarch.rpm amanda-3.5.1-23.u2.fos23.aarch64.rpm FusionOS-SA-2023-2004 Important FusionOS CVE-2023-24998:Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured. FusionOS apache-commons-fileupload-1.4-2.u1.fos23.noarch.rpm apache-commons-fileupload-help-1.4-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2005 Critical FusionOS CVE-2022-24963:Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0. FusionOS apr-1.7.0-6.u1.fos23.x86_64.rpm apr-devel-1.7.0-6.u1.fos23.x86_64.rpm apr-help-1.7.0-6.u1.fos23.noarch.rpm apr-1.7.0-6.u1.fos23.aarch64.rpm apr-devel-1.7.0-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2006 Critical FusionOS CVE-2022-25147:Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. FusionOS apr-util-1.6.1-14.u1.fos23.x86_64.rpm apr-util-devel-1.6.1-14.u1.fos23.x86_64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.x86_64.rpm apr-util-odbc-1.6.1-14.u1.fos23.x86_64.rpm apr-util-1.6.1-14.u1.fos23.aarch64.rpm apr-util-devel-1.6.1-14.u1.fos23.aarch64.rpm apr-util-pgsql-1.6.1-14.u1.fos23.aarch64.rpm apr-util-odbc-1.6.1-14.u1.fos23.aarch64.rpm FusionOS-SA-2023-2007 Important FusionOS CVE-2022-41704:A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16. CVE-2022-42890:A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16. FusionOS batik-1.10-8.u1.fos23.noarch.rpm batik-help-1.10-8.u1.fos23.noarch.rpm FusionOS-SA-2023-2008 Critical FusionOS CVE-2021-33641:When processing files, malloc stores the data of the current line. When processing comments, malloc incorrectly accesses the released memory (use after free). CVE-2021-33642:When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function. FusionOS byacc-2.0.20210808-4.u1.fos23.x86_64.rpm byacc-help-2.0.20210808-4.u1.fos23.noarch.rpm byacc-2.0.20210808-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2009 Moderate FusionOS CVE-2022-4904:A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity. FusionOS c-ares-1.18.1-5.u2.fos23.x86_64.rpm c-ares-devel-1.18.1-5.u2.fos23.x86_64.rpm c-ares-help-1.18.1-5.u2.fos23.noarch.rpm c-ares-1.18.1-5.u2.fos23.aarch64.rpm c-ares-devel-1.18.1-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2010 Important FusionOS CVE-2022-3650:A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. FusionOS ceph-16.2.7-14.u6.fos23.x86_64.rpm ceph-base-16.2.7-14.u6.fos23.x86_64.rpm cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-mds-16.2.7-14.u6.fos23.x86_64.rpm ceph-mon-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-16.2.7-14.u6.fos23.x86_64.rpm ceph-mgr-dashboard-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-diskprediction-local-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-modules-core-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-rook-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-k8sevents-16.2.7-14.u6.fos23.noarch.rpm ceph-mgr-cephadm-16.2.7-14.u6.fos23.noarch.rpm ceph-fuse-16.2.7-14.u6.fos23.x86_64.rpm cephfs-mirror-16.2.7-14.u6.fos23.x86_64.rpm rbd-fuse-16.2.7-14.u6.fos23.x86_64.rpm rbd-mirror-16.2.7-14.u6.fos23.x86_64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.x86_64.rpm rbd-nbd-16.2.7-14.u6.fos23.x86_64.rpm ceph-radosgw-16.2.7-14.u6.fos23.x86_64.rpm cephfs-top-16.2.7-14.u6.fos23.noarch.rpm ceph-osd-16.2.7-14.u6.fos23.x86_64.rpm librados2-16.2.7-14.u6.fos23.x86_64.rpm librados-devel-16.2.7-14.u6.fos23.x86_64.rpm libradospp-devel-16.2.7-14.u6.fos23.x86_64.rpm librgw2-16.2.7-14.u6.fos23.x86_64.rpm librgw-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rgw-16.2.7-14.u6.fos23.x86_64.rpm python3-rados-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-16.2.7-14.u6.fos23.x86_64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.x86_64.rpm librbd1-16.2.7-14.u6.fos23.x86_64.rpm librbd-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-rbd-16.2.7-14.u6.fos23.x86_64.rpm libcephfs2-16.2.7-14.u6.fos23.x86_64.rpm libcephfs-devel-16.2.7-14.u6.fos23.x86_64.rpm python3-cephfs-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.x86_64.rpm python3-ceph-common-16.2.7-14.u6.fos23.x86_64.rpm ceph-test-16.2.7-14.u6.fos23.x86_64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.x86_64.rpm ceph-grafana-dashboards-16.2.7-14.u6.fos23.noarch.rpm ceph-prometheus-alerts-16.2.7-14.u6.fos23.noarch.rpm ceph-16.2.7-14.u6.fos23.aarch64.rpm ceph-base-16.2.7-14.u6.fos23.aarch64.rpm ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-mds-16.2.7-14.u6.fos23.aarch64.rpm ceph-mon-16.2.7-14.u6.fos23.aarch64.rpm ceph-mgr-16.2.7-14.u6.fos23.aarch64.rpm ceph-fuse-16.2.7-14.u6.fos23.aarch64.rpm cephfs-mirror-16.2.7-14.u6.fos23.aarch64.rpm rbd-fuse-16.2.7-14.u6.fos23.aarch64.rpm rbd-mirror-16.2.7-14.u6.fos23.aarch64.rpm ceph-immutable-object-cache-16.2.7-14.u6.fos23.aarch64.rpm rbd-nbd-16.2.7-14.u6.fos23.aarch64.rpm ceph-radosgw-16.2.7-14.u6.fos23.aarch64.rpm ceph-osd-16.2.7-14.u6.fos23.aarch64.rpm librados2-16.2.7-14.u6.fos23.aarch64.rpm librados-devel-16.2.7-14.u6.fos23.aarch64.rpm libradospp-devel-16.2.7-14.u6.fos23.aarch64.rpm librgw2-16.2.7-14.u6.fos23.aarch64.rpm librgw-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rgw-16.2.7-14.u6.fos23.aarch64.rpm python3-rados-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-16.2.7-14.u6.fos23.aarch64.rpm libcephsqlite-devel-16.2.7-14.u6.fos23.aarch64.rpm librbd1-16.2.7-14.u6.fos23.aarch64.rpm librbd-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-rbd-16.2.7-14.u6.fos23.aarch64.rpm libcephfs2-16.2.7-14.u6.fos23.aarch64.rpm libcephfs-devel-16.2.7-14.u6.fos23.aarch64.rpm python3-cephfs-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-argparse-16.2.7-14.u6.fos23.aarch64.rpm python3-ceph-common-16.2.7-14.u6.fos23.aarch64.rpm ceph-test-16.2.7-14.u6.fos23.aarch64.rpm rados-objclass-devel-16.2.7-14.u6.fos23.aarch64.rpm FusionOS-SA-2023-2011 Critical FusionOS CVE-2023-20032:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to execute arbitrary code. This vulnerability is due to a missing buffer size check that may result in a heap buffer overflow write. An attacker could exploit this vulnerability by submitting a crafted HFS+ partition file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the ClamAV scanning process, or else crash the process, resulting in a denial of service (DoS) condition. For a description of this vulnerability, see the ClamAV blog ["https://blog.clamav.net/"]. CVE-2023-20052:On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability is due to enabling XML entity substitution that may result in XML external entity injection. An attacker could exploit this vulnerability by submitting a crafted DMG file to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to leak bytes from any file that may be read by the ClamAV scanning process. FusionOS clamav-0.103.8-1.fos23.x86_64.rpm clamav-devel-0.103.8-1.fos23.x86_64.rpm clamav-help-0.103.8-1.fos23.x86_64.rpm clamav-filesystem-0.103.8-1.fos23.noarch.rpm clamav-data-0.103.8-1.fos23.noarch.rpm clamav-update-0.103.8-1.fos23.x86_64.rpm clamd-0.103.8-1.fos23.x86_64.rpm clamav-milter-0.103.8-1.fos23.x86_64.rpm clamav-0.103.8-1.fos23.aarch64.rpm clamav-devel-0.103.8-1.fos23.aarch64.rpm clamav-help-0.103.8-1.fos23.aarch64.rpm clamav-update-0.103.8-1.fos23.aarch64.rpm clamd-0.103.8-1.fos23.aarch64.rpm clamav-milter-0.103.8-1.fos23.aarch64.rpm FusionOS-SA-2023-2012 Important FusionOS CVE-2022-23471:containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Users unable to upgrade should ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. CVE-2023-25153:containerd is an open source container runtime. Before versions 1.6.18 and 1.5.18, when importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. CVE-2023-25173:containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups. FusionOS containerd-1.6.9-1.u3.fos23.x86_64.rpm containerd-stress-1.6.9-1.u3.fos23.x86_64.rpm containerd-1.6.9-1.u3.fos23.aarch64.rpm containerd-stress-1.6.9-1.u3.fos23.aarch64.rpm FusionOS-SA-2023-2013 Moderate FusionOS CVE-2021-4122:It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium. FusionOS cryptsetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.x86_64.rpm veritysetup-2.4.1-4.u2.fos23.x86_64.rpm integritysetup-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.x86_64.rpm cryptsetup-help-2.4.1-4.u2.fos23.noarch.rpm cryptsetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-devel-2.4.1-4.u2.fos23.aarch64.rpm veritysetup-2.4.1-4.u2.fos23.aarch64.rpm integritysetup-2.4.1-4.u2.fos23.aarch64.rpm cryptsetup-reencrypt-2.4.1-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2014 Important FusionOS CVE-2022-43551:A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. CVE-2022-43552:A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path. CVE-2023-23914:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on. CVE-2023-23915:A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS. CVE-2023-23916:An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable "links" in this "decompression chain" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a "malloc bomb", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors. FusionOS curl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-7.79.1-14.u4.fos23.x86_64.rpm libcurl-devel-7.79.1-14.u4.fos23.x86_64.rpm curl-help-7.79.1-14.u4.fos23.noarch.rpm curl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-7.79.1-14.u4.fos23.aarch64.rpm libcurl-devel-7.79.1-14.u4.fos23.aarch64.rpm FusionOS-SA-2023-2015 Important FusionOS CVE-2023-0401:A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider. PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data. FusionOS edk2-devel-202011-11.u1.fos23.x86_64.rpm python3-edk2-devel-202011-11.u1.fos23.noarch.rpm edk2-help-202011-11.u1.fos23.noarch.rpm edk2-ovmf-202011-11.u1.fos23.noarch.rpm edk2-devel-202011-11.u1.fos23.aarch64.rpm FusionOS-SA-2023-2016 Important FusionOS CVE-2022-48337:GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input. CVE-2022-48338:An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed. FusionOS emacs-27.2-9.u1.fos23.x86_64.rpm emacs-devel-27.2-9.u1.fos23.x86_64.rpm emacs-lucid-27.2-9.u1.fos23.x86_64.rpm emacs-nox-27.2-9.u1.fos23.x86_64.rpm emacs-common-27.2-9.u1.fos23.x86_64.rpm emacs-terminal-27.2-9.u1.fos23.noarch.rpm emacs-filesystem-27.2-9.u1.fos23.noarch.rpm emacs-help-27.2-9.u1.fos23.noarch.rpm emacs-27.2-9.u1.fos23.aarch64.rpm emacs-devel-27.2-9.u1.fos23.aarch64.rpm emacs-lucid-27.2-9.u1.fos23.aarch64.rpm emacs-nox-27.2-9.u1.fos23.aarch64.rpm emacs-common-27.2-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2017 Important FusionOS CVE-2022-40899:An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server. FusionOS python3-future-0.18.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2018 Critical FusionOS CVE-2023-22490:Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs. CVE-2023-23946:Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link. CVE-2022-41903:Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`. CVE-2022-23521:Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2022-41953:Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GUI has a function to clone repositories. Immediately after the local clone is available, Git GUI will automatically post-process it, among other things running a spell checker called `aspell.exe` if it was found. Git GUI is implemented as a Tcl/Tk script. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable _always includes the current directory_. Therefore, malicious repositories can ship with an `aspell.exe` in their top-level directory which is executed by Git GUI without giving the user a chance to inspect it first, i.e. running untrusted code. This issue has been addressed in version 2.39.1. Users are advised to upgrade. Users unable to upgrade should avoid using Git GUI for cloning. If that is not a viable option, at least avoid cloning from untrusted sources. FusionOS git-2.33.0-9.u2.fos23.x86_64.rpm git-core-2.33.0-9.u2.fos23.x86_64.rpm git-daemon-2.33.0-9.u2.fos23.x86_64.rpm git-gui-2.33.0-9.u2.fos23.noarch.rpm gitk-2.33.0-9.u2.fos23.noarch.rpm git-web-2.33.0-9.u2.fos23.noarch.rpm git-svn-2.33.0-9.u2.fos23.noarch.rpm git-email-2.33.0-9.u2.fos23.noarch.rpm perl-Git-2.33.0-9.u2.fos23.noarch.rpm perl-Git-SVN-2.33.0-9.u2.fos23.noarch.rpm git-help-2.33.0-9.u2.fos23.noarch.rpm git-2.33.0-9.u2.fos23.aarch64.rpm git-core-2.33.0-9.u2.fos23.aarch64.rpm git-daemon-2.33.0-9.u2.fos23.aarch64.rpm FusionOS-SA-2023-2019 Critical FusionOS CVE-2023-0687:** DISPUTED ** A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function __monstartup of the file gmon.c of the component Call Graph Monitor. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. VDB-220246 is the identifier assigned to this vulnerability. NOTE: The real existence of this vulnerability is still doubted at the moment. The inputs that induce this vulnerability are basically addresses of the running application that is built with gmon enabled. It's basically trusted input or input that needs an actual security flaw to be compromised or controlled. FusionOS glibc-2.34-113.u11.fos23.x86_64.rpm glibc-common-2.34-113.u11.fos23.x86_64.rpm glibc-all-langpacks-2.34-113.u11.fos23.x86_64.rpm glibc-locale-source-2.34-113.u11.fos23.x86_64.rpm glibc-locale-archive-2.34-113.u11.fos23.x86_64.rpm glibc-devel-2.34-113.u11.fos23.x86_64.rpm nscd-2.34-113.u11.fos23.x86_64.rpm nss_modules-2.34-113.u11.fos23.x86_64.rpm glibc-nss-devel-2.34-113.u11.fos23.x86_64.rpm libnsl-2.34-113.u11.fos23.x86_64.rpm glibc-debugutils-2.34-113.u11.fos23.x86_64.rpm glibc-help-2.34-113.u11.fos23.noarch.rpm glibc-compat-2.17-2.34-113.u11.fos23.x86_64.rpm glibc-2.34-113.u11.fos23.aarch64.rpm glibc-common-2.34-113.u11.fos23.aarch64.rpm glibc-all-langpacks-2.34-113.u11.fos23.aarch64.rpm glibc-locale-source-2.34-113.u11.fos23.aarch64.rpm glibc-locale-archive-2.34-113.u11.fos23.aarch64.rpm glibc-devel-2.34-113.u11.fos23.aarch64.rpm nscd-2.34-113.u11.fos23.aarch64.rpm nss_modules-2.34-113.u11.fos23.aarch64.rpm glibc-nss-devel-2.34-113.u11.fos23.aarch64.rpm libnsl-2.34-113.u11.fos23.aarch64.rpm glibc-debugutils-2.34-113.u11.fos23.aarch64.rpm glibc-compat-2.17-2.34-113.u11.fos23.aarch64.rpm FusionOS-SA-2023-2020 Important FusionOS CVE-2021-43618:GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms. FusionOS gmp-6.2.1-2.u1.fos23.x86_64.rpm gmp-devel-6.2.1-2.u1.fos23.x86_64.rpm gmp-c++-6.2.1-2.u1.fos23.x86_64.rpm gmp-6.2.1-2.u1.fos23.aarch64.rpm gmp-devel-6.2.1-2.u1.fos23.aarch64.rpm gmp-c++-6.2.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2021 Critical FusionOS CVE-2021-44716:net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. CVE-2022-23772:Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. CVE-2022-23773:cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags. CVE-2022-23806:Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element. CVE-2022-24921:regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression. CVE-2022-41717:An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection. FusionOS golang-1.19.4-1.u1.fos23.x86_64.rpm golang-help-1.19.4-1.u1.fos23.noarch.rpm golang-devel-1.19.4-1.u1.fos23.noarch.rpm golang-1.19.4-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2022 Critical FusionOS CVE-2023-0056:An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability. CVE-2023-25725:HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. FusionOS haproxy-2.6.6-2.u1.fos23.x86_64.rpm haproxy-help-2.6.6-2.u1.fos23.noarch.rpm haproxy-2.6.6-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2023 Important FusionOS CVE-2023-25193:hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks. FusionOS harfbuzz-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.x86_64.rpm harfbuzz-help-2.8.2-4.u1.fos23.noarch.rpm harfbuzz-2.8.2-4.u1.fos23.aarch64.rpm harfbuzz-devel-2.8.2-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2024 Critical FusionOS CVE-2006-2001:Cross-site scripting (XSS) vulnerability in index.php in Scry Gallery 1.1 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: this is a different vulnerability than the directory traversal vector. CVE-2022-36760:Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. CVE-2022-37436:Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. CVE-2023-25690:Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific pattern matches some portion of the user-supplied request-target (URL) data and is then re-inserted into the proxied request-target using variable substitution. For example, something like: RewriteEngine on RewriteRule "^/here/(.*)" "http://example.com:8080/elsewhere?$1"; [P] ProxyPassReverse /here/ http://example.com:8080/ Request splitting/smuggling could result in bypass of access controls in the proxy server, proxying unintended URLs to existing origin servers, and cache poisoning. Users are recommended to update to at least version 2.4.56 of Apache HTTP Server. CVE-2023-27522:HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client. FusionOS httpd-2.4.51-15.u5.fos23.x86_64.rpm httpd-devel-2.4.51-15.u5.fos23.x86_64.rpm httpd-help-2.4.51-15.u5.fos23.noarch.rpm httpd-filesystem-2.4.51-15.u5.fos23.noarch.rpm httpd-tools-2.4.51-15.u5.fos23.x86_64.rpm mod_ssl-2.4.51-15.u5.fos23.x86_64.rpm mod_md-2.4.51-15.u5.fos23.x86_64.rpm mod_proxy_html-2.4.51-15.u5.fos23.x86_64.rpm mod_ldap-2.4.51-15.u5.fos23.x86_64.rpm mod_session-2.4.51-15.u5.fos23.x86_64.rpm httpd-2.4.51-15.u5.fos23.aarch64.rpm httpd-devel-2.4.51-15.u5.fos23.aarch64.rpm httpd-tools-2.4.51-15.u5.fos23.aarch64.rpm mod_ssl-2.4.51-15.u5.fos23.aarch64.rpm mod_md-2.4.51-15.u5.fos23.aarch64.rpm mod_proxy_html-2.4.51-15.u5.fos23.aarch64.rpm mod_ldap-2.4.51-15.u5.fos23.aarch64.rpm mod_session-2.4.51-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2025 Important FusionOS CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. FusionOS jackson-databind-2.9.8-9.u1.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u1.fos23.noarch.rpm FusionOS-SA-2023-2026 Critical FusionOS CVE-2014-125087:A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480. FusionOS java-xmlbuilder-1.1-1.u1.fos23.noarch.rpm java-xmlbuilder-help-1.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2027 Moderate FusionOS CVE-2021-28168:Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users. FusionOS jersey-2.29.1-1.u1.fos23.noarch.rpm jersey-test-framework-2.29.1-1.u1.fos23.noarch.rpm jersey-javadoc-2.29.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2028 Important FusionOS CVE-2022-46663:In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. FusionOS less-590-4.u1.fos23.x86_64.rpm less-help-590-4.u1.fos23.noarch.rpm less-590-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2029 Important FusionOS CVE-2022-44617:A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. CVE-2022-46285:A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library. CVE-2022-4883:A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. FusionOS libXpm-3.5.13-4.u1.fos23.x86_64.rpm libXpm-devel-3.5.13-4.u1.fos23.x86_64.rpm libXpm-help-3.5.13-4.u1.fos23.noarch.rpm libXpm-3.5.13-4.u1.fos23.aarch64.rpm libXpm-devel-3.5.13-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2030 Moderate FusionOS CVE-2021-36976:libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). FusionOS libarchive-3.5.2-6.u3.fos23.x86_64.rpm libarchive-devel-3.5.2-6.u3.fos23.x86_64.rpm libarchive-help-3.5.2-6.u3.fos23.noarch.rpm bsdtar-3.5.2-6.u3.fos23.x86_64.rpm bsdcpio-3.5.2-6.u3.fos23.x86_64.rpm bsdcat-3.5.2-6.u3.fos23.x86_64.rpm libarchive-3.5.2-6.u3.fos23.aarch64.rpm libarchive-devel-3.5.2-6.u3.fos23.aarch64.rpm bsdtar-3.5.2-6.u3.fos23.aarch64.rpm bsdcpio-3.5.2-6.u3.fos23.aarch64.rpm bsdcat-3.5.2-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2031 Critical FusionOS CVE-2022-47629:Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. FusionOS libksba-1.6.0-3.u1.fos23.x86_64.rpm libksba-devel-1.6.0-3.u1.fos23.x86_64.rpm libksba-help-1.6.0-3.u1.fos23.noarch.rpm libksba-1.6.0-3.u1.fos23.aarch64.rpm libksba-devel-1.6.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2032 Moderate FusionOS CVE-2023-27371:GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. FusionOS libmicrohttpd-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.x86_64.rpm libmicrohttpd-help-0.9.75-4.u1.fos23.noarch.rpm libmicrohttpd-0.9.75-4.u1.fos23.aarch64.rpm libmicrohttpd-devel-0.9.75-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2033 Moderate FusionOS CVE-2023-23009:Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. FusionOS libreswan-4.5-3.u1.fos23.x86_64.rpm libreswan-help-4.5-3.u1.fos23.x86_64.rpm libreswan-4.5-3.u1.fos23.aarch64.rpm libreswan-help-4.5-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2034 Important FusionOS CVE-2022-48281:processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. CVE-2023-0795:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0796:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0797:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0798:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0799:LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit afaabc3e. CVE-2023-0800:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0801:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0802:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0803:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. CVE-2023-0804:LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 33aee127. FusionOS libtiff-4.3.0-24.u2.fos23.x86_64.rpm libtiff-devel-4.3.0-24.u2.fos23.x86_64.rpm libtiff-static-4.3.0-24.u2.fos23.x86_64.rpm libtiff-tools-4.3.0-24.u2.fos23.x86_64.rpm libtiff-help-4.3.0-24.u2.fos23.noarch.rpm libtiff-4.3.0-24.u2.fos23.aarch64.rpm libtiff-devel-4.3.0-24.u2.fos23.aarch64.rpm libtiff-static-4.3.0-24.u2.fos23.aarch64.rpm libtiff-tools-4.3.0-24.u2.fos23.aarch64.rpm FusionOS-SA-2023-2035 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.x86_64.rpm lxc-help-4.0.3-2022102413.u4.fos23.noarch.rpm lxc-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-libs-4.0.3-2022102413.u4.fos23.aarch64.rpm lxc-devel-4.0.3-2022102413.u4.fos23.aarch64.rpm FusionOS-SA-2023-2036 Moderate FusionOS CVE-2022-44792:handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. CVE-2022-44793:handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. FusionOS net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-libs-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-devel-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-perl-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-gui-5.9.1-5.u1.fos23.x86_64.rpm python3-net-snmp-5.9.1-5.u1.fos23.x86_64.rpm net-snmp-help-5.9.1-5.u1.fos23.noarch.rpm net-snmp-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-libs-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-devel-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-perl-5.9.1-5.u1.fos23.aarch64.rpm net-snmp-gui-5.9.1-5.u1.fos23.aarch64.rpm python3-net-snmp-5.9.1-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2037 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS nodejs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-devel-12.22.11-4.u1.fos23.x86_64.rpm nodejs-libs-12.22.11-4.u1.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.x86_64.rpm nodejs-docs-12.22.11-4.u1.fos23.noarch.rpm nodejs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-devel-12.22.11-4.u1.fos23.aarch64.rpm nodejs-libs-12.22.11-4.u1.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-4.u1.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.4.u1.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2038 Critical FusionOS CVE-2023-25136:OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible." FusionOS openssh-8.8p1-19.u6.fos23.x86_64.rpm openssh-clients-8.8p1-19.u6.fos23.x86_64.rpm openssh-server-8.8p1-19.u6.fos23.x86_64.rpm openssh-keycat-8.8p1-19.u6.fos23.x86_64.rpm openssh-askpass-8.8p1-19.u6.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.x86_64.rpm openssh-help-8.8p1-19.u6.fos23.noarch.rpm openssh-8.8p1-19.u6.fos23.aarch64.rpm openssh-clients-8.8p1-19.u6.fos23.aarch64.rpm openssh-server-8.8p1-19.u6.fos23.aarch64.rpm openssh-keycat-8.8p1-19.u6.fos23.aarch64.rpm openssh-askpass-8.8p1-19.u6.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2039 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected. These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0. The OpenSSL asn1parse command line application is also impacted by this issue. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7. Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream. The OpenSSL cms and smime command line applications are similarly affected. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openssl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-libs-1.1.1m-18.u3.fos23.x86_64.rpm openssl-perl-1.1.1m-18.u3.fos23.x86_64.rpm openssl-devel-1.1.1m-18.u3.fos23.x86_64.rpm openssl-help-1.1.1m-18.u3.fos23.noarch.rpm openssl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-libs-1.1.1m-18.u3.fos23.aarch64.rpm openssl-perl-1.1.1m-18.u3.fos23.aarch64.rpm openssl-devel-1.1.1m-18.u3.fos23.aarch64.rpm FusionOS-SA-2023-2040 Critical FusionOS CVE-2022-4338:An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. FusionOS openvswitch-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-devel-2.12.4-2.u1.fos23.x86_64.rpm openvswitch-help-2.12.4-2.u1.fos23.x86_64.rpm python3-openvswitch-2.12.4-2.u1.fos23.noarch.rpm openvswitch-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-devel-2.12.4-2.u1.fos23.aarch64.rpm openvswitch-help-2.12.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2041 Important FusionOS CVE-2022-47021:A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts. FusionOS opusfile-0.11-5.u1.fos23.x86_64.rpm opusfile-devel-0.11-5.u1.fos23.x86_64.rpm opusfile-0.11-5.u1.fos23.aarch64.rpm opusfile-devel-0.11-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2042 Moderate FusionOS CVE-2022-3560:A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. FusionOS pesign-115-4.u1.fos23.x86_64.rpm pesign-help-115-4.u1.fos23.x86_64.rpm pesign-115-4.u1.fos23.aarch64.rpm pesign-help-115-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2043 Moderate FusionOS CVE-2023-24056:In pkgconf through 1.9.3, variable duplication can cause unbounded string expansion due to incorrect checks in libpkgconf/tuple.c:pkgconf_tuple_parse. For example, a .pc file containing a few hundred bytes can expand to one billion bytes. FusionOS pkgconf-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-devel-1.8.0-3.u1.fos23.x86_64.rpm pkgconf-help-1.8.0-3.u1.fos23.noarch.rpm pkgconf-1.8.0-3.u1.fos23.aarch64.rpm pkgconf-devel-1.8.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2044 Moderate FusionOS CVE-2022-37337:A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. FusionOS poppler-0.90.0-4.u1.fos23.x86_64.rpm poppler-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-glib-doc-0.90.0-4.u1.fos23.noarch.rpm poppler-qt5-0.90.0-4.u1.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-0.90.0-4.u1.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.x86_64.rpm poppler-utils-0.90.0-4.u1.fos23.x86_64.rpm poppler-help-0.90.0-4.u1.fos23.noarch.rpm poppler-0.90.0-4.u1.fos23.aarch64.rpm poppler-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-0.90.0-4.u1.fos23.aarch64.rpm poppler-glib-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-0.90.0-4.u1.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-0.90.0-4.u1.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-4.u1.fos23.aarch64.rpm poppler-utils-0.90.0-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2045 Important FusionOS CVE-2022-4603:** DISPUTED ** A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The manipulation of the argument spkt.buf/rpkt.buf leads to improper validation of array index. The real existence of this vulnerability is still doubted at the moment. The name of the patch is a75fb7b198eed50d769c80c36629f38346882cbf. It is recommended to apply a patch to fix this issue. VDB-216198 is the identifier assigned to this vulnerability. NOTE: pppdump is not used in normal process of setting up a PPP connection, is not installed setuid-root, and is not invoked automatically in any scenario. FusionOS ppp-2.4.9-5.u3.fos23.x86_64.rpm ppp-devel-2.4.9-5.u3.fos23.x86_64.rpm ppp-help-2.4.9-5.u3.fos23.noarch.rpm ppp-2.4.9-5.u3.fos23.aarch64.rpm ppp-devel-2.4.9-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2046 Moderate FusionOS CVE-2023-23931:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions `Cipher.update_into` would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as `bytes`) to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since `update_into` was originally introduced in cryptography 1.8. FusionOS python3-cryptography-36.0.1-2.u1.fos23.x86_64.rpm python-cryptography-help-36.0.1-2.u1.fos23.noarch.rpm python3-cryptography-36.0.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2047 Important FusionOS CVE-2022-40898:An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. FusionOS python3-wheel-0.37.0-2.u1.fos23.noarch.rpm python-wheel-wheel-0.37.0-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2048 Important FusionOS CVE-2021-33621:The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to applications that use untrusted user input either to generate an HTTP response or to create a CGI::Cookie object. FusionOS ruby-3.0.3-128.u1.fos23.x86_64.rpm ruby-devel-3.0.3-128.u1.fos23.x86_64.rpm rubygems-3.2.32-128.u1.fos23.noarch.rpm rubygems-devel-3.2.32-128.u1.fos23.noarch.rpm rubygem-rake-13.0.3-128.u1.fos23.noarch.rpm rubygem-rbs-1.4.0-128.u1.fos23.noarch.rpm ruby-irb-3.0.3-128.u1.fos23.noarch.rpm rubygem-rdoc-6.3.3-128.u1.fos23.noarch.rpm ruby-help-3.0.3-128.u1.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-128.u1.fos23.noarch.rpm rubygem-io-console-0.5.7-128.u1.fos23.x86_64.rpm rubygem-json-2.5.1-128.u1.fos23.x86_64.rpm rubygem-minitest-5.14.2-128.u1.fos23.noarch.rpm rubygem-openssl-2.2.1-128.u1.fos23.x86_64.rpm rubygem-power_assert-1.2.0-128.u1.fos23.noarch.rpm rubygem-psych-3.3.2-128.u1.fos23.x86_64.rpm rubygem-test-unit-3.3.7-128.u1.fos23.noarch.rpm rubygem-rexml-3.2.5-128.u1.fos23.noarch.rpm rubygem-rss-0.2.9-128.u1.fos23.noarch.rpm rubygem-typeprof-0.15.2-128.u1.fos23.noarch.rpm ruby-3.0.3-128.u1.fos23.aarch64.rpm ruby-devel-3.0.3-128.u1.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-128.u1.fos23.aarch64.rpm rubygem-io-console-0.5.7-128.u1.fos23.aarch64.rpm rubygem-json-2.5.1-128.u1.fos23.aarch64.rpm rubygem-openssl-2.2.1-128.u1.fos23.aarch64.rpm rubygem-psych-3.3.2-128.u1.fos23.aarch64.rpm FusionOS-SA-2023-2049 Important FusionOS CVE-2022-44566:A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service. CVE-2023-22794:A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment. FusionOS rubygem-activerecord-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-activerecord-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2050 Important FusionOS CVE-2023-22796:A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability. FusionOS rubygem-activesupport-6.1.4.1-5.u2.fos23.noarch.rpm rubygem-activesupport-doc-6.1.4.1-5.u2.fos23.noarch.rpm FusionOS-SA-2023-2051 Important FusionOS CVE-2023-22799:A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately. FusionOS rubygem-globalid-0.4.2-4.u1.fos23.noarch.rpm rubygem-globalid-doc-0.4.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2052 Important FusionOS CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS shim-15.6-9.u4.fos23.x86_64.rpm shim-15.6-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2053 Important FusionOS CVE-2022-25857:The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. CVE-2022-38749:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38750:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38751:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. CVE-2022-38752:Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow. CVE-2022-41854:Those using Snakeyaml to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack overflow. This effect may support a denial of service attack. FusionOS snakeyaml-1.32-1.u1.fos23.noarch.rpm snakeyaml-javadoc-1.32-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2054 Important FusionOS CVE-2023-22809:In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value. CVE-2023-27320:This vulnerability has been modified since it was last analyzed by the NVD. It is awaiting reanalysis which may result in further changes to the information provided. FusionOS sudo-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u3.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u3.fos23.noarch.rpm sudo-1.9.8p2-10.u3.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u3.fos23.aarch64.rpm FusionOS-SA-2023-2055 Moderate FusionOS CVE-2022-4415:A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. FusionOS systemd-249-46.u7.fos23.x86_64.rpm systemd-devel-249-46.u7.fos23.x86_64.rpm systemd-libs-249-46.u7.fos23.x86_64.rpm systemd-udev-249-46.u7.fos23.x86_64.rpm systemd-container-249-46.u7.fos23.x86_64.rpm systemd-resolved-249-46.u7.fos23.x86_64.rpm systemd-nspawn-249-46.u7.fos23.x86_64.rpm systemd-networkd-249-46.u7.fos23.x86_64.rpm systemd-timesyncd-249-46.u7.fos23.x86_64.rpm systemd-pam-249-46.u7.fos23.x86_64.rpm systemd-help-249-46.u7.fos23.noarch.rpm systemd-249-46.u7.fos23.aarch64.rpm systemd-devel-249-46.u7.fos23.aarch64.rpm systemd-libs-249-46.u7.fos23.aarch64.rpm systemd-udev-249-46.u7.fos23.aarch64.rpm systemd-container-249-46.u7.fos23.aarch64.rpm systemd-resolved-249-46.u7.fos23.aarch64.rpm systemd-nspawn-249-46.u7.fos23.aarch64.rpm systemd-networkd-249-46.u7.fos23.aarch64.rpm systemd-timesyncd-249-46.u7.fos23.aarch64.rpm systemd-pam-249-46.u7.fos23.aarch64.rpm FusionOS-SA-2023-2056 Important FusionOS CVE-2022-48303:GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. FusionOS tar-1.34-4.u1.fos23.x86_64.rpm tar-help-1.34-4.u1.fos23.noarch.rpm tar-1.34-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2057 Important FusionOS CVE-2022-47016:** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. FusionOS tmux-3.2a-3.u1.fos23.x86_64.rpm tmux-help-3.2a-3.u1.fos23.noarch.rpm tmux-3.2a-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2058 Important FusionOS CVE-2022-42252:If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header. CVE-2021-43980:The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. FusionOS tomcat-9.0.10-29.u4.fos23.noarch.rpm tomcat-jsvc-9.0.10-29.u4.fos23.noarch.rpm tomcat-help-9.0.10-29.u4.fos23.noarch.rpm FusionOS-SA-2023-2059 Moderate FusionOS CVE-2023-22745:tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected versions `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `layer_handler` with an 8 bit layer number, but the array only has `TPM2_ERROR_TSS2_RC_LAYER_COUNT` entries, so trying to add a handler for higher-numbered layers or decode a response code with such a layer number reads/writes past the end of the buffer. This Buffer overrun, could result in arbitrary code execution. An example attack would be a MiTM bus attack that returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules an attacker must have local access to the target machine with local system privileges which allows access to the TPM system. Usually TPM access requires administrative privilege. FusionOS tpm2-tss-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.x86_64.rpm tpm2-tss-help-3.1.0-3.u1.fos23.noarch.rpm tpm2-tss-3.1.0-3.u1.fos23.aarch64.rpm tpm2-tss-devel-3.1.0-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2060 Important FusionOS CVE-2023-0051:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1144. CVE-2023-0054:Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1145. CVE-2023-0049:Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.1143. CVE-2023-0288:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1189. CVE-2022-47024:A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts. CVE-2023-0433:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225. CVE-2023-1170:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376. CVE-2023-1175:Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378. FusionOS vim-common-9.0-11.u4.fos23.x86_64.rpm vim-minimal-9.0-11.u4.fos23.x86_64.rpm vim-enhanced-9.0-11.u4.fos23.x86_64.rpm vim-filesystem-9.0-11.u4.fos23.noarch.rpm vim-X11-9.0-11.u4.fos23.x86_64.rpm vim-common-9.0-11.u4.fos23.aarch64.rpm vim-minimal-9.0-11.u4.fos23.aarch64.rpm vim-enhanced-9.0-11.u4.fos23.aarch64.rpm vim-X11-9.0-11.u4.fos23.aarch64.rpm FusionOS-SA-2023-2061 Important FusionOS CVE-2022-3724:Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows CVE-2023-0416:GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0411:Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0413:Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0415:iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-0417:Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2022-4344:Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2022-4345:Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted capture file CVE-2023-0412:TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture file CVE-2023-1161:ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-1.u1.fos23.x86_64.rpm wireshark-devel-3.6.11-1.u1.fos23.x86_64.rpm wireshark-help-3.6.11-1.u1.fos23.x86_64.rpm wireshark-3.6.11-1.u1.fos23.aarch64.rpm wireshark-devel-3.6.11-1.u1.fos23.aarch64.rpm wireshark-help-3.6.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2062 Important FusionOS CVE-2023-0494:A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. FusionOS xorg-x11-server-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-source-1.20.11-16.u3.fos23.noarch.rpm xorg-x11-server-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-16.u3.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-16.u3.fos23.aarch64.rpm FusionOS-SA-2023-2063 Important FusionOS CVE-2022-41966:XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. FusionOS xstream-1.4.18-3.u2.fos23.noarch.rpm xstream-javadoc-1.4.18-3.u2.fos23.noarch.rpm xstream-hibernate-1.4.18-3.u2.fos23.noarch.rpm xstream-benchmark-1.4.18-3.u2.fos23.noarch.rpm xstream-parent-1.4.18-3.u2.fos23.noarch.rpm FusionOS-SA-2023-2064 Moderate FusionOS CVE-2023-1289:A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote attacker to pass a specially crafted SVG file that leads to a segmentation fault, generating many trash files in "/tmp," resulting in a denial of service. When ImageMagick crashes, it generates a lot of trash files. These trash files can be large if the SVG file contains many render actions. In a denial of service attack, if a remote attacker uploads an SVG file of size t, ImageMagick generates files of size 103*t. If an attacker uploads a 100M SVG, the server will generate about 10G. CVE-2023-1906:A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An attacker could pass specially crafted file to convert, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.x86_64.rpm ImageMagick-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-1.u1.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2065 Moderate FusionOS CVE-2023-1981:It was discovered that the avahi deamon can be locally crashed by a dbus call made by an unprivileged user, causing a denial of service. FusionOS avahi-0.8-15.u1.fos23.x86_64.rpm avahi-tools-0.8-15.u1.fos23.x86_64.rpm avahi-ui-0.8-15.u1.fos23.x86_64.rpm avahi-autoipd-0.8-15.u1.fos23.x86_64.rpm avahi-dnsconfd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-0.8-15.u1.fos23.x86_64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.x86_64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.x86_64.rpm avahi-devel-0.8-15.u1.fos23.x86_64.rpm avahi-glib-0.8-15.u1.fos23.x86_64.rpm avahi-glib-devel-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-0.8-15.u1.fos23.x86_64.rpm avahi-gobject-devel-0.8-15.u1.fos23.x86_64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.x86_64.rpm avahi-ui-devel-0.8-15.u1.fos23.x86_64.rpm avahi-libs-0.8-15.u1.fos23.x86_64.rpm avahi-help-0.8-15.u1.fos23.noarch.rpm avahi-0.8-15.u1.fos23.aarch64.rpm avahi-tools-0.8-15.u1.fos23.aarch64.rpm avahi-ui-0.8-15.u1.fos23.aarch64.rpm avahi-autoipd-0.8-15.u1.fos23.aarch64.rpm avahi-dnsconfd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-0.8-15.u1.fos23.aarch64.rpm avahi-compat-howl-devel-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-0.8-15.u1.fos23.aarch64.rpm avahi-compat-libdns_sd-devel-0.8-15.u1.fos23.aarch64.rpm avahi-devel-0.8-15.u1.fos23.aarch64.rpm avahi-glib-0.8-15.u1.fos23.aarch64.rpm avahi-glib-devel-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-0.8-15.u1.fos23.aarch64.rpm avahi-gobject-devel-0.8-15.u1.fos23.aarch64.rpm avahi-ui-gtk3-0.8-15.u1.fos23.aarch64.rpm avahi-ui-devel-0.8-15.u1.fos23.aarch64.rpm avahi-libs-0.8-15.u1.fos23.aarch64.rpm FusionOS-SA-2023-2066 Important FusionOS CVE-2023-27349:This package provides all utilities for use in Bluetooth applications. The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A. FusionOS bluez-5.54-17.u2.fos23.x86_64.rpm bluez-libs-5.54-17.u2.fos23.x86_64.rpm bluez-devel-5.54-17.u2.fos23.x86_64.rpm bluez-help-5.54-17.u2.fos23.noarch.rpm bluez-cups-5.54-17.u2.fos23.x86_64.rpm bluez-5.54-17.u2.fos23.aarch64.rpm bluez-libs-5.54-17.u2.fos23.aarch64.rpm bluez-devel-5.54-17.u2.fos23.aarch64.rpm bluez-cups-5.54-17.u2.fos23.aarch64.rpm FusionOS-SA-2023-2067 Critical FusionOS CVE-2023-27533:curl supports communicating using the TELNET protocol and as a part of this it offers users to pass on user name and "telnet options" for the servernegotiation. Due to lack of proper input scrubbing and without it being the documented functionality, curl would pass on user name and telnet options to the server as provided. This could allow users to pass in carefully crafted content that pass on content or do option negotiation without the application intending to do so. In particular if an application for example allows users to provide the data or parts of the data. CVE-2023-27534:to-become RFC draft](https://datatracker.ietf.org/doc/html/draft-ietf-secsh-scp-sftp-ssh-uri-04) that was to dictate how SFTP URLs work. Due to a bug, the handling of the tilde in SFTP path did however not only replace it when it is used stand-alone as the first path element but also wrongly when used as a mere prefix in the first element. Using a path like `/~2/foo` when accessing a server using the user `dan` (with home directory `/home/dan`) would then quite suprisingly access the file `/home/dan2/foo`. This can be taken advantage of to circumvent filtering or worse. CVE-2023-27535:libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The settings in questions are `CURLOPT_FTP_ACCOUNT`, `CURLOPT_FTP_ALTERNATIVE_TO_USER`, `CURLOPT_FTP_SSL_CCC` and `CURLOPT_USE_SSL` level. CVE-2023-27536:libcurl would reuse a previously created connection even when the GSS delegation (`CURLOPT_GSSAPI_DELEGATION`) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. CVE-2023-27538:libcurl would reuse a previously created connection even when an SSH related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, two SSH settings were left out from the configuration match checks, making them match too easily. FusionOS curl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-7.79.1-15.u5.fos23.x86_64.rpm libcurl-devel-7.79.1-15.u5.fos23.x86_64.rpm curl-help-7.79.1-15.u5.fos23.noarch.rpm curl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-7.79.1-15.u5.fos23.aarch64.rpm libcurl-devel-7.79.1-15.u5.fos23.aarch64.rpm FusionOS-SA-2023-2068 Important FusionOS CVE-2023-30630:Dmidecode reports information about your system's hardware as described in your system BIOS according to the SMBIOS/DMI standard (see a sample output). This information typically includes system manufacturer, model name, serial number, BIOS version, asset tag as well as a lot of other details of varying level of interest and reliability depending on the manufacturer. This will often include usage status for the CPU sockets, expansion slots (e.g. AGP, PCI, ISA) and memory module slots, and the list of I/O ports (e.g. serial, parallel, USB).DMI data can be used to enable or disable specific portions of kernel code depending on the specific hardware. Thus, one use of dmidecode is for kernel developers to detect system "signatures" and add them to the kernel source code when needed. FusionOS dmidecode-3.4-3.u1.fos23.x86_64.rpm dmidecode-3.4-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2069 Important FusionOS CVE-2023-28450:An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. FusionOS dnsmasq-2.86-5.u2.fos23.x86_64.rpm dnsmasq-help-2.86-5.u2.fos23.x86_64.rpm dnsmasq-2.86-5.u2.fos23.aarch64.rpm dnsmasq-help-2.86-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2070 Important FusionOS CVE-2023-28617:Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more. FusionOS emacs-27.2-10.u2.fos23.x86_64.rpm emacs-devel-27.2-10.u2.fos23.x86_64.rpm emacs-lucid-27.2-10.u2.fos23.x86_64.rpm emacs-nox-27.2-10.u2.fos23.x86_64.rpm emacs-common-27.2-10.u2.fos23.x86_64.rpm emacs-terminal-27.2-10.u2.fos23.noarch.rpm emacs-filesystem-27.2-10.u2.fos23.noarch.rpm emacs-help-27.2-10.u2.fos23.noarch.rpm emacs-27.2-10.u2.fos23.aarch64.rpm emacs-devel-27.2-10.u2.fos23.aarch64.rpm emacs-lucid-27.2-10.u2.fos23.aarch64.rpm emacs-nox-27.2-10.u2.fos23.aarch64.rpm emacs-common-27.2-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2071 Important FusionOS CVE-2023-2004:FreeType is written in C, designed to be small,efficient, highly customizable, and portable while capable of producing high-quality output (glyph images) of most vector and bitmap font formats FusionOS freetype-2.12.1-2.u1.fos23.x86_64.rpm freetype-demos-2.12.1-2.u1.fos23.x86_64.rpm freetype-devel-2.12.1-2.u1.fos23.x86_64.rpm freetype-help-2.12.1-2.u1.fos23.noarch.rpm freetype-2.12.1-2.u1.fos23.aarch64.rpm freetype-demos-2.12.1-2.u1.fos23.aarch64.rpm freetype-devel-2.12.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2072 Moderate FusionOS CVE-2023-24593:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. CVE-2023-25180:GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. FusionOS glib2-2.72.2-9.u4.fos23.x86_64.rpm glib2-devel-2.72.2-9.u4.fos23.x86_64.rpm glib2-static-2.72.2-9.u4.fos23.x86_64.rpm glib2-tests-2.72.2-9.u4.fos23.x86_64.rpm glib2-help-2.72.2-9.u4.fos23.noarch.rpm glib2-2.72.2-9.u4.fos23.aarch64.rpm glib2-devel-2.72.2-9.u4.fos23.aarch64.rpm glib2-static-2.72.2-9.u4.fos23.aarch64.rpm glib2-tests-2.72.2-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2073 Important FusionOS CVE-2023-26253:In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-read. FusionOS glusterfs-10.0-8.u1.fos23.x86_64.rpm glusterfs-cli-10.0-8.u1.fos23.x86_64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.x86_64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-fuse-10.0-8.u1.fos23.x86_64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.x86_64.rpm libglusterfs0-10.0-8.u1.fos23.x86_64.rpm libglusterfs-devel-10.0-8.u1.fos23.x86_64.rpm libgfapi0-10.0-8.u1.fos23.x86_64.rpm libgfapi-devel-10.0-8.u1.fos23.x86_64.rpm libgfchangelog0-10.0-8.u1.fos23.x86_64.rpm libgfchangelog-devel-10.0-8.u1.fos23.x86_64.rpm libgfrpc0-10.0-8.u1.fos23.x86_64.rpm libgfrpc-devel-10.0-8.u1.fos23.x86_64.rpm libgfxdr0-10.0-8.u1.fos23.x86_64.rpm libgfxdr-devel-10.0-8.u1.fos23.x86_64.rpm libglusterd0-10.0-8.u1.fos23.x86_64.rpm python3-gluster-10.0-8.u1.fos23.x86_64.rpm glusterfs-resource-agents-10.0-8.u1.fos23.noarch.rpm glusterfs-server-10.0-8.u1.fos23.x86_64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.x86_64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.x86_64.rpm glusterfs-events-10.0-8.u1.fos23.x86_64.rpm glusterfs-10.0-8.u1.fos23.aarch64.rpm glusterfs-cli-10.0-8.u1.fos23.aarch64.rpm glusterfs-cloudsync-plugins-10.0-8.u1.fos23.aarch64.rpm glusterfs-extra-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-fuse-10.0-8.u1.fos23.aarch64.rpm glusterfs-geo-replication-10.0-8.u1.fos23.aarch64.rpm libglusterfs0-10.0-8.u1.fos23.aarch64.rpm libglusterfs-devel-10.0-8.u1.fos23.aarch64.rpm libgfapi0-10.0-8.u1.fos23.aarch64.rpm libgfapi-devel-10.0-8.u1.fos23.aarch64.rpm libgfchangelog0-10.0-8.u1.fos23.aarch64.rpm libgfchangelog-devel-10.0-8.u1.fos23.aarch64.rpm libgfrpc0-10.0-8.u1.fos23.aarch64.rpm libgfrpc-devel-10.0-8.u1.fos23.aarch64.rpm libgfxdr0-10.0-8.u1.fos23.aarch64.rpm libgfxdr-devel-10.0-8.u1.fos23.aarch64.rpm libglusterd0-10.0-8.u1.fos23.aarch64.rpm python3-gluster-10.0-8.u1.fos23.aarch64.rpm glusterfs-server-10.0-8.u1.fos23.aarch64.rpm glusterfs-thin-arbiter-10.0-8.u1.fos23.aarch64.rpm glusterfs-client-xlators-10.0-8.u1.fos23.aarch64.rpm glusterfs-events-10.0-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2074 Important FusionOS CVE-2023-0361:A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection. FusionOS gnutls-3.7.2-7.u1.fos23.x86_64.rpm gnutls-devel-3.7.2-7.u1.fos23.x86_64.rpm gnutls-utils-3.7.2-7.u1.fos23.x86_64.rpm gnutls-help-3.7.2-7.u1.fos23.noarch.rpm gnutls-3.7.2-7.u1.fos23.aarch64.rpm gnutls-devel-3.7.2-7.u1.fos23.aarch64.rpm gnutls-utils-3.7.2-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2075 Important FusionOS CVE-2023-25950:HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition. FusionOS haproxy-2.6.6-3.u2.fos23.x86_64.rpm haproxy-help-2.6.6-3.u2.fos23.noarch.rpm haproxy-2.6.6-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2076 Critical FusionOS CVE-2018-13867:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c. CVE-2018-14031:An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5T_copy in H5T.c. CVE-2018-16438:An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in H5L_extern_query at H5Lexternal.c. CVE-2019-8396:A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while repacking an HDF5 file, aka "Invalid write of size 2." CVE-2020-10812:An issue was discovered in HDF5 through 1.12.0. A NULL pointer dereference exists in the function H5F_get_nrefs() located in H5Fquery.c. It allows an attacker to cause Denial of Service. CVE-2021-37501:Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c. FusionOS hdf5-1.12.1-4.u3.fos23.x86_64.rpm hdf5-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.x86_64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.x86_64.rpm hdf5-1.12.1-4.u3.fos23.aarch64.rpm hdf5-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-mpich-static-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-devel-1.12.1-4.u3.fos23.aarch64.rpm hdf5-openmpi-static-1.12.1-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2077 Important FusionOS CVE-2022-2047:In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. CVE-2022-2048:In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. FusionOS jetty-9.4.16-3.u1.fos23.noarch.rpm jetty-client-9.4.16-3.u1.fos23.noarch.rpm jetty-continuation-9.4.16-3.u1.fos23.noarch.rpm jetty-http-9.4.16-3.u1.fos23.noarch.rpm jetty-http-spi-9.4.16-3.u1.fos23.noarch.rpm jetty-io-9.4.16-3.u1.fos23.noarch.rpm jetty-jaas-9.4.16-3.u1.fos23.noarch.rpm jetty-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-security-9.4.16-3.u1.fos23.noarch.rpm jetty-server-9.4.16-3.u1.fos23.noarch.rpm jetty-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-util-9.4.16-3.u1.fos23.noarch.rpm jetty-webapp-9.4.16-3.u1.fos23.noarch.rpm jetty-jmx-9.4.16-3.u1.fos23.noarch.rpm jetty-xml-9.4.16-3.u1.fos23.noarch.rpm jetty-project-9.4.16-3.u1.fos23.noarch.rpm jetty-deploy-9.4.16-3.u1.fos23.noarch.rpm jetty-annotations-9.4.16-3.u1.fos23.noarch.rpm jetty-ant-9.4.16-3.u1.fos23.noarch.rpm jetty-cdi-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-client-9.4.16-3.u1.fos23.noarch.rpm jetty-fcgi-server-9.4.16-3.u1.fos23.noarch.rpm jetty-infinispan-9.4.16-3.u1.fos23.noarch.rpm jetty-jaspi-9.4.16-3.u1.fos23.noarch.rpm jetty-jndi-9.4.16-3.u1.fos23.noarch.rpm jetty-jspc-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-maven-plugin-9.4.16-3.u1.fos23.noarch.rpm jetty-plus-9.4.16-3.u1.fos23.noarch.rpm jetty-proxy-9.4.16-3.u1.fos23.noarch.rpm jetty-rewrite-9.4.16-3.u1.fos23.noarch.rpm jetty-servlets-9.4.16-3.u1.fos23.noarch.rpm jetty-spring-9.4.16-3.u1.fos23.noarch.rpm jetty-start-9.4.16-3.u1.fos23.noarch.rpm jetty-unixsocket-9.4.16-3.u1.fos23.noarch.rpm jetty-util-ajax-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-api-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-client-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-common-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-server-9.4.16-3.u1.fos23.noarch.rpm jetty-websocket-servlet-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-client-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-javax-websocket-server-impl-9.4.16-3.u1.fos23.noarch.rpm jetty-nosql-9.4.16-3.u1.fos23.noarch.rpm jetty-httpservice-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-warurl-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-boot-jsp-9.4.16-3.u1.fos23.noarch.rpm jetty-osgi-alpn-9.4.16-3.u1.fos23.noarch.rpm jetty-quickstart-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-client-9.4.16-3.u1.fos23.noarch.rpm jetty-alpn-server-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-client-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-common-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-hpack-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-http-client-transport-9.4.16-3.u1.fos23.noarch.rpm jetty-http2-server-9.4.16-3.u1.fos23.noarch.rpm jetty-jstl-9.4.16-3.u1.fos23.noarch.rpm jetty-javadoc-9.4.16-3.u1.fos23.noarch.rpm FusionOS-SA-2023-2078 Important FusionOS CVE-2023-1370:[Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software. FusionOS json-smart-2.2-2.u1.fos23.noarch.rpm json-smart-javadoc-2.2-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2079 Important FusionOS CVE-2022-36280:An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-4269:A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC action "mirred") a local unprivileged user could trigger a CPU soft lockup (ABBA deadlock) when the transport protocol in use (TCP or SCTP) does a retransmission, resulting in a denial of service condition. CVE-2022-48423:In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur. CVE-2022-48424:In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. CVE-2022-48425:In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. CVE-2023-0266:A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e CVE-2023-1079:A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data. CVE-2023-1249:A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the system. Only if patch 390031c94211 ("coredump: Use the vma snapshot in fill_files_note") not applied yet, then kernel could be affected. CVE-2023-1281:Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. CVE-2023-1380:in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1382:A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set. This issue leads to a NULL pointer dereference when accessing con->sock->sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. CVE-2023-1513:A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an information leak. CVE-2023-1611:A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea CVE-2023-1670:A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2023-1855:A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. CVE-2023-1859:A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c in Xen transport for 9pfs in the Linux Kernel. This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. CVE-2023-1872:A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit CVE-2023-1989:A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. In this flaw, a call to btsdio_remove with an unfinished job, may cause a race problem leading to a UAF on hdev devices. CVE-2023-1990:A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. This flaw could allow an attacker to crash the system due to a race problem. CVE-2023-1998:The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. CVE-2023-2006:A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel. CVE-2023-28327:Reference:https://lore.kernel.org/netdev/CAO4mrfdvyjFpokhNsiwZiP-wpdSD0AStcJwfKcKQdAALQ9_2Qw@mail.gmail.com/https://lore.kernel.org/netdev/e04315e7c90d9a75613f3993c2baf2d344eef7eb.camel@redhat.com/https://lore.kernel.org/netdev/20221127012412.37969-3-kuniyu@amazon.com/T/ CVE-2023-28328:A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28466:do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference). CVE-2023-30456:An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. CVE-2023-30772:The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device. FusionOS kernel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.x86_64.rpm kernel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-headers-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm python3-perf-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm bpftool-5.10.0-136.30.0.106.u42.fos23.aarch64.rpm FusionOS-SA-2023-2080 Important FusionOS CVE-2020-12762:json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. FusionOS libfastjson-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-devel-0.99.9-3.u1.fos23.x86_64.rpm libfastjson-0.99.9-3.u1.fos23.aarch64.rpm libfastjson-devel-0.99.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2081 Moderate FusionOS CVE-2023-0614:The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC. FusionOS libldb-2.6.1-2.u1.fos23.x86_64.rpm libldb-devel-2.6.1-2.u1.fos23.x86_64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-2.6.1-2.u1.fos23.x86_64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.x86_64.rpm libldb-help-2.6.1-2.u1.fos23.noarch.rpm libldb-2.6.1-2.u1.fos23.aarch64.rpm libldb-devel-2.6.1-2.u1.fos23.aarch64.rpm python-ldb-devel-common-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-2.6.1-2.u1.fos23.aarch64.rpm python3-ldb-devel-2.6.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2082 Important FusionOS CVE-2023-26769:Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c. FusionOS liblouis-3.7.0-5.u2.fos23.x86_64.rpm liblouis-devel-3.7.0-5.u2.fos23.x86_64.rpm liblouis-utils-3.7.0-5.u2.fos23.x86_64.rpm liblouis-help-3.7.0-5.u2.fos23.noarch.rpm python3-louis-3.7.0-5.u2.fos23.noarch.rpm liblouis-3.7.0-5.u2.fos23.aarch64.rpm liblouis-devel-3.7.0-5.u2.fos23.aarch64.rpm liblouis-utils-3.7.0-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2083 Moderate FusionOS CVE-2023-28484:In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in xmlschemas.c. CVE-2023-29469:An issue was discovered in libxml2 before 2.10.4. When hashing empty dict strings in a crafted XML document, xmlDictComputeFastKey in dict.c can produce non-deterministic values, leading to various logic and memory errors, such as a double free. This behavior occurs because there is an attempt to use the first byte of an empty string, and any value is possible (not solely the '\0' value). FusionOS libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-devel-2.9.14-5.u1.fos23.x86_64.rpm python3-libxml2-2.9.14-5.u1.fos23.x86_64.rpm libxml2-help-2.9.14-5.u1.fos23.noarch.rpm libxml2-2.9.14-5.u1.fos23.aarch64.rpm libxml2-devel-2.9.14-5.u1.fos23.aarch64.rpm python3-libxml2-2.9.14-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2084 Important FusionOS CVE-2021-45985:In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. FusionOS lua-5.4.3-11.u2.fos23.x86_64.rpm lua-devel-5.4.3-11.u2.fos23.x86_64.rpm lua-help-5.4.3-11.u2.fos23.noarch.rpm lua-5.4.3-11.u2.fos23.aarch64.rpm lua-devel-5.4.3-11.u2.fos23.aarch64.rpm FusionOS-SA-2023-2085 Important FusionOS CVE-2022-44370:NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 FusionOS nasm-2.15.05-5.u2.fos23.x86_64.rpm nasm-help-2.15.05-5.u2.fos23.noarch.rpm nasm-2.15.05-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2086 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. FusionOS openssl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-libs-1.1.1m-19.u5.fos23.x86_64.rpm openssl-perl-1.1.1m-19.u5.fos23.x86_64.rpm openssl-devel-1.1.1m-19.u5.fos23.x86_64.rpm openssl-help-1.1.1m-19.u5.fos23.noarch.rpm openssl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-libs-1.1.1m-19.u5.fos23.aarch64.rpm openssl-perl-1.1.1m-19.u5.fos23.aarch64.rpm openssl-devel-1.1.1m-19.u5.fos23.aarch64.rpm FusionOS-SA-2023-2087 Important FusionOS CVE-2023-1668:A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow. FusionOS openvswitch-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-devel-2.12.4-3.u2.fos23.x86_64.rpm openvswitch-help-2.12.4-3.u2.fos23.x86_64.rpm python3-openvswitch-2.12.4-3.u2.fos23.noarch.rpm openvswitch-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-devel-2.12.4-3.u2.fos23.aarch64.rpm openvswitch-help-2.12.4-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2088 Moderate FusionOS CVE-2022-40897:Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py. FusionOS python-setuptools-59.4.0-5.u1.fos23.noarch.rpm python3-setuptools-59.4.0-5.u1.fos23.noarch.rpm python-setuptools-help-59.4.0-5.u1.fos23.noarch.rpm FusionOS-SA-2023-2089 Important FusionOS CVE-2023-24329:An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. FusionOS python3-3.9.9-24.u3.fos23.x86_64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.x86_64.rpm python3-devel-3.9.9-24.u3.fos23.x86_64.rpm python3-debug-3.9.9-24.u3.fos23.x86_64.rpm python3-help-3.9.9-24.u3.fos23.noarch.rpm python3-3.9.9-24.u3.fos23.aarch64.rpm python3-unversioned-command-3.9.9-24.u3.fos23.aarch64.rpm python3-devel-3.9.9-24.u3.fos23.aarch64.rpm python3-debug-3.9.9-24.u3.fos23.aarch64.rpm FusionOS-SA-2023-2090 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis5-5.0.7-5.u1.fos23.x86_64.rpm redis5-devel-5.0.7-5.u1.fos23.x86_64.rpm redis5-doc-5.0.7-5.u1.fos23.noarch.rpm redis5-5.0.7-5.u1.fos23.aarch64.rpm redis5-devel-5.0.7-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2091 Moderate FusionOS CVE-2022-36021:Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. FusionOS redis6-6.2.7-2.u1.fos23.x86_64.rpm redis6-devel-6.2.7-2.u1.fos23.x86_64.rpm redis6-doc-6.2.7-2.u1.fos23.noarch.rpm redis6-6.2.7-2.u1.fos23.aarch64.rpm redis6-devel-6.2.7-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2092 Important FusionOS CVE-2023-28755:A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. CVE-2023-28756:A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. The Time parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. FusionOS ruby-3.0.3-129.u2.fos23.x86_64.rpm ruby-devel-3.0.3-129.u2.fos23.x86_64.rpm rubygems-3.2.32-129.u2.fos23.noarch.rpm rubygems-devel-3.2.32-129.u2.fos23.noarch.rpm rubygem-rake-13.0.3-129.u2.fos23.noarch.rpm rubygem-rbs-1.4.0-129.u2.fos23.noarch.rpm ruby-irb-3.0.3-129.u2.fos23.noarch.rpm rubygem-rdoc-6.3.3-129.u2.fos23.noarch.rpm ruby-help-3.0.3-129.u2.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-129.u2.fos23.noarch.rpm rubygem-io-console-0.5.7-129.u2.fos23.x86_64.rpm rubygem-json-2.5.1-129.u2.fos23.x86_64.rpm rubygem-minitest-5.14.2-129.u2.fos23.noarch.rpm rubygem-openssl-2.2.1-129.u2.fos23.x86_64.rpm rubygem-power_assert-1.2.0-129.u2.fos23.noarch.rpm rubygem-psych-3.3.2-129.u2.fos23.x86_64.rpm rubygem-test-unit-3.3.7-129.u2.fos23.noarch.rpm rubygem-rexml-3.2.5-129.u2.fos23.noarch.rpm rubygem-rss-0.2.9-129.u2.fos23.noarch.rpm rubygem-typeprof-0.15.2-129.u2.fos23.noarch.rpm ruby-3.0.3-129.u2.fos23.aarch64.rpm ruby-devel-3.0.3-129.u2.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-129.u2.fos23.aarch64.rpm rubygem-io-console-0.5.7-129.u2.fos23.aarch64.rpm rubygem-json-2.5.1-129.u2.fos23.aarch64.rpm rubygem-openssl-2.2.1-129.u2.fos23.aarch64.rpm rubygem-psych-3.3.2-129.u2.fos23.aarch64.rpm FusionOS-SA-2023-2093 Important FusionOS CVE-2023-28642:runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. FusionOS runc-1.1.3-11.u3.fos23.x86_64.rpm runc-1.1.3-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2094 Moderate FusionOS CVE-2023-24626:socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. FusionOS screen-4.9.0-2.u1.fos23.x86_64.rpm screen-help-4.9.0-2.u1.fos23.noarch.rpm screen-4.9.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2095 Low FusionOS CVE-2023-29383:In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account. FusionOS shadow-4.9-9.u3.fos23.x86_64.rpm shadow-subid-devel-4.9-9.u3.fos23.x86_64.rpm shadow-help-4.9-9.u3.fos23.noarch.rpm shadow-4.9-9.u3.fos23.aarch64.rpm shadow-subid-devel-4.9-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2096 Important FusionOS CVE-2022-46908:SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. FusionOS sqlite-3.37.2-5.u2.fos23.x86_64.rpm sqlite-devel-3.37.2-5.u2.fos23.x86_64.rpm sqlite-help-3.37.2-5.u2.fos23.noarch.rpm sqlite-3.37.2-5.u2.fos23.aarch64.rpm sqlite-devel-3.37.2-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2097 Moderate FusionOS CVE-2023-28486:Sudo before 1.9.13 does not escape control characters in log messages. CVE-2023-28487:Sudo before 1.9.13 does not escape control characters in sudoreplay output. FusionOS sudo-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-devel-1.9.8p2-10.u4.fos23.x86_64.rpm sudo-help-1.9.8p2-10.u4.fos23.noarch.rpm sudo-1.9.8p2-10.u4.fos23.aarch64.rpm sudo-devel-1.9.8p2-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2098 Moderate FusionOS CVE-2023-1801:The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet. FusionOS tcpdump-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-help-4.99.1-6.u1.fos23.x86_64.rpm tcpdump-4.99.1-6.u1.fos23.aarch64.rpm tcpdump-help-4.99.1-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2099 Moderate FusionOS CVE-2023-28708:When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. FusionOS tomcat-9.0.10-30.u5.fos23.noarch.rpm tomcat-jsvc-9.0.10-30.u5.fos23.noarch.rpm tomcat-help-9.0.10-30.u5.fos23.noarch.rpm FusionOS-SA-2023-2100 Important FusionOS CVE-2023-1108:A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. FusionOS undertow-1.4.0-4.u1.fos23.noarch.rpm undertow-javadoc-1.4.0-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2101 Moderate FusionOS CVE-2023-1264:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392. FusionOS vim-common-9.0-12.u5.fos23.x86_64.rpm vim-minimal-9.0-12.u5.fos23.x86_64.rpm vim-enhanced-9.0-12.u5.fos23.x86_64.rpm vim-filesystem-9.0-12.u5.fos23.noarch.rpm vim-X11-9.0-12.u5.fos23.x86_64.rpm vim-common-9.0-12.u5.fos23.aarch64.rpm vim-minimal-9.0-12.u5.fos23.aarch64.rpm vim-enhanced-9.0-12.u5.fos23.aarch64.rpm vim-X11-9.0-12.u5.fos23.aarch64.rpm FusionOS-SA-2023-2102 Important FusionOS CVE-2023-1992:RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1993:LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file CVE-2023-1994:GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-3.u2.fos23.x86_64.rpm wireshark-devel-3.6.11-3.u2.fos23.x86_64.rpm wireshark-help-3.6.11-3.u2.fos23.x86_64.rpm wireshark-3.6.11-3.u2.fos23.aarch64.rpm wireshark-devel-3.6.11-3.u2.fos23.aarch64.rpm wireshark-help-3.6.11-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2103 Important FusionOS CVE-2023-1393:A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. FusionOS xorg-x11-server-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-source-1.20.11-18.u5.fos23.noarch.rpm xorg-x11-server-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-18.u5.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-18.u5.fos23.aarch64.rpm FusionOS-SA-2023-2104 Important FusionOS CVE-2022-4899:A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. FusionOS zstd-1.5.0-4.u2.fos23.x86_64.rpm zstd-devel-1.5.0-4.u2.fos23.x86_64.rpm zstd-help-1.5.0-4.u2.fos23.noarch.rpm zstd-1.5.0-4.u2.fos23.aarch64.rpm zstd-devel-1.5.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2105 Moderate FusionOS CVE-2023-1729:A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash. FusionOS LibRaw-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-devel-0.20.2-6.u1.fos23.x86_64.rpm LibRaw-0.20.2-6.u1.fos23.aarch64.rpm LibRaw-devel-0.20.2-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2106 Important FusionOS CVE-2022-3736 :BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3924:This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. If the resolver receives many queries that require recursion, there will be a corresponding increase in the number of clients that are waiting for recursion to complete. If there are sufficient clients already waiting when a new client query is received so that it is necessary to SERVFAIL the longest waiting client (see BIND 9 ARM `recursive-clients` limit and soft quota), then it is possible for a race to occur between providing a stale answer to this older client and sending an early timeout SERVFAIL, which may cause an assertion failure. This issue affects BIND 9 versions 9.16.12 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.12-S1 through 9.16.36-S1. CVE-2022-3094:Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1. FusionOS bind-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-libs-9.16.23-14.u3.fos23.x86_64.rpm bind-license-9.16.23-14.u3.fos23.noarch.rpm bind-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-14.u3.fos23.noarch.rpm bind-devel-9.16.23-14.u3.fos23.x86_64.rpm bind-chroot-9.16.23-14.u3.fos23.x86_64.rpm python3-bind-9.16.23-14.u3.fos23.noarch.rpm bind-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-libs-9.16.23-14.u3.fos23.aarch64.rpm bind-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-14.u3.fos23.aarch64.rpm bind-devel-9.16.23-14.u3.fos23.aarch64.rpm bind-chroot-9.16.23-14.u3.fos23.aarch64.rpm FusionOS-SA-2023-2107 Important FusionOS CVE-2023-25815:In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to localize messages at all, and skips the gettext initialization. However, due to a change in MINGW-packages, the `gettext()` function's implicit initialization no longer uses the runtime prefix but uses the hard-coded path `C:\mingw64\share\locale` to look for localized messages. And since any authenticated user has the permission to create folders in `C:\` (and since `C:\mingw64` does not typically exist), it is possible for low-privilege users to place fake messages in that location where `git.exe` will pick them up in version 2.40.1. This vulnerability is relatively hard to exploit and requires social engineering. For example, a legitimate message at the end of a clone could be maliciously modified to ask the user to direct their web browser to a malicious website, and the user might think that the message comes from Git and is legitimate. It does require local write access by the attacker, though, which makes this attack vector less likely. Version 2.40.1 contains a patch for this issue. Some workarounds are available. Do not work on a Windows machine with shared accounts, or alternatively create a `C:\mingw64` folder and leave it empty. Users who have administrative rights may remove the permission to create folders in `C:\`. CVE-2023-29007:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. CVE-2023-25652:Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. FusionOS git-2.33.0-11.u3.fos23.x86_64.rpm git-core-2.33.0-11.u3.fos23.x86_64.rpm git-daemon-2.33.0-11.u3.fos23.x86_64.rpm git-gui-2.33.0-11.u3.fos23.noarch.rpm gitk-2.33.0-11.u3.fos23.noarch.rpm git-web-2.33.0-11.u3.fos23.noarch.rpm git-svn-2.33.0-11.u3.fos23.noarch.rpm git-email-2.33.0-11.u3.fos23.noarch.rpm perl-Git-2.33.0-11.u3.fos23.noarch.rpm perl-Git-SVN-2.33.0-11.u3.fos23.noarch.rpm git-help-2.33.0-11.u3.fos23.noarch.rpm git-2.33.0-11.u3.fos23.aarch64.rpm git-core-2.33.0-11.u3.fos23.aarch64.rpm git-daemon-2.33.0-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2108 Critical FusionOS CVE-2023-29400:Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags. CVE-2023-24540:Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution. CVE-2023-24539:Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input. CVE-2023-24538:Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. With fix, Template.Parse returns an Error when it encounters templates like this, with an ErrorCode of value 12. CVE-2023-24537:Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow. CVE-2023-24536:Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=. CVE-2023-24534:HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers. CVE-2023-24532:The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh. CVE-2022-41725:A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. CVE-2022-41724:Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert). CVE-2022-41723:A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. CVE-2022-41722:A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b". FusionOS golang-1.19.4-1.u2.fos23.x86_64.rpm golang-help-1.19.4-1.u2.fos23.noarch.rpm golang-devel-1.19.4-1.u2.fos23.noarch.rpm golang-1.19.4-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2109 Important FusionOS CVE-2023-1829:A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. CVE-2022-4382:A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. CVE-2023-0458:A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. CVE-2023-2269:A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component. CVE-2023-2483:In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr. If we remove the driver which will call emac_remove to make cleanup, there may be a unfinished work. This could lead to a use-after-free. CVE-2023-31436:qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX. CVE-2023-2176:A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. CVE-2023-2194:An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. CVE-2023-2166:A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux. ml_priv may not be initialized in the receive path of CAN frames. A local user could use this flaw to crash the system or potentially cause a denial of service. CVE-2023-2007:The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. FusionOS kernel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.x86_64.rpm kernel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-headers-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm python3-perf-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm bpftool-5.10.0-136.31.0.107.u46.fos23.aarch64.rpm FusionOS-SA-2023-2110 Important FusionOS CVE-2023-28625:mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`. FusionOS mod_auth_openidc-2.4.13.2-1.fos23.x86_64.rpm mod_auth_openidc-2.4.13.2-1.fos23.aarch64.rpm FusionOS-SA-2023-2111 Critical FusionOS CVE-2022-37434:zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference). FusionOS mysql-8.0.29-2.u1.fos23.x86_64.rpm mysql-libs-8.0.29-2.u1.fos23.x86_64.rpm mysql-config-8.0.29-2.u1.fos23.x86_64.rpm mysql-common-8.0.29-2.u1.fos23.x86_64.rpm mysql-errmsg-8.0.29-2.u1.fos23.x86_64.rpm mysql-server-8.0.29-2.u1.fos23.x86_64.rpm mysql-devel-8.0.29-2.u1.fos23.x86_64.rpm mysql-test-8.0.29-2.u1.fos23.x86_64.rpm mysql-help-8.0.29-2.u1.fos23.x86_64.rpm mysql-8.0.29-2.u1.fos23.aarch64.rpm mysql-libs-8.0.29-2.u1.fos23.aarch64.rpm mysql-config-8.0.29-2.u1.fos23.aarch64.rpm mysql-common-8.0.29-2.u1.fos23.aarch64.rpm mysql-errmsg-8.0.29-2.u1.fos23.aarch64.rpm mysql-server-8.0.29-2.u1.fos23.aarch64.rpm mysql-devel-8.0.29-2.u1.fos23.aarch64.rpm mysql-test-8.0.29-2.u1.fos23.aarch64.rpm mysql-help-8.0.29-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2112 Important FusionOS CVE-2023-31484:CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. FusionOS perl-5.34.0-7.u1.fos23.x86_64.rpm perl-libs-5.34.0-7.u1.fos23.x86_64.rpm perl-devel-5.34.0-7.u1.fos23.x86_64.rpm perl-help-5.34.0-7.u1.fos23.noarch.rpm perl-5.34.0-7.u1.fos23.aarch64.rpm perl-libs-5.34.0-7.u1.fos23.aarch64.rpm perl-devel-5.34.0-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2113 Important FusionOS CVE-2022-38023:Netlogon RPC Elevation of Privilege Vulnerability. CVE-2022-37966:Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability CVE-2022-37967:Windows Kerberos Elevation of Privilege Vulnerability FusionOS samba-4.17.5-2.fos23.x86_64.rpm samba-libs-4.17.5-2.fos23.x86_64.rpm samba-client-4.17.5-2.fos23.x86_64.rpm samba-common-4.17.5-2.fos23.x86_64.rpm samba-common-tools-4.17.5-2.fos23.x86_64.rpm samba-dc-4.17.5-2.fos23.x86_64.rpm samba-dc-provision-4.17.5-2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.x86_64.rpm samba-devel-4.17.5-2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-2.fos23.x86_64.rpm libsmbclient-4.17.5-2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-2.fos23.x86_64.rpm libwbclient-4.17.5-2.fos23.x86_64.rpm libwbclient-devel-4.17.5-2.fos23.x86_64.rpm python3-samba-4.17.5-2.fos23.x86_64.rpm python3-samba-test-4.17.5-2.fos23.x86_64.rpm python3-samba-dc-4.17.5-2.fos23.x86_64.rpm samba-pidl-4.17.5-2.fos23.noarch.rpm samba-test-4.17.5-2.fos23.x86_64.rpm samba-usershares-4.17.5-2.fos23.x86_64.rpm samba-winbind-4.17.5-2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-2.fos23.x86_64.rpm ctdb-4.17.5-2.fos23.x86_64.rpm samba-help-4.17.5-2.fos23.x86_64.rpm samba-4.17.5-2.fos23.aarch64.rpm samba-libs-4.17.5-2.fos23.aarch64.rpm samba-client-4.17.5-2.fos23.aarch64.rpm samba-common-4.17.5-2.fos23.aarch64.rpm samba-common-tools-4.17.5-2.fos23.aarch64.rpm samba-dc-4.17.5-2.fos23.aarch64.rpm samba-dc-provision-4.17.5-2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-2.fos23.aarch64.rpm samba-devel-4.17.5-2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-2.fos23.aarch64.rpm libsmbclient-4.17.5-2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-2.fos23.aarch64.rpm libwbclient-4.17.5-2.fos23.aarch64.rpm libwbclient-devel-4.17.5-2.fos23.aarch64.rpm python3-samba-4.17.5-2.fos23.aarch64.rpm python3-samba-test-4.17.5-2.fos23.aarch64.rpm python3-samba-dc-4.17.5-2.fos23.aarch64.rpm samba-test-4.17.5-2.fos23.aarch64.rpm samba-usershares-4.17.5-2.fos23.aarch64.rpm samba-winbind-4.17.5-2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-2.fos23.aarch64.rpm ctdb-4.17.5-2.fos23.aarch64.rpm samba-help-4.17.5-2.fos23.aarch64.rpm FusionOS-SA-2023-2114 Important FusionOS CVE-2023-34151:A vulnerability was found in ImageMagick. This security flaw ouccers as an undefined behaviors of casting double to size_t in svg, mvg and other coders (recurring bugs of CVE-2022-32546). CVE-2023-34153:A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. FusionOS ImageMagick-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.x86_64.rpm ImageMagick-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-2.u2.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2115 Important FusionOS CVE-2023-31130:c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular "0::00:00:00/2" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1. CVE-2023-32067:c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1. CVE-2023-31124:c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1. CVE-2023-31147:c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1. FusionOS c-ares-1.18.1-7.u3.fos23.x86_64.rpm c-ares-devel-1.18.1-7.u3.fos23.x86_64.rpm c-ares-help-1.18.1-7.u3.fos23.noarch.rpm c-ares-1.18.1-7.u3.fos23.aarch64.rpm c-ares-devel-1.18.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2116 Moderate FusionOS CVE-2022-2084:Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords. CVE-2023-1786:Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege. FusionOS cloud-init-21.4-16.u8.fos23.noarch.rpm cloud-init-help-21.4-16.u8.fos23.noarch.rpm FusionOS-SA-2023-2117 Low FusionOS CVE-2015-1197:cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. FusionOS cpio-2.13-8.u1.fos23.x86_64.rpm cpio-help-2.13-8.u1.fos23.noarch.rpm cpio-2.13-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2118 Moderate FusionOS CVE-2023-32324:OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service (DoS) attack. A buffer overflow vulnerability in the function `format_log_line` could allow remote attackers to cause a DoS on the affected system. Exploitation of the vulnerability can be triggered when the configuration file `cupsd.conf` sets the value of `loglevel `to `DEBUG`. FusionOS cups-2.4.0-7.u2.fos23.x86_64.rpm cups-client-2.4.0-7.u2.fos23.x86_64.rpm cups-devel-2.4.0-7.u2.fos23.x86_64.rpm cups-libs-2.4.0-7.u2.fos23.x86_64.rpm cups-filesystem-2.4.0-7.u2.fos23.noarch.rpm cups-lpd-2.4.0-7.u2.fos23.x86_64.rpm cups-ipptool-2.4.0-7.u2.fos23.x86_64.rpm cups-printerapp-2.4.0-7.u2.fos23.x86_64.rpm cups-help-2.4.0-7.u2.fos23.noarch.rpm cups-2.4.0-7.u2.fos23.aarch64.rpm cups-client-2.4.0-7.u2.fos23.aarch64.rpm cups-devel-2.4.0-7.u2.fos23.aarch64.rpm cups-libs-2.4.0-7.u2.fos23.aarch64.rpm cups-lpd-2.4.0-7.u2.fos23.aarch64.rpm cups-ipptool-2.4.0-7.u2.fos23.aarch64.rpm cups-printerapp-2.4.0-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2119 Important FusionOS CVE-2023-24805:cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) >> 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. FusionOS cups-filters-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-devel-1.28.9-3.u1.fos23.x86_64.rpm cups-filters-help-1.28.9-3.u1.fos23.noarch.rpm cups-filters-1.28.9-3.u1.fos23.aarch64.rpm cups-filters-devel-1.28.9-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2120 Moderate FusionOS CVE-2023-28322:An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST. CVE-2023-28320:A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave. CVE-2023-28321:An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`. FusionOS curl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-7.79.1-19.u9.fos23.x86_64.rpm libcurl-devel-7.79.1-19.u9.fos23.x86_64.rpm curl-help-7.79.1-19.u9.fos23.noarch.rpm curl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-7.79.1-19.u9.fos23.aarch64.rpm libcurl-devel-7.79.1-19.u9.fos23.aarch64.rpm FusionOS-SA-2023-2121 Critical FusionOS CVE-2023-28879:In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written. FusionOS ghostscript-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-devel-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-help-9.55.0-2.u1.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.x86_64.rpm ghostscript-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-devel-9.55.0-2.u1.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2122 Important FusionOS CVE-2022-42003:In FasterXML jackson-databind before 2.14.0-rc1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. CVE-2022-42004:In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays. An application is vulnerable only with certain customized choices for deserialization. CVE-2020-36518:jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects. FusionOS jackson-databind-2.9.8-9.u3.fos23.noarch.rpm jackson-databind-javadoc-2.9.8-9.u3.fos23.noarch.rpm FusionOS-SA-2023-2123 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.372.b07-0.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.372.b07-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2124 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-11-openjdk-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.x86_64.rpm java-11-openjdk-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.19.7-0.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.19.7-0.fos23.aarch64.rpm FusionOS-SA-2023-2125 Important FusionOS CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. FusionOS java-17-openjdk-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.x86_64.rpm java-17-openjdk-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-headless-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-devel-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-jmods-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-demo-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-src-slowdebug-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-17.0.5.8-0.u1.fos23.aarch64.rpm java-17-openjdk-javadoc-zip-17.0.5.8-0.u1.fos23.aarch64.rpm FusionOS-SA-2023-2126 Important FusionOS CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2022-45693:Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. CVE-2022-40149:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. FusionOS jettison-1.3.7-1.u2.fos23.noarch.rpm jettison-javadoc-1.3.7-1.u2.fos23.noarch.rpm FusionOS-SA-2023-2127 Important FusionOS CVE-2023-3141:A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. CVE-2023-22998:In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer). CVE-2023-34256:An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. CVE-2022-48502:An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. CVE-2023-25012:The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long. CVE-2023-2985:A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-3111:A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2022-1015:A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. CVE-2023-32233:In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled. CVE-2023-2124:An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system. CVE-2023-32269:An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability. CVE-2023-2002:A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth communication. CVE-2023-26544:In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size. CVE-2023-0459:Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. FusionOS kernel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.x86_64.rpm kernel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-headers-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm python3-perf-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm bpftool-5.10.0-136.35.0.111.u63.fos23.aarch64.rpm FusionOS-SA-2023-2128 Low FusionOS CVE-2023-2602:A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory. CVE-2023-2603:A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB. FusionOS libcap-2.61-5.u1.fos23.x86_64.rpm libcap-devel-2.61-5.u1.fos23.x86_64.rpm libcap-help-2.61-5.u1.fos23.noarch.rpm libcap-2.61-5.u1.fos23.aarch64.rpm libcap-devel-2.61-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2129 Important FusionOS CVE-2023-30570:pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. FusionOS libreswan-4.11-1.u1.fos23.x86_64.rpm libreswan-help-4.11-1.u1.fos23.x86_64.rpm libreswan-4.11-1.u1.fos23.aarch64.rpm libreswan-help-4.11-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2130 Moderate FusionOS CVE-2023-1667:A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service. CVE-2023-2283:A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK. FusionOS libssh-0.9.6-7.u2.fos23.x86_64.rpm libssh-devel-0.9.6-7.u2.fos23.x86_64.rpm libssh-help-0.9.6-7.u2.fos23.noarch.rpm libssh-0.9.6-7.u2.fos23.aarch64.rpm libssh-devel-0.9.6-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2131 Moderate FusionOS CVE-2023-1916:A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. CVE-2023-2731:A NULL pointer dereference flaw was found in Libtiff's LZWDecode() function in the libtiff/tif_lzw.c file. This flaw allows a local attacker to craft specific input data that can cause the program to dereference a NULL pointer when decompressing a TIFF format file, resulting in a program crash or denial of service. FusionOS libtiff-4.3.0-25.u4.fos23.x86_64.rpm libtiff-devel-4.3.0-25.u4.fos23.x86_64.rpm libtiff-static-4.3.0-25.u4.fos23.x86_64.rpm libtiff-tools-4.3.0-25.u4.fos23.x86_64.rpm libtiff-help-4.3.0-25.u4.fos23.noarch.rpm libtiff-4.3.0-25.u4.fos23.aarch64.rpm libtiff-devel-4.3.0-25.u4.fos23.aarch64.rpm libtiff-static-4.3.0-25.u4.fos23.aarch64.rpm libtiff-tools-4.3.0-25.u4.fos23.aarch64.rpm FusionOS-SA-2023-2132 Important FusionOS CVE-2023-1017:An out-of-bounds write vulnerability exists in TPM2.0's Module Library allowing writing of a 2-byte data past the end of TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can lead to denial of service (crashing the TPM chip/process or rendering it unusable) and/or arbitrary code execution in the TPM context. CVE-2023-1018:An out-of-bounds read vulnerability exists in TPM2.0's Module Library allowing a 2-byte read past the end of a TPM2.0 command in the CryptParameterDecryption routine. An attacker who can successfully exploit this vulnerability can read or access sensitive data stored in the TPM. FusionOS libtpms-0.7.3-8.u1.fos23.x86_64.rpm libtpms-devel-0.7.3-8.u1.fos23.x86_64.rpm libtpms-0.7.3-8.u1.fos23.aarch64.rpm libtpms-devel-0.7.3-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2133 Moderate FusionOS CVE-2023-1999:There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. FusionOS libwebp-1.2.1-3.u1.fos23.x86_64.rpm libwebp-tools-1.2.1-3.u1.fos23.x86_64.rpm libwebp-devel-1.2.1-3.u1.fos23.x86_64.rpm libwebp-java-1.2.1-3.u1.fos23.x86_64.rpm libwebp-help-1.2.1-3.u1.fos23.noarch.rpm libwebp-1.2.1-3.u1.fos23.aarch64.rpm libwebp-tools-1.2.1-3.u1.fos23.aarch64.rpm libwebp-devel-1.2.1-3.u1.fos23.aarch64.rpm libwebp-java-1.2.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2134 Critical FusionOS CVE-2018-16487:A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype. CVE-2018-3721:lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects. CVE-2019-10744:Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. CVE-2020-8203:Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. FusionOS lodash-3.10.1-1.u1.fos23.noarch.rpm js-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-node-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cli-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-add-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-after-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraycopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayevery-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arrayfilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-arraymap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ary-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-assign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-at-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-attempt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseassign-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseclone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecompareascending-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecopy-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basecreate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedelay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basedifference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseeachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefilter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefindindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseflatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseforright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basefunctions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseget-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseisequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basematchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basepullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baserandom-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basereduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseslice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basesortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basetostring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-baseuniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-basevalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-before-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-binaryindexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bind-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindcallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-bindkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-cacheindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-callback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-camelcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-capitalize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ceil-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-charsrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-chunk-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clone-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-clonedeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-compact-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-constant-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-countby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-create-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createaggregator-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createassigner-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcache-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createcompounder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createpadding-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-createwrapper-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curry-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-curryright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-debounce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-deburr-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaults-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defaultsdeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-defer-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-delay-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-difference-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-drop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-droprightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-dropwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-endswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-escaperegexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-every-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-fill-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-filter-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-find-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlast-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findlastkey-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-findwhere-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-first-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flatten-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flattendeep-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-floor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flow-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-flowright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreach-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-foreachright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forinright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forown-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-forownright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-functions-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-get-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-getnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-groupby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-gte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-has-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-identity-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-includes-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-indexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-initial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-inrange-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-intersection-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invert-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invoke-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-invokepath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarguments-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isboolean-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isdate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iselement-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isempty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isequal-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-iserror-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfinite-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isfunction-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isiterateecall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-ismatch-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnan-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnative-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isnumber-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isregexp-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isstring-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-istypedarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-isundefined-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-kebabcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-keysin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-last-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lastindexof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lt-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-lte-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-map-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapkeys-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mapvalues-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matches-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-matchesproperty-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-max-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-memoize-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-merge-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-method-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-methodof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-min-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-mixin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-modargs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-negate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-noop-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-now-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-omit-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-once-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pad-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-padright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pairs-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-parseint-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partial-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partialright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-partition-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pick-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbyarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pickbycallback-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pluck-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-property-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-propertyof-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pull-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-pullat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-random-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-range-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rearg-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduce-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reduceright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reevaluate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reinterpolate-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-reject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-remove-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-repeat-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-replaceholders-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-rest-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-restparam-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-result-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-round-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sample-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-set-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-shuffle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-size-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-slice-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-snakecase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-some-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortby-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyall-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortbyorder-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sortedlastindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-spread-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startcase-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-startswith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-sum-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-support-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-take-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takeright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takerightwhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-takewhile-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-template-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-templatesettings-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-throttle-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-times-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toarray-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toiterable-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-topath-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-toplainobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-transform-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trim-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimleft-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedleftindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimmedrightindex-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trimright-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-trunc-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unescape-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-union-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniq-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-uniqueid-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-unzipwith-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-values-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-valuesin-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-where-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-without-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-words-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-wrap-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-xor-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zip-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipobject-3.10.1-1.u1.fos23.noarch.rpm nodejs-lodash-zipwith-3.10.1-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2135 Low FusionOS CVE-2022-47952:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist. FusionOS lxc-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.x86_64.rpm lxc-help-4.0.3-2022102419.u6.fos23.noarch.rpm lxc-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-libs-4.0.3-2022102419.u6.fos23.aarch64.rpm lxc-devel-4.0.3-2022102419.u6.fos23.aarch64.rpm FusionOS-SA-2023-2136 Important FusionOS CVE-2019-16869:Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. FusionOS netty3-3.10.6-6.u1.fos23.noarch.rpm FusionOS-SA-2023-2137 Moderate FusionOS CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26552:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26553:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26554:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. CVE-2023-26555:praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. CVE-2023-26551:mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. FusionOS ntp-4.2.8p15-10.u2.fos23.x86_64.rpm ntp-perl-4.2.8p15-10.u2.fos23.noarch.rpm ntp-help-4.2.8p15-10.u2.fos23.noarch.rpm ntp-4.2.8p15-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2138 Important FusionOS CVE-2023-2953:A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. FusionOS openldap-2.6.0-6.u2.fos23.x86_64.rpm openldap-devel-2.6.0-6.u2.fos23.x86_64.rpm openldap-servers-2.6.0-6.u2.fos23.x86_64.rpm openldap-clients-2.6.0-6.u2.fos23.x86_64.rpm openldap-help-2.6.0-6.u2.fos23.noarch.rpm openldap-2.6.0-6.u2.fos23.aarch64.rpm openldap-devel-2.6.0-6.u2.fos23.aarch64.rpm openldap-servers-2.6.0-6.u2.fos23.aarch64.rpm openldap-clients-2.6.0-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2139 Important FusionOS CVE-2023-2650:Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. An OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers - most of which have no size limit. OBJ_obj2txt() may be used to translate an ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL type ASN1_OBJECT) to its canonical numeric text form, which are the sub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by periods. When one of the sub-identifiers in the OBJECT IDENTIFIER is very large (these are sizes that are seen as absurdly large, taking up tens or hundreds of KiBs), the translation to a decimal number in text may take a very long time. The time complexity is O(n^2) with 'n' being the size of the sub-identifiers in bytes (*). With OpenSSL 3.0, support to fetch cryptographic algorithms using names / identifiers in string form was introduced. This includes using OBJECT IDENTIFIERs in canonical numeric text form as identifiers for fetching algorithms. Such OBJECT IDENTIFIERs may be received through the ASN.1 structure AlgorithmIdentifier, which is commonly used in multiple protocols to specify what cryptographic algorithm should be used to sign or verify, encrypt or decrypt, or digest passed data. Applications that call OBJ_obj2txt() directly with untrusted data are affected, with any version of OpenSSL. If the use is for the mere purpose of display, the severity is considered low. In OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS. It also impacts anything that processes X.509 certificates, including simple things like verifying its signature. The impact on TLS is relatively low, because all versions of OpenSSL have a 100KiB limit on the peer's certificate chain. Additionally, this only impacts clients, or servers that have explicitly enabled client authentication. In OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects, such as X.509 certificates. This is assumed to not happen in such a way that it would cause a Denial of Service, so these versions are considered not affected by this issue in such a way that it would be cause for concern, and the severity is therefore considered low. FusionOS openssl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-libs-1.1.1m-22.u7.fos23.x86_64.rpm openssl-perl-1.1.1m-22.u7.fos23.x86_64.rpm openssl-devel-1.1.1m-22.u7.fos23.x86_64.rpm openssl-help-1.1.1m-22.u7.fos23.noarch.rpm openssl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-libs-1.1.1m-22.u7.fos23.aarch64.rpm openssl-perl-1.1.1m-22.u7.fos23.aarch64.rpm openssl-devel-1.1.1m-22.u7.fos23.aarch64.rpm FusionOS-SA-2023-2140 Important FusionOS CVE-2023-30861:Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. FusionOS python3-flask-2.1.2-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2141 Moderate FusionOS CVE-2023-33733:Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval. FusionOS python3-reportlab-3.6.10-1.u1.fos23.x86_64.rpm python-reportlab-help-3.6.10-1.u1.fos23.noarch.rpm python3-reportlab-3.6.10-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2142 Moderate FusionOS CVE-2023-32681:Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. FusionOS python3-requests-2.26.0-8.u2.fos23.noarch.rpm python-requests-help-2.26.0-8.u2.fos23.noarch.rpm FusionOS-SA-2023-2143 Important FusionOS CVE-2023-32762:An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. ,CVE-2023-32763:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. CVE-2023-24607:Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x before 5.15.13, 6.x before 6.2.8, and 6.3.x before 6.4.3. FusionOS qt5-qtbase-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-6.u2.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.x86_64.rpm qt5-qtbase-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-6.u2.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2144 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis5-5.0.7-5.u2.fos23.x86_64.rpm redis5-devel-5.0.7-5.u2.fos23.x86_64.rpm redis5-doc-5.0.7-5.u2.fos23.noarch.rpm redis5-5.0.7-5.u2.fos23.aarch64.rpm redis5-devel-5.0.7-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2145 Moderate FusionOS CVE-2023-28856:Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS redis6-6.2.7-2.u2.fos23.x86_64.rpm redis6-devel-6.2.7-2.u2.fos23.x86_64.rpm redis6-doc-6.2.7-2.u2.fos23.noarch.rpm redis6-6.2.7-2.u2.fos23.aarch64.rpm redis6-devel-6.2.7-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2146 Moderate FusionOS CVE-2018-14628:An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. FusionOS samba-4.17.5-3.u2.fos23.x86_64.rpm samba-libs-4.17.5-3.u2.fos23.x86_64.rpm samba-client-4.17.5-3.u2.fos23.x86_64.rpm samba-common-4.17.5-3.u2.fos23.x86_64.rpm samba-common-tools-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-provision-4.17.5-3.u2.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.x86_64.rpm samba-devel-4.17.5-3.u2.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-3.u2.fos23.x86_64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-4.17.5-3.u2.fos23.x86_64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-4.17.5-3.u2.fos23.x86_64.rpm libwbclient-devel-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-test-4.17.5-3.u2.fos23.x86_64.rpm python3-samba-dc-4.17.5-3.u2.fos23.x86_64.rpm samba-pidl-4.17.5-3.u2.fos23.noarch.rpm samba-test-4.17.5-3.u2.fos23.x86_64.rpm samba-usershares-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.x86_64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.x86_64.rpm ctdb-4.17.5-3.u2.fos23.x86_64.rpm samba-help-4.17.5-3.u2.fos23.x86_64.rpm samba-4.17.5-3.u2.fos23.aarch64.rpm samba-libs-4.17.5-3.u2.fos23.aarch64.rpm samba-client-4.17.5-3.u2.fos23.aarch64.rpm samba-common-4.17.5-3.u2.fos23.aarch64.rpm samba-common-tools-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-provision-4.17.5-3.u2.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-3.u2.fos23.aarch64.rpm samba-devel-4.17.5-3.u2.fos23.aarch64.rpm samba-krb5-printing-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-4.17.5-3.u2.fos23.aarch64.rpm libsmbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-4.17.5-3.u2.fos23.aarch64.rpm libwbclient-devel-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-test-4.17.5-3.u2.fos23.aarch64.rpm python3-samba-dc-4.17.5-3.u2.fos23.aarch64.rpm samba-test-4.17.5-3.u2.fos23.aarch64.rpm samba-usershares-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-clients-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-3.u2.fos23.aarch64.rpm samba-winbind-modules-4.17.5-3.u2.fos23.aarch64.rpm ctdb-4.17.5-3.u2.fos23.aarch64.rpm samba-help-4.17.5-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2147 Important FusionOS CVE-2023-33204:sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377. FusionOS sysstat-12.5.4-8.u2.fos23.x86_64.rpm sysstat-12.5.4-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2148 Moderate FusionOS CVE-2022-0563:A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4. FusionOS util-linux-2.37.2-19.u6.fos23.x86_64.rpm libfdisk-2.37.2-19.u6.fos23.x86_64.rpm libsmartcols-2.37.2-19.u6.fos23.x86_64.rpm libmount-2.37.2-19.u6.fos23.x86_64.rpm libblkid-2.37.2-19.u6.fos23.x86_64.rpm uuidd-2.37.2-19.u6.fos23.x86_64.rpm libuuid-2.37.2-19.u6.fos23.x86_64.rpm util-linux-user-2.37.2-19.u6.fos23.x86_64.rpm python3-libmount-2.37.2-19.u6.fos23.x86_64.rpm util-linux-devel-2.37.2-19.u6.fos23.x86_64.rpm util-linux-help-2.37.2-19.u6.fos23.noarch.rpm util-linux-2.37.2-19.u6.fos23.aarch64.rpm libfdisk-2.37.2-19.u6.fos23.aarch64.rpm libsmartcols-2.37.2-19.u6.fos23.aarch64.rpm libmount-2.37.2-19.u6.fos23.aarch64.rpm libblkid-2.37.2-19.u6.fos23.aarch64.rpm uuidd-2.37.2-19.u6.fos23.aarch64.rpm libuuid-2.37.2-19.u6.fos23.aarch64.rpm util-linux-user-2.37.2-19.u6.fos23.aarch64.rpm python3-libmount-2.37.2-19.u6.fos23.aarch64.rpm util-linux-devel-2.37.2-19.u6.fos23.aarch64.rpm FusionOS-SA-2023-2149 Important FusionOS CVE-2023-2609:NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2610:Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. FusionOS vim-common-9.0-15.u8.fos23.x86_64.rpm vim-minimal-9.0-15.u8.fos23.x86_64.rpm vim-enhanced-9.0-15.u8.fos23.x86_64.rpm vim-filesystem-9.0-15.u8.fos23.noarch.rpm vim-X11-9.0-15.u8.fos23.x86_64.rpm vim-common-9.0-15.u8.fos23.aarch64.rpm vim-minimal-9.0-15.u8.fos23.aarch64.rpm vim-enhanced-9.0-15.u8.fos23.aarch64.rpm vim-X11-9.0-15.u8.fos23.aarch64.rpm FusionOS-SA-2023-2150 Important FusionOS CVE-2023-28204:A flaw was found in the webkitgtk package. An out of bounds read may be possible when processing malicious web content, which can lead to information disclosure. CVE-2023-32373:A use after free vulnerability was found in the webkitgtk package. Processing maliciously crafted web content may lead to arbitrary code execution. CVE-2023-32409:A flaw was found in the WebGPU, part of the Webkit project. This flaw allows a remote attacker to break out of the Web Content sandbox. FusionOS webkit2gtk3-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.x86_64.rpm webkit2gtk3-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-devel-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-2.36.3-4.u1.fos23.aarch64.rpm webkit2gtk3-jsc-devel-2.36.3-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2151 Important FusionOS CVE-2023-0668:Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark. CVE-2023-2855:Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2856:VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2857:BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2858:NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file CVE-2023-2879:GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.11-4.u3.fos23.x86_64.rpm wireshark-devel-3.6.11-4.u3.fos23.x86_64.rpm wireshark-help-3.6.11-4.u3.fos23.x86_64.rpm wireshark-3.6.11-4.u3.fos23.aarch64.rpm wireshark-devel-3.6.11-4.u3.fos23.aarch64.rpm wireshark-help-3.6.11-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2152 Important FusionOS CVE-2022-3550:A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. FusionOS xorg-x11-server-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-source-1.20.11-20.u7.fos23.noarch.rpm xorg-x11-server-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-20.u7.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-20.u7.fos23.aarch64.rpm FusionOS-SA-2023-2153 Critical FusionOS CVE-2021-33454:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr_get_intnum() in libyasm/expr.c. CVE-2021-33455:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in do_directive() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33456:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in hash() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33457:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmac_params() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33458:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in find_cc() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33459:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. CVE-2021-33460:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in if_condition() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33461:An issue was discovered in yasm version 1.3.0. There is a use-after-free in yasm_intnum_destroy() in libyasm/intnum.c. CVE-2021-33462:An issue was discovered in yasm version 1.3.0. There is a use-after-free in expr_traverse_nodes_post() in libyasm/expr.c. CVE-2021-33463:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c. CVE-2021-33464:An issue was discovered in yasm version 1.3.0. There is a heap-buffer-overflow in inc_fopen() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33465:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_mmacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33466:An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in expand_smacro() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33467:An issue was discovered in yasm version 1.3.0. There is a use-after-free in pp_getline() in modules/preprocs/nasm/nasm-pp.c. CVE-2021-33468:An issue was discovered in yasm version 1.3.0. There is a use-after-free in error() in modules/preprocs/nasm/nasm-pp.c. CVE-2023-30402:yasm v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re CVE-2023-31972:yasm v1.3.0 was discovered to contain a use after free via the function pp_getline at /nasm/nasm-pp.c. CVE-2023-31973:yasm v1.3.0 was discovered to contain a use after free via the function expand_mmac_params at /nasm/nasm-pp.c. CVE-2023-31974:yasm v1.3.0 was discovered to contain a use after free via the function error at /nasm/nasm-pp.c. CVE-2023-31975:yasm v1.3.0 was discovered to contain a memory leak via the function yasm_intnum_copy at /libyasm/intnum.c. FusionOS yasm-1.3.0-10.u1.fos23.x86_64.rpm yasm-1.3.0-10.u1.fos23.aarch64.rpm FusionOS-SA-2023-2154 Important FusionOS CVE-2022-35737:SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API. FusionOS perl-DBD-SQLite-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.x86_64.rpm perl-DBD-SQLite-1.70-2.u1.fos23.aarch64.rpm perl-DBD-SQLite-help-1.70-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2155 Important FusionOS CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). FusionOS shim-15.6-9.u6.fos23.x86_64.rpm shim-15.6-9.u6.fos23.aarch64.rpm FusionOS-SA-2023-2156 Critical FusionOS CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. FusionOS syslinux-6.04-13.u1.fos23.x86_64.rpm syslinux-perl-6.04-13.u1.fos23.x86_64.rpm syslinux-devel-6.04-13.u1.fos23.x86_64.rpm syslinux-extlinux-6.04-13.u1.fos23.x86_64.rpm syslinux-tftpboot-6.04-13.u1.fos23.noarch.rpm syslinux-extlinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-nonlinux-6.04-13.u1.fos23.noarch.rpm syslinux-efi64-6.04-13.u1.fos23.x86_64.rpm FusionOS-SA-2023-2157 Important FusionOS CVE-2023-2911:If the `recursive-clients` quota is reached on a BIND 9 resolver configured with both `stale-answer-enable yes;` and `stale-answer-client-timeout 0;`, a sequence of serve-stale-related lookups could cause `named` to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versions 9.16.33 through 9.16.41, 9.18.7 through 9.18.15, 9.16.33-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. CVE-2023-2828:Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to authoritative servers. The size limit for that cache database can be configured using the max-cache-size statement in the configuration file; it defaults to 90% of the total amount of memory available on the host. When the size of the cache reaches 7/8 of the configured limit, a cache-cleaning algorithm starts to remove expired and/or least-recently used RRsets from the cache, to keep memory use below the configured limit.It has been discovered that the effectiveness of the cache-cleaning algorithm used in named can be severely diminished by querying the resolver for specific RRsets in a certain order, effectively allowing the configured max-cache-size limit to be significantly exceeded.This issue affects BIND 9 versions 9.11.0 through 9.16.41, 9.18.0 through 9.18.15, 9.19.0 through 9.19.13, 9.11.3-S1 through 9.16.41-S1, and 9.18.11-S1 through 9.18.15-S1. FusionOS bind-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-18.u5.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-18.u5.fos23.x86_64.rpm bind-libs-9.16.23-18.u5.fos23.x86_64.rpm bind-license-9.16.23-18.u5.fos23.noarch.rpm bind-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-18.u5.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-18.u5.fos23.noarch.rpm bind-devel-9.16.23-18.u5.fos23.x86_64.rpm bind-chroot-9.16.23-18.u5.fos23.x86_64.rpm python3-bind-9.16.23-18.u5.fos23.noarch.rpm bind-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-18.u5.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-18.u5.fos23.aarch64.rpm bind-libs-9.16.23-18.u5.fos23.aarch64.rpm bind-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-18.u5.fos23.aarch64.rpm bind-devel-9.16.23-18.u5.fos23.aarch64.rpm bind-chroot-9.16.23-18.u5.fos23.aarch64.rpm FusionOS-SA-2023-2158 Moderate FusionOS CVE-2023-33201:Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without any escaping, which leads to an LDAP injection vulnerability. FusionOS bouncycastle-1.67-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2159 Important FusionOS CVE-2023-34241:OpenPrinting CUPS is a standards-based, open source printing system for Linux and other Unix-like operating systems. Starting in version 2.0.0 and prior to version 2.4.6, CUPS logs data of free memory to the logging service AFTER the connection has been closed, when it should have logged the data right before. This is a use-after-free bug that impacts the entire cupsd process. The exact cause of this issue is the function `httpClose(con->http)` being called in `scheduler/client.c`. The problem is that httpClose always, provided its argument is not null, frees the pointer at the end of the call, only for cupsdLogClient to pass the pointer to httpGetHostname. This issue happens in function `cupsdAcceptClient` if LogLevel is warn or higher and in two scenarios: there is a double-lookup for the IP Address (HostNameLookups Double is set in `cupsd.conf`) which fails to resolve, or if CUPS is compiled with TCP wrappers and the connection is refused by rules from `/etc/hosts.allow` and `/etc/hosts.deny`. Version 2.4.6 has a patch for this issue. FusionOS cups-2.4.0-8.u3.fos23.x86_64.rpm cups-client-2.4.0-8.u3.fos23.x86_64.rpm cups-devel-2.4.0-8.u3.fos23.x86_64.rpm cups-libs-2.4.0-8.u3.fos23.x86_64.rpm cups-filesystem-2.4.0-8.u3.fos23.noarch.rpm cups-lpd-2.4.0-8.u3.fos23.x86_64.rpm cups-ipptool-2.4.0-8.u3.fos23.x86_64.rpm cups-printerapp-2.4.0-8.u3.fos23.x86_64.rpm cups-help-2.4.0-8.u3.fos23.noarch.rpm cups-2.4.0-8.u3.fos23.aarch64.rpm cups-client-2.4.0-8.u3.fos23.aarch64.rpm cups-devel-2.4.0-8.u3.fos23.aarch64.rpm cups-libs-2.4.0-8.u3.fos23.aarch64.rpm cups-lpd-2.4.0-8.u3.fos23.aarch64.rpm cups-ipptool-2.4.0-8.u3.fos23.aarch64.rpm cups-printerapp-2.4.0-8.u3.fos23.aarch64.rpm FusionOS-SA-2023-2160 Moderate FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. FusionOS edk2-devel-202011-12.u3.fos23.x86_64.rpm python3-edk2-devel-202011-12.u3.fos23.noarch.rpm edk2-help-202011-12.u3.fos23.noarch.rpm edk2-ovmf-202011-12.u3.fos23.noarch.rpm edk2-devel-202011-12.u3.fos23.aarch64.rpm FusionOS-SA-2023-2161 Critical FusionOS CVE-2020-25969:gnuplot v5.5 was discovered to contain a buffer overflow via the function plotrequest(). FusionOS gnuplot-5.0.6-14.u1.fos23.x86_64.rpm gnuplot-help-5.0.6-14.u1.fos23.noarch.rpm gnuplot-5.0.6-14.u1.fos23.aarch64.rpm FusionOS-SA-2023-2162 Critical FusionOS CVE-2023-29402:The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via go get , are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected). CVE-2023-29403:On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers. CVE-2023-29404:he go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers. CVE-2023-29405:The go command may execute arbitrary code at build time when using cgo. This may occur when running go get on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler. FusionOS golang-1.20.5-1.u2.fos23.x86_64.rpm golang-help-1.20.5-1.u2.fos23.noarch.rpm golang-devel-1.20.5-1.u2.fos23.noarch.rpm golang-1.20.5-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2163 Important FusionOS CVE-2023-2976:Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. FusionOS guava-25.0-6.u1.fos23.noarch.rpm guava-help-25.0-6.u1.fos23.noarch.rpm guava-testlib-25.0-6.u1.fos23.noarch.rpm FusionOS-SA-2023-2164 Important FusionOS CVE-2023-3389:A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Racing a io_uring cancel poll request with a linked timeout can cause a UAF in a hrtimer. CVE-2023-3090:A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. CVE-2023-3327:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. CVE-2023-35823:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c. CVE-2023-35824:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c. CVE-2023-3006:A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim s hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible. CVE-2023-31084:An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process. CVE-2023-35828:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c. CVE-2023-35788:An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation. CVE-2023-3358:A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system. CVE-2022-48502:An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c. CVE-2023-33288:An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition. CVE-2023-2985:A use after free flaw was found in hfsplus_put_super in fs/hfsplus/super.c in the Linux Kernel. This flaw could allow a local user to cause a denial of service problem. CVE-2023-3161:A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service. CVE-2023-3212:A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file systems when the evict code tries to reference the journal descriptor structure after it has been freed and set to NULL. A privileged local user could use this flaw to cause a kernel panic. CVE-2023-3268:An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could allow a local attacker to crash the system or leak kernel internal information. CVE-2023-35829:An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c. CVE-2023-3141:A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak. FusionOS kernel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-headers-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-devel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-tools-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm perf-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm python3-perf-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm bpftool-5.10.0-136.40.0.117.u69.fos23.x86_64.rpm kernel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-headers-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-devel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-tools-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm perf-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm python3-perf-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm bpftool-5.10.0-136.40.0.117.u69.fos23.aarch64.rpm FusionOS-SA-2023-2165 Moderate FusionOS CVE-2023-35789:An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. FusionOS librabbitmq-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-devel-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-help-0.9.0-9.u1.fos23.x86_64.rpm librabbitmq-0.9.0-9.u1.fos23.aarch64.rpm librabbitmq-devel-0.9.0-9.u1.fos23.aarch64.rpm librabbitmq-help-0.9.0-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2166 Moderate FusionOS CVE-2023-26965:loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use after free via a crafted TIFF image. CVE-2023-3316:A NULL pointer dereference in TIFFClose() is caused by a failure to open an output file (non-existent path or a path that requires permissions like /dev/null) while specifying zones. CVE-2023-25433:libtiff 4.5.0 is vulnerable to Buffer Overflow via /libtiff/tools/tiffcrop.c:8499. Incorrect updating of buffer size after rotateImage() in tiffcrop cause heap-buffer-overflow and SEGV. CVE-2023-26966:libtiff 4.5.0 is vulnerable to Buffer Overflow in uv_encode() when libtiff reads a corrupted little-endian TIFF file and specifies the output to be big-endian. CVE-2023-2908:A null pointer dereference issue was found in Libtiff's tif_dir.c file. This issue may allow an attacker to pass a crafted TIFF image file to the tiffcp utility which triggers a runtime error that causes undefined behavior. This will result in an application crash, eventually leading to a denial of service. CVE-2023-3576:A vulnerability was found in libtiff where a memory leak exists in tools/tiffcrop.c FusionOS libtiff-4.3.0-29.u5.fos23.x86_64.rpm libtiff-devel-4.3.0-29.u5.fos23.x86_64.rpm libtiff-static-4.3.0-29.u5.fos23.x86_64.rpm libtiff-tools-4.3.0-29.u5.fos23.x86_64.rpm libtiff-help-4.3.0-29.u5.fos23.noarch.rpm libtiff-4.3.0-29.u5.fos23.aarch64.rpm libtiff-devel-4.3.0-29.u5.fos23.aarch64.rpm libtiff-static-4.3.0-29.u5.fos23.aarch64.rpm libtiff-tools-4.3.0-29.u5.fos23.aarch64.rpm FusionOS-SA-2023-2167 Important FusionOS CVE-2023-29491:curses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. FusionOS ncurses-6.3-7.u2.fos23.x86_64.rpm ncurses-base-6.3-7.u2.fos23.noarch.rpm ncurses-libs-6.3-7.u2.fos23.x86_64.rpm ncurses-devel-6.3-7.u2.fos23.x86_64.rpm ncurses-compat-libs-6.3-7.u2.fos23.x86_64.rpm ncurses-static-6.3-7.u2.fos23.x86_64.rpm ncurses-help-6.3-7.u2.fos23.x86_64.rpm ncurses-6.3-7.u2.fos23.aarch64.rpm ncurses-libs-6.3-7.u2.fos23.aarch64.rpm ncurses-devel-6.3-7.u2.fos23.aarch64.rpm ncurses-compat-libs-6.3-7.u2.fos23.aarch64.rpm ncurses-static-6.3-7.u2.fos23.aarch64.rpm ncurses-help-6.3-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2168 Important FusionOS CVE-2022-4304:A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-0466:The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification. However the implementation of the function does not enable the check which allows certificates with invalid or incorrect policies to pass the certificate verification. As suddenly enabling the policy check could break existing deployments it was decided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy() function. Instead the applications that require OpenSSL to perform certificate policy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly enable the policy check by calling X509_VERIFY_PARAM_set_flags() with the X509_V_FLAG_POLICY_CHECK flag argument. Certificate policy checks are disabled by default in OpenSSL and are not commonly used by applications. CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openresty-openssl111-asan-1.1.1h-2.u2.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2169 Important FusionOS CVE-2023-31486:HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. FusionOS perl-HTTP-Tiny-0.080-2.u1.fos23.noarch.rpm perl-HTTP-Tiny-help-0.080-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2170 Moderate FusionOS CVE-2023-36617:A ReDoS issue was discovered in the URI component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a fixed version. FusionOS ruby-3.0.3-131.u3.fos23.x86_64.rpm ruby-devel-3.0.3-131.u3.fos23.x86_64.rpm rubygems-3.2.32-131.u3.fos23.noarch.rpm rubygems-devel-3.2.32-131.u3.fos23.noarch.rpm rubygem-rake-13.0.3-131.u3.fos23.noarch.rpm rubygem-rbs-1.4.0-131.u3.fos23.noarch.rpm ruby-irb-3.0.3-131.u3.fos23.noarch.rpm rubygem-rdoc-6.3.3-131.u3.fos23.noarch.rpm ruby-help-3.0.3-131.u3.fos23.noarch.rpm rubygem-bigdecimal-3.0.0-131.u3.fos23.x86_64.rpm rubygem-did_you_mean-1.5.0-131.u3.fos23.noarch.rpm rubygem-io-console-0.5.7-131.u3.fos23.x86_64.rpm rubygem-json-2.5.1-131.u3.fos23.x86_64.rpm rubygem-minitest-5.14.2-131.u3.fos23.noarch.rpm rubygem-openssl-2.2.1-131.u3.fos23.x86_64.rpm rubygem-power_assert-1.2.0-131.u3.fos23.noarch.rpm rubygem-psych-3.3.2-131.u3.fos23.x86_64.rpm rubygem-test-unit-3.3.7-131.u3.fos23.noarch.rpm rubygem-rexml-3.2.5-131.u3.fos23.noarch.rpm rubygem-rss-0.2.9-131.u3.fos23.noarch.rpm rubygem-typeprof-0.15.2-131.u3.fos23.noarch.rpm ruby-3.0.3-131.u3.fos23.aarch64.rpm ruby-devel-3.0.3-131.u3.fos23.aarch64.rpm rubygem-bigdecimal-3.0.0-131.u3.fos23.aarch64.rpm rubygem-io-console-0.5.7-131.u3.fos23.aarch64.rpm rubygem-json-2.5.1-131.u3.fos23.aarch64.rpm rubygem-openssl-2.2.1-131.u3.fos23.aarch64.rpm rubygem-psych-3.3.2-131.u3.fos23.aarch64.rpm FusionOS-SA-2023-2171 Important FusionOS CVE-2023-34454:snappy-java is a fast compressor/decompressor for Java. Due to unchecked multiplications, an integer overflow may occur in versions prior to 1.1.10.1, causing an unrecoverable fatal error. The function `compress(char[] input)` in the file `Snappy.java` receives an array of characters and compresses it. It does so by multiplying the length by 2 and passing it to the rawCompress` function. Since the length is not tested, the multiplication by two can cause an integer overflow and become negative. The rawCompress function then uses the received length and passes it to the natively compiled maxCompressedLength function, using the returned value to allocate a byte array. Since the maxCompressedLength function treats the length as an unsigned integer, it doesn’t care that it is negative, and it returns a valid value, which is casted to a signed integer by the Java engine. If the result is negative, a `java.lang.NegativeArraySizeException` exception will be raised while trying to allocate the array `buf`. On the other side, if the result is positive, the `buf` array will successfully be allocated, but its size might be too small to use for the compression, causing a fatal Access Violation error. The same issue exists also when using the `compress` functions that receive double, float, int, long and short, each using a different multiplier that may cause the same issue. The issue most likely won’t occur when using a byte array, since creating a byte array of size 0x80000000 (or any other negative value) is impossible in the first place. CVE-2023-34455:snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does that by attempting to read 4 bytes. If it wasn’t possible to read the 4 bytes, the function returns false. Otherwise, if 4 bytes were available, the code treats them as the length of the next chunk. In the case that the `compressed` variable is null, a byte array is allocated with the size given by the input data. Since the code doesn’t test the legality of the `chunkSize` variable, it is possible to pass a negative number (such as 0xFFFFFFFF which is -1), which will cause the code to raise a `java.lang.NegativeArraySizeException` exception. A worse case would happen when passing a huge positive value (such as 0x7FFFFFFF), which would raise the fatal `java.lang.OutOfMemoryError` error. Version 1.1.10.1 contains a patch for this issue. FusionOS snappy-java-1.1.2.4-2.u1.fos23.x86_64.rpm snappy-java-javadoc-1.1.2.4-2.u1.fos23.noarch.rpm snappy-java-1.1.2.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2172 Moderate FusionOS CVE-2023-1672:A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host. FusionOS tang-7-3.u2.fos23.x86_64.rpm tang-help-7-3.u2.fos23.noarch.rpm tang-7-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2173 Important FusionOS CVE-2023-32700:LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX before 23.5. FusionOS texlive-base-20180414-34.u1.fos23.x86_64.rpm texlive-a2ping-20180414-34.u1.fos23.noarch.rpm texlive-accfonts-20180414-34.u1.fos23.noarch.rpm texlive-adhocfilelist-20180414-34.u1.fos23.noarch.rpm texlive-afm2pl-20180414-34.u1.fos23.x86_64.rpm texlive-aleph-20180414-34.u1.fos23.x86_64.rpm texlive-amstex-20180414-34.u1.fos23.noarch.rpm texlive-arara-20180414-34.u1.fos23.noarch.rpm texlive-authorindex-20180414-34.u1.fos23.noarch.rpm texlive-autosp-20180414-34.u1.fos23.x86_64.rpm texlive-axodraw2-20180414-34.u1.fos23.x86_64.rpm texlive-bib2gls-20180414-34.u1.fos23.noarch.rpm texlive-bibexport-20180414-34.u1.fos23.noarch.rpm texlive-bibtex-20180414-34.u1.fos23.x86_64.rpm texlive-bibtexu-20180414-34.u1.fos23.x86_64.rpm texlive-bibtex8-20180414-34.u1.fos23.x86_64.rpm texlive-bundledoc-20180414-34.u1.fos23.noarch.rpm texlive-cachepic-20180414-34.u1.fos23.noarch.rpm texlive-checkcites-20180414-34.u1.fos23.noarch.rpm texlive-checklistings-20180414-34.u1.fos23.noarch.rpm texlive-chktex-20180414-34.u1.fos23.x86_64.rpm texlive-cjkutils-20180414-34.u1.fos23.x86_64.rpm texlive-context-20180414-34.u1.fos23.noarch.rpm texlive-convbkmk-20180414-34.u1.fos23.noarch.rpm texlive-crossrefware-20180414-34.u1.fos23.noarch.rpm texlive-cslatex-20180414-34.u1.fos23.noarch.rpm texlive-csplain-20180414-34.u1.fos23.noarch.rpm texlive-ctan-o-mat-20180414-34.u1.fos23.noarch.rpm texlive-ctanify-20180414-34.u1.fos23.noarch.rpm texlive-ctie-20180414-34.u1.fos23.x86_64.rpm texlive-cweb-20180414-34.u1.fos23.x86_64.rpm texlive-cyrillic-20180414-34.u1.fos23.noarch.rpm texlive-de-macro-20180414-34.u1.fos23.noarch.rpm texlive-detex-20180414-34.u1.fos23.x86_64.rpm texlive-diadia-20180414-34.u1.fos23.noarch.rpm texlive-dosepsbin-20180414-34.u1.fos23.noarch.rpm texlive-dtl-20180414-34.u1.fos23.x86_64.rpm texlive-dtxgen-20180414-34.u1.fos23.noarch.rpm texlive-dvi2tty-20180414-34.u1.fos23.x86_64.rpm texlive-dviasm-20180414-34.u1.fos23.noarch.rpm texlive-dvicopy-20180414-34.u1.fos23.x86_64.rpm texlive-dvidvi-20180414-34.u1.fos23.x86_64.rpm texlive-dviinfox-20180414-34.u1.fos23.noarch.rpm texlive-dviljk-20180414-34.u1.fos23.x86_64.rpm texlive-dvipdfmx-20180414-34.u1.fos23.x86_64.rpm texlive-dvipng-20180414-34.u1.fos23.x86_64.rpm texlive-dvipos-20180414-34.u1.fos23.x86_64.rpm texlive-dvips-20180414-34.u1.fos23.x86_64.rpm texlive-dvisvgm-20180414-34.u1.fos23.x86_64.rpm texlive-ebong-20180414-34.u1.fos23.noarch.rpm texlive-eplain-20180414-34.u1.fos23.noarch.rpm texlive-epspdf-20180414-34.u1.fos23.noarch.rpm texlive-epstopdf-20180414-34.u1.fos23.noarch.rpm texlive-fig4latex-20180414-34.u1.fos23.noarch.rpm texlive-findhyph-20180414-34.u1.fos23.noarch.rpm texlive-fontinst-20180414-34.u1.fos23.noarch.rpm texlive-fontools-20180414-34.u1.fos23.noarch.rpm texlive-fontware-20180414-34.u1.fos23.x86_64.rpm texlive-fragmaster-20180414-34.u1.fos23.noarch.rpm texlive-getmap-20180414-34.u1.fos23.noarch.rpm texlive-glossaries-20180414-34.u1.fos23.noarch.rpm texlive-glyphlist-20180414-34.u1.fos23.noarch.rpm texlive-gregoriotex-20180414-34.u1.fos23.x86_64.rpm texlive-gsftopk-20180414-34.u1.fos23.x86_64.rpm texlive-installfont-20180414-34.u1.fos23.noarch.rpm texlive-jadetex-20180414-34.u1.fos23.noarch.rpm texlive-jfmutil-20180414-34.u1.fos23.noarch.rpm texlive-kotex-utils-20180414-34.u1.fos23.noarch.rpm texlive-kpathsea-20180414-34.u1.fos23.x86_64.rpm texlive-l3build-20180414-34.u1.fos23.noarch.rpm texlive-lacheck-20180414-34.u1.fos23.x86_64.rpm texlive-latex-20180414-34.u1.fos23.noarch.rpm texlive-latex-git-log-20180414-34.u1.fos23.noarch.rpm texlive-latex-papersize-20180414-34.u1.fos23.noarch.rpm texlive-latex2man-20180414-34.u1.fos23.noarch.rpm texlive-latex2nemeth-20180414-34.u1.fos23.noarch.rpm texlive-latexdiff-20180414-34.u1.fos23.noarch.rpm texlive-latexfileversion-20180414-34.u1.fos23.noarch.rpm texlive-latexpand-20180414-34.u1.fos23.noarch.rpm texlive-lcdftypetools-20180414-34.u1.fos23.x86_64.rpm texlive-lib-20180414-34.u1.fos23.x86_64.rpm texlive-lib-devel-20180414-34.u1.fos23.x86_64.rpm texlive-lilyglyphs-20180414-34.u1.fos23.noarch.rpm texlive-listbib-20180414-34.u1.fos23.noarch.rpm texlive-listings-ext-20180414-34.u1.fos23.noarch.rpm texlive-lollipop-20180414-34.u1.fos23.noarch.rpm texlive-ltxfileinfo-20180414-34.u1.fos23.noarch.rpm texlive-ltximg-20180414-34.u1.fos23.noarch.rpm texlive-lua2dox-20180414-34.u1.fos23.noarch.rpm texlive-luaotfload-20180414-34.u1.fos23.noarch.rpm texlive-luatex-20180414-34.u1.fos23.x86_64.rpm texlive-lwarp-20180414-34.u1.fos23.noarch.rpm texlive-lyluatex-svn47584-34.u1.fos23.noarch.rpm texlive-make4ht-20180414-34.u1.fos23.noarch.rpm texlive-makedtx-20180414-34.u1.fos23.noarch.rpm texlive-makeindex-20180414-34.u1.fos23.x86_64.rpm texlive-match_parens-20180414-34.u1.fos23.noarch.rpm texlive-mathspic-20180414-34.u1.fos23.noarch.rpm texlive-metafont-20180414-34.u1.fos23.x86_64.rpm texlive-metapost-20180414-34.u1.fos23.x86_64.rpm texlive-mex-20180414-34.u1.fos23.noarch.rpm texlive-mflua-20180414-34.u1.fos23.x86_64.rpm texlive-mfware-20180414-34.u1.fos23.x86_64.rpm texlive-mf2pt1-20180414-34.u1.fos23.noarch.rpm texlive-mkgrkindex-20180414-34.u1.fos23.noarch.rpm texlive-mkjobtexmf-20180414-34.u1.fos23.noarch.rpm texlive-mkpic-20180414-34.u1.fos23.noarch.rpm texlive-mltex-20180414-34.u1.fos23.noarch.rpm texlive-mptopdf-20180414-34.u1.fos23.noarch.rpm texlive-multibibliography-20180414-34.u1.fos23.noarch.rpm texlive-musixtex-20180414-34.u1.fos23.noarch.rpm texlive-musixtnt-20180414-34.u1.fos23.x86_64.rpm texlive-m-tx-20180414-34.u1.fos23.x86_64.rpm texlive-oberdiek-20180414-34.u1.fos23.noarch.rpm texlive-omegaware-20180414-34.u1.fos23.x86_64.rpm texlive-patgen-20180414-34.u1.fos23.x86_64.rpm texlive-pax-20180414-34.u1.fos23.noarch.rpm texlive-pdfbook2-20180414-34.u1.fos23.noarch.rpm texlive-pdfcrop-20180414-34.u1.fos23.noarch.rpm texlive-pdfjam-20180414-34.u1.fos23.noarch.rpm texlive-pdflatexpicscale-20180414-34.u1.fos23.noarch.rpm texlive-pdftex-20180414-34.u1.fos23.x86_64.rpm texlive-pdftools-20180414-34.u1.fos23.x86_64.rpm texlive-pdfxup-20180414-34.u1.fos23.noarch.rpm texlive-pedigree-perl-20180414-34.u1.fos23.noarch.rpm texlive-perltex-20180414-34.u1.fos23.noarch.rpm texlive-petri-nets-20180414-34.u1.fos23.noarch.rpm texlive-pfarrei-20180414-34.u1.fos23.noarch.rpm texlive-pkfix-20180414-34.u1.fos23.noarch.rpm texlive-pkfix-helper-20180414-34.u1.fos23.noarch.rpm texlive-pmx-20180414-34.u1.fos23.x86_64.rpm texlive-pmxchords-20180414-34.u1.fos23.noarch.rpm texlive-pstools-20180414-34.u1.fos23.x86_64.rpm texlive-pst2pdf-20180414-34.u1.fos23.noarch.rpm texlive-pst-pdf-20180414-34.u1.fos23.noarch.rpm texlive-ps2pk-20180414-34.u1.fos23.x86_64.rpm texlive-ptex-20180414-34.u1.fos23.x86_64.rpm texlive-ptex-fontmaps-20180414-34.u1.fos23.noarch.rpm texlive-ptex2pdf-20180414-34.u1.fos23.noarch.rpm texlive-purifyeps-20180414-34.u1.fos23.noarch.rpm texlive-pygmentex-20180414-34.u1.fos23.noarch.rpm texlive-pythontex-20180414-34.u1.fos23.noarch.rpm texlive-rubik-20180414-34.u1.fos23.noarch.rpm texlive-seetexk-20180414-34.u1.fos23.x86_64.rpm texlive-splitindex-20180414-34.u1.fos23.noarch.rpm texlive-srcredact-20180414-34.u1.fos23.noarch.rpm texlive-sty2dtx-20180414-34.u1.fos23.noarch.rpm texlive-svn-multi-20180414-34.u1.fos23.noarch.rpm texlive-synctex-20180414-34.u1.fos23.x86_64.rpm texlive-tetex-20180414-34.u1.fos23.noarch.rpm texlive-tex-20180414-34.u1.fos23.x86_64.rpm texlive-tex4ebook-20180414-34.u1.fos23.noarch.rpm texlive-tex4ht-20180414-34.u1.fos23.x86_64.rpm texlive-texconfig-20180414-34.u1.fos23.noarch.rpm texlive-texcount-20180414-34.u1.fos23.noarch.rpm texlive-texdef-20180414-34.u1.fos23.noarch.rpm texlive-texdiff-20180414-34.u1.fos23.noarch.rpm texlive-texdirflatten-20180414-34.u1.fos23.noarch.rpm texlive-texdoc-20180414-34.u1.fos23.noarch.rpm texlive-texdoctk-20180414-34.u1.fos23.noarch.rpm texlive-texfot-20180414-34.u1.fos23.noarch.rpm texlive-texliveonfly-20180414-34.u1.fos23.noarch.rpm texlive-texlive-en-20180414-34.u1.fos23.noarch.rpm texlive-texlive-scripts-20180414-34.u1.fos23.noarch.rpm texlive-texlive.infra-20180414-34.u1.fos23.noarch.rpm texlive-texloganalyser-20180414-34.u1.fos23.noarch.rpm texlive-texosquery-20180414-34.u1.fos23.noarch.rpm texlive-texsis-20180414-34.u1.fos23.noarch.rpm texlive-texware-20180414-34.u1.fos23.x86_64.rpm texlive-thumbpdf-20180414-34.u1.fos23.noarch.rpm texlive-tie-20180414-34.u1.fos23.x86_64.rpm texlive-tpic2pdftex-20180414-34.u1.fos23.noarch.rpm texlive-ttfutils-20180414-34.u1.fos23.x86_64.rpm texlive-typeoutfileinfo-20180414-34.u1.fos23.noarch.rpm texlive-ulqda-20180414-34.u1.fos23.noarch.rpm texlive-uptex-20180414-34.u1.fos23.x86_64.rpm texlive-urlbst-20180414-34.u1.fos23.noarch.rpm texlive-velthuis-20180414-34.u1.fos23.x86_64.rpm texlive-vlna-20180414-34.u1.fos23.x86_64.rpm texlive-vpe-20180414-34.u1.fos23.noarch.rpm texlive-web-20180414-34.u1.fos23.x86_64.rpm texlive-wordcount-20180414-34.u1.fos23.noarch.rpm texlive-xdvi-20180414-34.u1.fos23.x86_64.rpm texlive-xetex-20180414-34.u1.fos23.x86_64.rpm texlive-xmltex-20180414-34.u1.fos23.noarch.rpm texlive-yplan-20180414-34.u1.fos23.noarch.rpm texlive-base-20180414-34.u1.fos23.aarch64.rpm texlive-afm2pl-20180414-34.u1.fos23.aarch64.rpm texlive-aleph-20180414-34.u1.fos23.aarch64.rpm texlive-autosp-20180414-34.u1.fos23.aarch64.rpm texlive-axodraw2-20180414-34.u1.fos23.aarch64.rpm texlive-bibtex-20180414-34.u1.fos23.aarch64.rpm texlive-bibtexu-20180414-34.u1.fos23.aarch64.rpm texlive-bibtex8-20180414-34.u1.fos23.aarch64.rpm texlive-chktex-20180414-34.u1.fos23.aarch64.rpm texlive-cjkutils-20180414-34.u1.fos23.aarch64.rpm texlive-ctie-20180414-34.u1.fos23.aarch64.rpm texlive-cweb-20180414-34.u1.fos23.aarch64.rpm texlive-detex-20180414-34.u1.fos23.aarch64.rpm texlive-dtl-20180414-34.u1.fos23.aarch64.rpm texlive-dvi2tty-20180414-34.u1.fos23.aarch64.rpm texlive-dvicopy-20180414-34.u1.fos23.aarch64.rpm texlive-dvidvi-20180414-34.u1.fos23.aarch64.rpm texlive-dviljk-20180414-34.u1.fos23.aarch64.rpm texlive-dvipdfmx-20180414-34.u1.fos23.aarch64.rpm texlive-dvipng-20180414-34.u1.fos23.aarch64.rpm texlive-dvipos-20180414-34.u1.fos23.aarch64.rpm texlive-dvips-20180414-34.u1.fos23.aarch64.rpm texlive-dvisvgm-20180414-34.u1.fos23.aarch64.rpm texlive-fontware-20180414-34.u1.fos23.aarch64.rpm texlive-gregoriotex-20180414-34.u1.fos23.aarch64.rpm texlive-gsftopk-20180414-34.u1.fos23.aarch64.rpm texlive-kpathsea-20180414-34.u1.fos23.aarch64.rpm texlive-lacheck-20180414-34.u1.fos23.aarch64.rpm texlive-lcdftypetools-20180414-34.u1.fos23.aarch64.rpm texlive-lib-20180414-34.u1.fos23.aarch64.rpm texlive-lib-devel-20180414-34.u1.fos23.aarch64.rpm texlive-luatex-20180414-34.u1.fos23.aarch64.rpm texlive-makeindex-20180414-34.u1.fos23.aarch64.rpm texlive-metafont-20180414-34.u1.fos23.aarch64.rpm texlive-metapost-20180414-34.u1.fos23.aarch64.rpm texlive-mflua-20180414-34.u1.fos23.aarch64.rpm texlive-mfware-20180414-34.u1.fos23.aarch64.rpm texlive-musixtnt-20180414-34.u1.fos23.aarch64.rpm texlive-m-tx-20180414-34.u1.fos23.aarch64.rpm texlive-omegaware-20180414-34.u1.fos23.aarch64.rpm texlive-patgen-20180414-34.u1.fos23.aarch64.rpm texlive-pdftex-20180414-34.u1.fos23.aarch64.rpm texlive-pdftools-20180414-34.u1.fos23.aarch64.rpm texlive-pmx-20180414-34.u1.fos23.aarch64.rpm texlive-pstools-20180414-34.u1.fos23.aarch64.rpm texlive-ps2pk-20180414-34.u1.fos23.aarch64.rpm texlive-ptex-20180414-34.u1.fos23.aarch64.rpm texlive-seetexk-20180414-34.u1.fos23.aarch64.rpm texlive-synctex-20180414-34.u1.fos23.aarch64.rpm texlive-tex-20180414-34.u1.fos23.aarch64.rpm texlive-tex4ht-20180414-34.u1.fos23.aarch64.rpm texlive-texware-20180414-34.u1.fos23.aarch64.rpm texlive-tie-20180414-34.u1.fos23.aarch64.rpm texlive-ttfutils-20180414-34.u1.fos23.aarch64.rpm texlive-uptex-20180414-34.u1.fos23.aarch64.rpm texlive-velthuis-20180414-34.u1.fos23.aarch64.rpm texlive-vlna-20180414-34.u1.fos23.aarch64.rpm texlive-web-20180414-34.u1.fos23.aarch64.rpm texlive-xdvi-20180414-34.u1.fos23.aarch64.rpm texlive-xetex-20180414-34.u1.fos23.aarch64.rpm FusionOS-SA-2023-2174 Critical FusionOS CVE-2023-0667:Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark CVE-2023-2952:XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-1.u4.fos23.x86_64.rpm wireshark-devel-3.6.14-1.u4.fos23.x86_64.rpm wireshark-help-3.6.14-1.u4.fos23.x86_64.rpm wireshark-3.6.14-1.u4.fos23.aarch64.rpm wireshark-devel-3.6.14-1.u4.fos23.aarch64.rpm wireshark-help-3.6.14-1.u4.fos23.aarch64.rpm FusionOS-SA-2023-2175 Moderate FusionOS CVE-2023-3428:A vulnerability was found in ImageMagick <=7.1.1, where heap-based buffer overflow was found in coders/tiff.c. CVE-2023-34474:A heap-based buffer overflow issue was discovered in ImageMagick's ReadTIM2ImageData() function in coders/tim2.c. A local attacker could trick the user in opening specially crafted file, triggering an out-of-bounds read error, allowing an application to crash, resulting in a denial of service. CVE-2023-34475:A heap use after free issue was discovered in ImageMagick's ReplaceXmpValue() function in MagickCore/profile.c. An attacker could trick user to open a specially crafted file to convert, triggering an heap-use-after-free write error, allowing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-4.u4.fos23.x86_64.rpm ImageMagick-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-4.u4.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-4.u4.fos23.aarch64.rpm FusionOS-SA-2023-2176 Important FusionOS CVE-2023-37464:OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug allows an attacker to provide a truncated Authentication Tag and to modify the JWE accordingly. Users should upgrade to a version >= 0.6.2.2. Users unable to upgrade should avoid using AES GCM encryption and replace it with another encryption algorithm (e.g. AES CBC). FusionOS cjose-0.6.2.2-1.fos23.x86_64.rpm cjose-devel-0.6.2.2-1.fos23.x86_64.rpm cjose-0.6.2.2-1.fos23.aarch64.rpm cjose-devel-0.6.2.2-1.fos23.aarch64.rpm FusionOS-SA-2023-2177 Moderate FusionOS CVE-2023-32001:libcurl can be told to save cookie, HSTS and/or alt-svc data to files. When doing this, it called `stat()` followed by `fopen()` in a way that made it vulnerable to a TOCTOU race condition problem. By exploiting this flaw, an attacker could trick the victim to create or overwrite protected files holding this data in ways it was not intended to. FusionOS curl-7.79.1-23.u10.fos23.x86_64.rpm libcurl-7.79.1-23.u10.fos23.x86_64.rpm libcurl-devel-7.79.1-23.u10.fos23.x86_64.rpm curl-help-7.79.1-23.u10.fos23.noarch.rpm curl-7.79.1-23.u10.fos23.aarch64.rpm libcurl-7.79.1-23.u10.fos23.aarch64.rpm libcurl-devel-7.79.1-23.u10.fos23.aarch64.rpm FusionOS-SA-2023-2178 Moderate FusionOS CVE-2023-34969:D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6. FusionOS dbus-1.12.20-9.u1.fos23.x86_64.rpm dbus-libs-1.12.20-9.u1.fos23.x86_64.rpm dbus-daemon-1.12.20-9.u1.fos23.x86_64.rpm dbus-common-1.12.20-9.u1.fos23.noarch.rpm dbus-tools-1.12.20-9.u1.fos23.x86_64.rpm dbus-devel-1.12.20-9.u1.fos23.x86_64.rpm dbus-x11-1.12.20-9.u1.fos23.x86_64.rpm dbus-help-1.12.20-9.u1.fos23.noarch.rpm dbus-1.12.20-9.u1.fos23.aarch64.rpm dbus-libs-1.12.20-9.u1.fos23.aarch64.rpm dbus-daemon-1.12.20-9.u1.fos23.aarch64.rpm dbus-tools-1.12.20-9.u1.fos23.aarch64.rpm dbus-devel-1.12.20-9.u1.fos23.aarch64.rpm dbus-x11-1.12.20-9.u1.fos23.aarch64.rpm FusionOS-SA-2023-2179 Important FusionOS CVE-2021-44648:GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF files with lzw minimum code size equals to 12. FusionOS gdk-pixbuf2-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-modules-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-devel-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-tests-2.42.6-6.u1.fos23.x86_64.rpm gdk-pixbuf2-help-2.42.6-6.u1.fos23.noarch.rpm gdk-pixbuf2-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-modules-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-devel-2.42.6-6.u1.fos23.aarch64.rpm gdk-pixbuf2-tests-2.42.6-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2181 Important FusionOS CVE-2023-2976:Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows. FusionOS guava20-20.0-11.u1.fos23.noarch.rpm guava20-help-20.0-11.u1.fos23.noarch.rpm FusionOS-SA-2023-2182 Important FusionOS CVE-2023-38403:iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. FusionOS iperf3-3.10.1-3.u1.fos23.x86_64.rpm iperf3-devel-3.10.1-3.u1.fos23.x86_64.rpm iperf3-help-3.10.1-3.u1.fos23.noarch.rpm iperf3-3.10.1-3.u1.fos23.aarch64.rpm iperf3-devel-3.10.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2183 Important FusionOS CVE-2023-3117:A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous sets in batch requests, which can lead to performing arbitrary reads and writes in kernel memory. This flaw allows a local user with CAP_NET_ADMIN capability to crash or potentially escalate their privileges on the system. CVE-2023-3390:A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vulnerability. This flaw allows a local attacker with user access to cause a privilege escalation issue. We recommend upgrading past commit 1240eb93f0616b21c675416516ff3d74798fdc97. CVE-2022-45886:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. CVE-2023-3338:A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system. CVE-2023-3220:An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check of the return value of kzalloc() and will cause the NULL Pointer Dereference. CVE-2023-31248:Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-3567:A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This flaw allows an attacker with local user access to cause a system crash or leak internal kernel information. CVE-2023-2163:bpf: incorrect verifier pruning due to missing register precision taints, which may lead to out-of-band read/write access due to an incorrect verifier conclusion. CVE-2023-35001:Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace CVE-2023-32248:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_TREE_CONNECT and SMB2_QUERY_INFO commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32255:Linux Kernel ksmbd Session Setup Memory Leak Denial-of-Service Vulnerability FusionOS kernel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-headers-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-devel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-tools-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm perf-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm python3-perf-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm bpftool-5.10.0-136.42.0.120.u69.fos23.x86_64.rpm kernel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-headers-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-devel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-tools-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm perf-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm python3-perf-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm bpftool-5.10.0-136.42.0.120.u69.fos23.aarch64.rpm FusionOS-SA-2023-2184 Important FusionOS CVE-2023-3138:A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption. FusionOS libX11-1.7.2-6.u1.fos23.x86_64.rpm libX11-devel-1.7.2-6.u1.fos23.x86_64.rpm libX11-help-1.7.2-6.u1.fos23.noarch.rpm libX11-1.7.2-6.u1.fos23.aarch64.rpm libX11-devel-1.7.2-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2185 Critical FusionOS CVE-2023-39976:log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered. FusionOS libqb-2.0.0-2.u1.fos23.x86_64.rpm libqb-devel-2.0.0-2.u1.fos23.x86_64.rpm libqb-help-2.0.0-2.u1.fos23.noarch.rpm doxygen2man-2.0.0-2.u1.fos23.x86_64.rpm libqb-2.0.0-2.u1.fos23.aarch64.rpm libqb-devel-2.0.0-2.u1.fos23.aarch64.rpm doxygen2man-2.0.0-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2186 Low FusionOS CVE-2023-38288:Multiple potential integer overflow in raw2tiff.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow. CVE-2023-38289:Multiple potential integer overflow in tiffcp.c in libtiff <= 4.5.1 can allow remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image which triggers a heap-based buffer overflow. FusionOS libtiff-4.3.0-30.u6.fos23.x86_64.rpm libtiff-devel-4.3.0-30.u6.fos23.x86_64.rpm libtiff-static-4.3.0-30.u6.fos23.x86_64.rpm libtiff-tools-4.3.0-30.u6.fos23.x86_64.rpm libtiff-help-4.3.0-30.u6.fos23.noarch.rpm libtiff-4.3.0-30.u6.fos23.aarch64.rpm libtiff-devel-4.3.0-30.u6.fos23.aarch64.rpm libtiff-static-4.3.0-30.u6.fos23.aarch64.rpm libtiff-tools-4.3.0-30.u6.fos23.aarch64.rpm FusionOS-SA-2023-2187 Important FusionOS CVE-2023-35945:Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. FusionOS nghttp2-1.46.0-4.u2.fos23.x86_64.rpm libnghttp2-1.46.0-4.u2.fos23.x86_64.rpm libnghttp2-devel-1.46.0-4.u2.fos23.x86_64.rpm nghttp2-help-1.46.0-4.u2.fos23.noarch.rpm nghttp2-1.46.0-4.u2.fos23.aarch64.rpm libnghttp2-1.46.0-4.u2.fos23.aarch64.rpm libnghttp2-devel-1.46.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2188 Important FusionOS CVE-2023-0286:There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. FusionOS openresty-openssl111-asan-1.1.1h-2.u2.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2189 Critical FusionOS CVE-2023-38408:The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. FusionOS openssh-8.8p1-23.u12.fos23.x86_64.rpm openssh-clients-8.8p1-23.u12.fos23.x86_64.rpm openssh-server-8.8p1-23.u12.fos23.x86_64.rpm openssh-keycat-8.8p1-23.u12.fos23.x86_64.rpm openssh-askpass-8.8p1-23.u12.fos23.x86_64.rpm pam_ssh_agent_auth-0.10.4-4.23.u12.fos23.x86_64.rpm openssh-help-8.8p1-23.u12.fos23.noarch.rpm openssh-8.8p1-23.u12.fos23.aarch64.rpm openssh-clients-8.8p1-23.u12.fos23.aarch64.rpm openssh-server-8.8p1-23.u12.fos23.aarch64.rpm openssh-keycat-8.8p1-23.u12.fos23.aarch64.rpm openssh-askpass-8.8p1-23.u12.fos23.aarch64.rpm pam_ssh_agent_auth-0.10.4-4.23.u12.fos23.aarch64.rpm FusionOS-SA-2023-2190 Moderate FusionOS CVE-2023-3817:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. CVE-2023-3446:Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ('p' parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulernable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the '-check' option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue. FusionOS openssl-1.1.1m-25.u10.fos23.x86_64.rpm openssl-libs-1.1.1m-25.u10.fos23.x86_64.rpm openssl-perl-1.1.1m-25.u10.fos23.x86_64.rpm openssl-devel-1.1.1m-25.u10.fos23.x86_64.rpm openssl-help-1.1.1m-25.u10.fos23.noarch.rpm openssl-1.1.1m-25.u10.fos23.aarch64.rpm openssl-libs-1.1.1m-25.u10.fos23.aarch64.rpm openssl-perl-1.1.1m-25.u10.fos23.aarch64.rpm openssl-devel-1.1.1m-25.u10.fos23.aarch64.rpm FusionOS-SA-2023-2191 Important FusionOS CVE-2022-41409:Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input. FusionOS pcre2-10.39-9.u3.fos23.x86_64.rpm pcre2-devel-10.39-9.u3.fos23.x86_64.rpm pcre2-help-10.39-9.u3.fos23.noarch.rpm pcre2-10.39-9.u3.fos23.aarch64.rpm pcre2-devel-10.39-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2192 Important FusionOS CVE-2023-31486:HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. FusionOS perl-5.34.0-8.u2.fos23.x86_64.rpm perl-libs-5.34.0-8.u2.fos23.x86_64.rpm perl-devel-5.34.0-8.u2.fos23.x86_64.rpm perl-help-5.34.0-8.u2.fos23.noarch.rpm perl-5.34.0-8.u2.fos23.aarch64.rpm perl-libs-5.34.0-8.u2.fos23.aarch64.rpm perl-devel-5.34.0-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2193 Important FusionOS CVE-2023-31484:CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. FusionOS perl-CPAN-2.29-2.u1.fos23.noarch.rpm perl-CPAN-help-2.29-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2194 Moderate FusionOS CVE-2022-41946:pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `PreparedStatemet.setBytea(int, InputStream)` will create a temporary file if the InputStream is larger than 2k. This will create a temporary file which is readable by other users on Unix like systems, but not MacOS. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. Java 1.7 and higher users: this vulnerability is fixed in 4.5.0. Java 1.6 and lower users: no patch is available. If you are unable to patch, or are stuck running on Java 1.6, specifying the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will mitigate this vulnerability. FusionOS postgresql-jdbc-42.4.1-2.u1.fos23.noarch.rpm postgresql-jdbc-javadoc-42.4.1-2.u1.fos23.noarch.rpm postgresql-jdbc-help-42.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2195 Moderate FusionOS CVE-2023-4016:Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap. FusionOS procps-ng-4.0.2-10.u6.fos23.x86_64.rpm procps-ng-devel-4.0.2-10.u6.fos23.x86_64.rpm procps-ng-i18n-4.0.2-10.u6.fos23.noarch.rpm procps-ng-help-4.0.2-10.u6.fos23.noarch.rpm procps-ng-4.0.2-10.u6.fos23.aarch64.rpm procps-ng-devel-4.0.2-10.u6.fos23.aarch64.rpm FusionOS-SA-2023-2196 Critical FusionOS CVE-2023-37920:Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. CVE-2022-23491:Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. FusionOS python3-certifi-2023.7.22-1.fos23.noarch.rpm python-certifi-help-2023.7.22-1.fos23.noarch.rpm FusionOS-SA-2023-2197 Moderate FusionOS CVE-2022-40896:A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. FusionOS python3-pygments-2.10.0-4.u1.fos23.noarch.rpm python-pygments-help-2.10.0-4.u1.fos23.noarch.rpm FusionOS-SA-2023-2198 Moderate FusionOS CVE-2023-28370:Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL. FusionOS python3-tornado-6.1-2.u1.fos23.x86_64.rpm python-tornado-help-6.1-2.u1.fos23.x86_64.rpm python3-tornado-6.1-2.u1.fos23.aarch64.rpm python-tornado-help-6.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2199 Important FusionOS CVE-2023-23934:Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3. CVE-2023-25577:Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue. FusionOS python3-werkzeug-2.0.3-4.u2.fos23.noarch.rpm python-werkzeug-help-2.0.3-4.u2.fos23.noarch.rpm FusionOS-SA-2023-2200 Low FusionOS CVE-2007-4559:Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267. FusionOS python3-3.9.9-25.u6.fos23.x86_64.rpm python3-unversioned-command-3.9.9-25.u6.fos23.x86_64.rpm python3-devel-3.9.9-25.u6.fos23.x86_64.rpm python3-debug-3.9.9-25.u6.fos23.x86_64.rpm python3-help-3.9.9-25.u6.fos23.noarch.rpm python3-3.9.9-25.u6.fos23.aarch64.rpm python3-unversioned-command-3.9.9-25.u6.fos23.aarch64.rpm python3-devel-3.9.9-25.u6.fos23.aarch64.rpm python3-debug-3.9.9-25.u6.fos23.aarch64.rpm FusionOS-SA-2023-2201 Important FusionOS CVE-2023-0664:A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system. CVE-2023-2861:A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder. FusionOS qemu-6.2.0-76.u4.fos23.x86_64.rpm qemu-guest-agent-6.2.0-76.u4.fos23.x86_64.rpm qemu-help-6.2.0-76.u4.fos23.noarch.rpm qemu-img-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-rbd-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-ssh-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-76.u4.fos23.x86_64.rpm qemu-block-curl-6.2.0-76.u4.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-76.u4.fos23.x86_64.rpm qemu-seabios-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-arm-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-76.u4.fos23.x86_64.rpm qemu-system-riscv-6.2.0-76.u4.fos23.x86_64.rpm qemu-6.2.0-76.u4.fos23.aarch64.rpm qemu-guest-agent-6.2.0-76.u4.fos23.aarch64.rpm qemu-img-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-rbd-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-ssh-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-76.u4.fos23.aarch64.rpm qemu-block-curl-6.2.0-76.u4.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-arm-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-76.u4.fos23.aarch64.rpm qemu-system-riscv-6.2.0-76.u4.fos23.aarch64.rpm FusionOS-SA-2023-2202 Moderate FusionOS CVE-2023-28362:A Cross-site Scripting (XSS) vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned location header. FusionOS rubygem-actionpack-6.1.4.1-3.u1.fos23.noarch.rpm rubygem-actionpack-doc-6.1.4.1-3.u1.fos23.noarch.rpm FusionOS-SA-2023-2203 Important FusionOS CVE-2022-2127:An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. CVE-2023-3347:A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, such as a man-in-the-middle attack, by intercepting the network traffic and modifying the SMB2 messages between client and server, affecting the integrity of the data. CVE-2023-34966:An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in an endless loop consuming 100% CPU. This flaw allows an attacker to issue a malformed RPC request, triggering an infinite loop, resulting in a denial of service condition. CVE-2023-34967:A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the mdssvc protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a caller may trigger a crash in talloc_get_size() when talloc detects that the passed-in pointer is not a valid talloc pointer. With an RPC worker process shared among multiple client connections, a malicious client or attacker can trigger a process crash in a shared RPC mdssvc worker process, affecting all other clients this worker serves. CVE-2023-34968:A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path. FusionOS samba-4.17.5-6.u3.fos23.x86_64.rpm samba-libs-4.17.5-6.u3.fos23.x86_64.rpm samba-client-4.17.5-6.u3.fos23.x86_64.rpm samba-common-4.17.5-6.u3.fos23.x86_64.rpm samba-common-tools-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-provision-4.17.5-6.u3.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-6.u3.fos23.x86_64.rpm samba-devel-4.17.5-6.u3.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-6.u3.fos23.x86_64.rpm samba-krb5-printing-4.17.5-6.u3.fos23.x86_64.rpm libsmbclient-4.17.5-6.u3.fos23.x86_64.rpm libsmbclient-devel-4.17.5-6.u3.fos23.x86_64.rpm libwbclient-4.17.5-6.u3.fos23.x86_64.rpm libwbclient-devel-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-test-4.17.5-6.u3.fos23.x86_64.rpm python3-samba-dc-4.17.5-6.u3.fos23.x86_64.rpm samba-pidl-4.17.5-6.u3.fos23.noarch.rpm samba-test-4.17.5-6.u3.fos23.x86_64.rpm samba-usershares-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-clients-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-6.u3.fos23.x86_64.rpm samba-winbind-modules-4.17.5-6.u3.fos23.x86_64.rpm ctdb-4.17.5-6.u3.fos23.x86_64.rpm samba-help-4.17.5-6.u3.fos23.x86_64.rpm samba-4.17.5-6.u3.fos23.aarch64.rpm samba-libs-4.17.5-6.u3.fos23.aarch64.rpm samba-client-4.17.5-6.u3.fos23.aarch64.rpm samba-common-4.17.5-6.u3.fos23.aarch64.rpm samba-common-tools-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-provision-4.17.5-6.u3.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-6.u3.fos23.aarch64.rpm samba-devel-4.17.5-6.u3.fos23.aarch64.rpm samba-krb5-printing-4.17.5-6.u3.fos23.aarch64.rpm libsmbclient-4.17.5-6.u3.fos23.aarch64.rpm libsmbclient-devel-4.17.5-6.u3.fos23.aarch64.rpm libwbclient-4.17.5-6.u3.fos23.aarch64.rpm libwbclient-devel-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-test-4.17.5-6.u3.fos23.aarch64.rpm python3-samba-dc-4.17.5-6.u3.fos23.aarch64.rpm samba-test-4.17.5-6.u3.fos23.aarch64.rpm samba-usershares-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-clients-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-6.u3.fos23.aarch64.rpm samba-winbind-modules-4.17.5-6.u3.fos23.aarch64.rpm ctdb-4.17.5-6.u3.fos23.aarch64.rpm samba-help-4.17.5-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2204 Moderate FusionOS CVE-2023-25399:A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function. FusionOS python3-scipy-1.6.2-2.u1.fos23.x86_64.rpm python3-scipy-1.6.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2205 Important FusionOS CVE-2018-0737:The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). FusionOS shim-15.6-10.u7.fos23.x86_64.rpm shim-15.6-10.u7.fos23.aarch64.rpm FusionOS-SA-2023-2206 Moderate FusionOS CVE-2023-36191:sqlite3 v3.40.1 was discovered to contain a segmentation violation at /sqlite3_aflpp/shell.c. FusionOS sqlite-3.37.2-6.u3.fos23.x86_64.rpm sqlite-devel-3.37.2-6.u3.fos23.x86_64.rpm sqlite-help-3.37.2-6.u3.fos23.noarch.rpm sqlite-3.37.2-6.u3.fos23.aarch64.rpm sqlite-devel-3.37.2-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2207 Critical FusionOS CVE-2016-9840:inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9841:inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic. CVE-2016-9842:The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers. CVE-2016-9843:The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation. FusionOS syslinux-6.04-14.u2.fos23.x86_64.rpm syslinux-perl-6.04-14.u2.fos23.x86_64.rpm syslinux-devel-6.04-14.u2.fos23.x86_64.rpm syslinux-extlinux-6.04-14.u2.fos23.x86_64.rpm syslinux-tftpboot-6.04-14.u2.fos23.noarch.rpm syslinux-extlinux-nonlinux-6.04-14.u2.fos23.noarch.rpm syslinux-nonlinux-6.04-14.u2.fos23.noarch.rpm syslinux-efi64-6.04-14.u2.fos23.x86_64.rpm FusionOS-SA-2023-2208 Moderate FusionOS CVE-2023-3648:Kafka dissector crash in Wireshark 4.0.0 to 4.0.6 and 3.6.0 to 3.6.14 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-2.u5.fos23.x86_64.rpm wireshark-devel-3.6.14-2.u5.fos23.x86_64.rpm wireshark-help-3.6.14-2.u5.fos23.x86_64.rpm wireshark-3.6.14-2.u5.fos23.aarch64.rpm wireshark-devel-3.6.14-2.u5.fos23.aarch64.rpm wireshark-help-3.6.14-2.u5.fos23.aarch64.rpm FusionOS-SA-2023-2209 Moderate FusionOS CVE-2023-37732:Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. FusionOS yasm-1.3.0-11.u2.fos23.x86_64.rpm yasm-1.3.0-11.u2.fos23.aarch64.rpm FusionOS-SA-2023-2210 Important FusionOS CVE-2023-30577:AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than CVE-2022-37705. FusionOS amanda-3.5.4-1.u2.fos23.x86_64.rpm amanda-help-3.5.4-1.u2.fos23.noarch.rpm amanda-3.5.4-1.u2.fos23.aarch64.rpm FusionOS-SA-2023-2211 Important FusionOS CVE-2021-46174:Heap-based Buffer Overflow in function bfd_getl32 in Binutils objdump 3.37. CVE-2023-1972:A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability. CVE-2022-48064:GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. CVE-2022-4285:An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599. CVE-2022-47696:An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols. CVE-2022-47011:An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47008:An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. FusionOS binutils-2.37-22.u6.fos23.x86_64.rpm binutils-devel-2.37-22.u6.fos23.x86_64.rpm binutils-help-2.37-22.u6.fos23.x86_64.rpm binutils-2.37-22.u6.fos23.aarch64.rpm binutils-devel-2.37-22.u6.fos23.aarch64.rpm binutils-help-2.37-22.u6.fos23.aarch64.rpm FusionOS-SA-2023-2212 Low FusionOS CVE-2015-1197:cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. FusionOS cpio-2.13-10.u2.fos23.x86_64.rpm cpio-help-2.13-10.u2.fos23.noarch.rpm cpio-2.13-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2213 Moderate FusionOS CVE-2022-48554:File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project. FusionOS file-5.41-3.u1.fos23.x86_64.rpm file-libs-5.41-3.u1.fos23.x86_64.rpm file-devel-5.41-3.u1.fos23.x86_64.rpm file-help-5.41-3.u1.fos23.x86_64.rpm python3-magic-5.41-3.u1.fos23.noarch.rpm file-5.41-3.u1.fos23.aarch64.rpm file-libs-5.41-3.u1.fos23.aarch64.rpm file-devel-5.41-3.u1.fos23.aarch64.rpm file-help-5.41-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2214 Important FusionOS CVE-2020-22219:Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder. FusionOS flac-1.3.4-2.u1.fos23.x86_64.rpm flac-devel-1.3.4-2.u1.fos23.x86_64.rpm xmms-flac-1.3.4-2.u1.fos23.x86_64.rpm flac-help-1.3.4-2.u1.fos23.x86_64.rpm flac-1.3.4-2.u1.fos23.aarch64.rpm flac-devel-1.3.4-2.u1.fos23.aarch64.rpm xmms-flac-1.3.4-2.u1.fos23.aarch64.rpm flac-help-1.3.4-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2215 Low FusionOS CVE-2023-4156:A heap out of bound read issue exists in builtin.c of gawk prior to version 5.1.1. The array the_args takes an unsafe index val , while it does not validate the index to ensure the index refers to a valid position in the array (e.g., exceedingly large or negative). The vulnerability can cause crash of the software and might be used by attackers to read sensitive information. FusionOS gawk-5.1.1-5.u2.fos23.x86_64.rpm gawk-devel-5.1.1-5.u2.fos23.x86_64.rpm gawk-help-5.1.1-5.u2.fos23.noarch.rpm gawk-lang-5.1.1-5.u2.fos23.x86_64.rpm gawk-5.1.1-5.u2.fos23.aarch64.rpm gawk-devel-5.1.1-5.u2.fos23.aarch64.rpm gawk-lang-5.1.1-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2216 Moderate FusionOS CVE-2023-39128:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c. FusionOS gdb-11.1-6.u2.fos23.x86_64.rpm gdb-headless-11.1-6.u2.fos23.x86_64.rpm gdb-gdbserver-11.1-6.u2.fos23.x86_64.rpm gdb-help-11.1-6.u2.fos23.noarch.rpm gdb-11.1-6.u2.fos23.aarch64.rpm gdb-headless-11.1-6.u2.fos23.aarch64.rpm gdb-gdbserver-11.1-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2217 Moderate FusionOS CVE-2023-38559:A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to cause a denial of service via outputting a crafted PDF file for a DEVN device with gs. FusionOS ghostscript-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-devel-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-help-9.55.0-3.u2.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-3.u2.fos23.x86_64.rpm ghostscript-9.55.0-3.u2.fos23.aarch64.rpm ghostscript-devel-9.55.0-3.u2.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2218 Moderate FusionOS CVE-2023-29406:The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or FusionOS golang-1.20.5-3.u5.fos23.x86_64.rpm golang-help-1.20.5-3.u5.fos23.noarch.rpm golang-devel-1.20.5-3.u5.fos23.noarch.rpm golang-1.20.5-3.u5.fos23.aarch64.rpm FusionOS-SA-2023-2219 Important FusionOS CVE-2023-40225:HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length headers, violating RFC 9110 section 8.6. In uncommon cases, an HTTP/1 server behind HAProxy may interpret the payload as an extra request. FusionOS haproxy-2.6.6-4.u3.fos23.x86_64.rpm haproxy-help-2.6.6-4.u3.fos23.noarch.rpm haproxy-2.6.6-4.u3.fos23.aarch64.rpm FusionOS-SA-2023-2220 Moderate FusionOS CVE-2022-47022:An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. FusionOS hwloc-2.7.1-2.u1.fos23.x86_64.rpm hwloc-devel-2.7.1-2.u1.fos23.x86_64.rpm hwloc-help-2.7.1-2.u1.fos23.x86_64.rpm hwloc-2.7.1-2.u1.fos23.aarch64.rpm hwloc-devel-2.7.1-2.u1.fos23.aarch64.rpm hwloc-help-2.7.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2221 Moderate FusionOS CVE-2023-40305:GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. FusionOS indent-2.2.11-29.u1.fos23.x86_64.rpm indent-help-2.2.11-29.u1.fos23.noarch.rpm indent-2.2.11-29.u1.fos23.aarch64.rpm FusionOS-SA-2023-2222 Critical FusionOS CVE-2023-20593:An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-4128:A use-after-free flaw was found in net/sched/cls_fw.c in classifiers (cls_fw, cls_u32, and cls_route) in the Linux Kernel. This flaw allows a local attacker to perform a local privilege escalation due to incorrect handling of the existing filter, leading to a kernel information leak issue. CVE-2023-4133:A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-4134:A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. This issue occurs in the device cleanup routine due to a possible rearming of the watchdog_timer from the workqueue. This could allow a local user to crash the system, causing a denial of service. CVE-2023-4132:A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition. CVE-2023-3867:A vulnerability was found in Linux Kernel (Operating System) (the affected version is unknown). It has been rated as critical. Affected by this issue is an unknown code of the file fs/smb/server/smb2pdu.c of the component ksmbd. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CVE-2023-4147:A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system. CVE-2023-3772:A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3863:A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c in NFC in the Linux kernel. This flaw allows a local user with special privileges to impact a kernel information leak issue. CVE-2023-3611:An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. The qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. We recommend upgrading past commit 3e337087c3b5805fe0b8a46ba622a962880b5d64. CVE-2023-38426:An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bounds read in smb2_find_context_vals when create_context's name_len is larger than the tag length. CVE-2023-3609:A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc. CVE-2023-21255:In multiple functions of binder.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. CVE-2023-38428:An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider the address of security buffer, leading to an out-of-bounds read. CVE-2023-3776:A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 0323bce598eea038714f941ce2b22541c46d488f. CVE-2023-4004:A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-38427:An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_contexts. CVE-2023-38429:An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation (because of ksmbd_smb2_check_message) that may lead to out-of-bounds access. CVE-2023-38430:An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validate the SMB request protocol ID, leading to an out-of-bounds read. FusionOS kernel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-headers-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-devel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-tools-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm perf-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm python3-perf-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm bpftool-5.10.0-136.46.0.124.u73.fos23.x86_64.rpm kernel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-headers-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-devel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-tools-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm perf-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm python3-perf-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm bpftool-5.10.0-136.46.0.124.u73.fos23.aarch64.rpm FusionOS-SA-2023-2223 Moderate FusionOS CVE-2023-36054:lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. FusionOS krb5-1.19.2-9.u2.fos23.x86_64.rpm krb5-server-1.19.2-9.u2.fos23.x86_64.rpm krb5-client-1.19.2-9.u2.fos23.x86_64.rpm krb5-devel-1.19.2-9.u2.fos23.x86_64.rpm krb5-libs-1.19.2-9.u2.fos23.x86_64.rpm krb5-help-1.19.2-9.u2.fos23.noarch.rpm krb5-1.19.2-9.u2.fos23.aarch64.rpm krb5-server-1.19.2-9.u2.fos23.aarch64.rpm krb5-client-1.19.2-9.u2.fos23.aarch64.rpm krb5-devel-1.19.2-9.u2.fos23.aarch64.rpm krb5-libs-1.19.2-9.u2.fos23.aarch64.rpm FusionOS-SA-2023-2224 Moderate FusionOS CVE-2023-38633:A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. FusionOS librsvg2-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-devel-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-tools-2.50.5-6.u3.fos23.x86_64.rpm librsvg2-help-2.50.5-6.u3.fos23.noarch.rpm librsvg2-2.50.5-6.u3.fos23.aarch64.rpm librsvg2-devel-2.50.5-6.u3.fos23.aarch64.rpm librsvg2-tools-2.50.5-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2225 Moderate FusionOS CVE-2022-40090:An issue was discovered in function TIFFReadDirectory libtiff before 4.4.0 allows attackers to cause a denial of service via crafted TIFF file. CVE-2023-3618:A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode function in libtiff/tif_fax3.c, resulting in a denial of service. FusionOS libtiff-4.3.0-32.u8.fos23.x86_64.rpm libtiff-devel-4.3.0-32.u8.fos23.x86_64.rpm libtiff-static-4.3.0-32.u8.fos23.x86_64.rpm libtiff-tools-4.3.0-32.u8.fos23.x86_64.rpm libtiff-help-4.3.0-32.u8.fos23.noarch.rpm libtiff-4.3.0-32.u8.fos23.aarch64.rpm libtiff-devel-4.3.0-32.u8.fos23.aarch64.rpm libtiff-static-4.3.0-32.u8.fos23.aarch64.rpm libtiff-tools-4.3.0-32.u8.fos23.aarch64.rpm FusionOS-SA-2023-2226 Critical FusionOS CVE-2022-48522:In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. FusionOS perl-5.34.0-9.u3.fos23.x86_64.rpm perl-libs-5.34.0-9.u3.fos23.x86_64.rpm perl-devel-5.34.0-9.u3.fos23.x86_64.rpm perl-help-5.34.0-9.u3.fos23.noarch.rpm perl-5.34.0-9.u3.fos23.aarch64.rpm perl-libs-5.34.0-9.u3.fos23.aarch64.rpm perl-devel-5.34.0-9.u3.fos23.aarch64.rpm FusionOS-SA-2023-2227 Moderate FusionOS CVE-2023-3301:A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service. CVE-2023-3180:A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. FusionOS qemu-6.2.0-79.u7.fos23.x86_64.rpm qemu-guest-agent-6.2.0-79.u7.fos23.x86_64.rpm qemu-help-6.2.0-79.u7.fos23.noarch.rpm qemu-img-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-rbd-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-ssh-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-79.u7.fos23.x86_64.rpm qemu-block-curl-6.2.0-79.u7.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-79.u7.fos23.x86_64.rpm qemu-seabios-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-arm-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-79.u7.fos23.x86_64.rpm qemu-system-riscv-6.2.0-79.u7.fos23.x86_64.rpm qemu-6.2.0-79.u7.fos23.aarch64.rpm qemu-guest-agent-6.2.0-79.u7.fos23.aarch64.rpm qemu-img-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-rbd-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-ssh-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-79.u7.fos23.aarch64.rpm qemu-block-curl-6.2.0-79.u7.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-arm-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-79.u7.fos23.aarch64.rpm qemu-system-riscv-6.2.0-79.u7.fos23.aarch64.rpm FusionOS-SA-2023-2228 Important FusionOS CVE-2021-25786:An issue was discovered in QPDF version 10.0.4, allows remote attackers to execute arbitrary code via crafted .pdf file to Pl_ASCII85Decoder::write parameter in libqpdf. FusionOS qpdf-8.4.2-4.u1.fos23.x86_64.rpm qpdf-devel-8.4.2-4.u1.fos23.x86_64.rpm qpdf-help-8.4.2-4.u1.fos23.noarch.rpm qpdf-8.4.2-4.u1.fos23.aarch64.rpm qpdf-devel-8.4.2-4.u1.fos23.aarch64.rpm FusionOS-SA-2023-2229 Moderate FusionOS CVE-2023-32573:In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled. FusionOS qt-4.8.7-53.u2.fos23.x86_64.rpm qt-devel-4.8.7-53.u2.fos23.x86_64.rpm qt-4.8.7-53.u2.fos23.aarch64.rpm qt-devel-4.8.7-53.u2.fos23.aarch64.rpm FusionOS-SA-2023-2230 Important FusionOS CVE-2022-24834:Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20. FusionOS redis5-5.0.7-6.u4.fos23.x86_64.rpm redis5-devel-5.0.7-6.u4.fos23.x86_64.rpm redis5-doc-5.0.7-6.u4.fos23.noarch.rpm redis5-5.0.7-6.u4.fos23.aarch64.rpm redis5-devel-5.0.7-6.u4.fos23.aarch64.rpm FusionOS-SA-2023-2231 Important FusionOS CVE-2022-24834:Redis is an in-memory database that persists on disk. A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson library, and result with heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. The problem is fixed in versions 7.0.12, 6.2.13, and 6.0.20. FusionOS redis6-6.2.7-3.u4.fos23.x86_64.rpm redis6-devel-6.2.7-3.u4.fos23.x86_64.rpm redis6-doc-6.2.7-3.u4.fos23.noarch.rpm redis6-6.2.7-3.u4.fos23.aarch64.rpm redis6-devel-6.2.7-3.u4.fos23.aarch64.rpm FusionOS-SA-2023-2232 Moderate FusionOS CVE-2023-2157:A heap-based buffer overflow vulnerability was found in the ImageMagick package that can lead to the application crashing. CVE-2023-3195:A stack-based buffer overflow issue was found in ImageMagick's coders/tiff.c. This flaw allows an attacker to trick the user into opening a specially crafted malicious tiff file, causing an application to crash, resulting in a denial of service. FusionOS ImageMagick-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-4.u5.fos23.x86_64.rpm ImageMagick-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-4.u5.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-4.u5.fos23.aarch64.rpm FusionOS-SA-2023-2233 Moderate FusionOS CVE-2021-37533:Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. FusionOS apache-commons-net-3.6-6.u2.fos23.noarch.rpm apache-commons-net-help-3.6-6.u2.fos23.noarch.rpm FusionOS-SA-2023-2234 Important FusionOS CVE-2022-38398:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-38648:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-40146:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-44729:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. CVE-2022-44730:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. FusionOS batik-1.10-8.u2.fos23.noarch.rpm batik-help-1.10-8.u2.fos23.noarch.rpm FusionOS-SA-2023-2235 Important FusionOS CVE-2022-47007:An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-47010:An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks. CVE-2022-48063:GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack. CVE-2022-44840:Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c. CVE-2022-47695:An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c. CVE-2022-48065:GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c. FusionOS binutils-2.37-24.u10.fos23.x86_64.rpm binutils-devel-2.37-24.u10.fos23.x86_64.rpm binutils-help-2.37-24.u10.fos23.x86_64.rpm binutils-2.37-24.u10.fos23.aarch64.rpm binutils-devel-2.37-24.u10.fos23.aarch64.rpm binutils-help-2.37-24.u10.fos23.aarch64.rpm FusionOS-SA-2023-2236 Critical FusionOS CVE-2022-48174:There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. FusionOS busybox-1.34.1-19.u1.fos23.x86_64.rpm busybox-petitboot-1.34.1-19.u1.fos23.x86_64.rpm busybox-help-1.34.1-19.u1.fos23.x86_64.rpm busybox-1.34.1-19.u1.fos23.aarch64.rpm busybox-petitboot-1.34.1-19.u1.fos23.aarch64.rpm busybox-help-1.34.1-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2237 Important FusionOS CVE-2023-20197:A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for completion when a file is decompressed, which may result in a loop condition that could cause the affected software to stop responding. An attacker could exploit this vulnerability by submitting a crafted HFS+ filesystem image to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to stop responding, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . FusionOS clamav-0.103.9-1.fos23.x86_64.rpm clamav-devel-0.103.9-1.fos23.x86_64.rpm clamav-help-0.103.9-1.fos23.x86_64.rpm clamav-filesystem-0.103.9-1.fos23.noarch.rpm clamav-data-0.103.9-1.fos23.noarch.rpm clamav-update-0.103.9-1.fos23.x86_64.rpm clamd-0.103.9-1.fos23.x86_64.rpm clamav-milter-0.103.9-1.fos23.x86_64.rpm clamav-0.103.9-1.fos23.aarch64.rpm clamav-devel-0.103.9-1.fos23.aarch64.rpm clamav-help-0.103.9-1.fos23.aarch64.rpm clamav-update-0.103.9-1.fos23.aarch64.rpm clamd-0.103.9-1.fos23.aarch64.rpm clamav-milter-0.103.9-1.fos23.aarch64.rpm FusionOS-SA-2023-2238 Moderate FusionOS CVE-2021-46310:An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. CVE-2021-46312:An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero. FusionOS djvulibre-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-devel-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-help-3.5.27-19.u1.fos23.x86_64.rpm djvulibre-3.5.27-19.u1.fos23.aarch64.rpm djvulibre-devel-3.5.27-19.u1.fos23.aarch64.rpm djvulibre-help-3.5.27-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2239 Critical FusionOS CVE-2020-15663:If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2. CVE-2020-15664:By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. CVE-2020-15665:Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect URL being shown when used in conjunction with other unexpected browser behaviors. This vulnerability affects Firefox < 80. CVE-2020-15666:When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80. CVE-2020-15667:When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80. CVE-2020-15668:A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80. CVE-2020-15670:Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. CVE-2020-15673:Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15674:Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81. CVE-2020-15675:When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81. CVE-2020-15676:Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15677:By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15678:When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3. CVE-2020-15680:If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82. CVE-2020-15681:When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 82. CVE-2020-15682:When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82. CVE-2020-15683:Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. CVE-2020-15684:Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82. CVE-2020-16012:Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. CVE-2020-16044:Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. CVE-2020-26950:In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2. CVE-2020-26951:A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26953:It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26956:In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26958:Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26959:During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26960:If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26961:When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26962:Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in clickjacking attacks, as well as be read across partitions in dynamic first party isolation. This vulnerability affects Firefox < 83. CVE-2020-26965:Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26966:Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26968:Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5. CVE-2020-26969:Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83. CVE-2020-26971:Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26972:The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 84. CVE-2020-26973:Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26974:When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26976:When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84. CVE-2020-26978:Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-26979:When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before navigation occurred to the desired, entered address. To construct a convincing spoof the attacker would have had to guess what the user was typing, perhaps by suggesting it. This vulnerability affects Firefox < 84. CVE-2020-35111:When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-35113:Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6. CVE-2020-35114:Mozilla developers reported memory safety bugs present in Firefox 83. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 84. CVE-2021-23953:If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23954:Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23955:The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. This vulnerability affects Firefox < 85. CVE-2021-23956:An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox < 85. CVE-2021-23958:The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. This vulnerability affects Firefox < 85. CVE-2021-23960:Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23961:Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox < 85. CVE-2021-23962:Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable crash. This vulnerability affects Firefox < 85. CVE-2021-23963:When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to loss of control over the currently granted permission. This vulnerability affects Firefox < 85. CVE-2021-23964:Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85, Thunderbird < 78.7, and Firefox ESR < 78.7. CVE-2021-23965:Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 85. CVE-2021-23968:If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23969:As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23970:Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. This vulnerability affects Firefox < 86. CVE-2021-23971:When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. This would have potentially resulted in more information than intended by the original origin being provided to the destination of the redirect. This vulnerability affects Firefox < 86. CVE-2021-23972:One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://www.phishingtarget.com@evil.com'. To mitigate this type of attack, Firefox will display a warning dialog; however, this warning dialog would not have been displayed if evil.com used a redirect that was cached by the browser. This vulnerability affects Firefox < 86. CVE-2021-23973:When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may have revealed information about the resource. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23974:The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86. CVE-2021-23975:The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects Firefox < 86. CVE-2021-23978:Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86, Thunderbird < 78.8, and Firefox ESR < 78.8. CVE-2021-23979:Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 86. CVE-2021-23981:A texture upload of a Pixel Buffer Object could have confused the WebGL code to skip binding the buffer used to unpack it, resulting in memory corruption and a potentially exploitable information leak or crash. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23982:Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23983:By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 87. CVE-2021-23984:A malicious extension could have opened a popup window lacking an address bar. The title of the popup lacking an address bar should not be fully controllable, but in this situation was. This could have been used to spoof a website and attempt to trick the user into providing credentials. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23985:If an attacker is able to alter specific about:config values (for example malware running on the user's computer), the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker (able to make a direct network connection to the victim) to monitor the user's browsing activity and (plaintext) network traffic. This was addressed by providing a visual cue when Devtools has an open network socket. This vulnerability affects Firefox < 87. CVE-2021-23986:A malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL. The response to this cross-origin request could have been read by the extension, allowing a same-origin policy bypass by the extension, which should not have cross-origin permissions. This cross-origin request was made without cookies, so the sensitive information disclosed by the violation was limited to local-network resources or resources that perform IP-based authentication. This vulnerability affects Firefox < 87. CVE-2021-23987:Mozilla developers and community members reported memory safety bugs present in Firefox 86 and Firefox ESR 78.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.9, Firefox < 87, and Thunderbird < 78.9. CVE-2021-23988:Mozilla developers reported memory safety bugs present in Firefox 86. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 87. CVE-2021-23994:A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23995:When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23996:By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other attacks on a user. This vulnerability affects Firefox < 88. CVE-2021-23997:Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88. CVE-2021-23998:Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-23999:If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-24000:A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they were on a separate tab. In conjunction with certain elements (such as &lt;input type="file"&gt;) this could have led to an attack where a user was confused about the origin of the webpage and potentially disclosed information they did not intend to. This vulnerability affects Firefox < 88. CVE-2021-24001:A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructure that was not restricted to testing-only configurations. This vulnerability affects Firefox < 88. CVE-2021-24002:When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29944:Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 88. CVE-2021-29945:The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other platforms are unaffected.*. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29946:Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header. This vulnerability affects Firefox ESR < 78.10, Thunderbird < 78.10, and Firefox < 88. CVE-2021-29947:Mozilla developers and community members reported memory safety bugs present in Firefox 87. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88. CVE-2021-29952:When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. CVE-2021-29953:A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domain, resulting in a Universal Cross-Site Scripting vulnerability. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Further details are being temporarily withheld to allow users an opportunity to update.*. This vulnerability affects Firefox < 88.0.1 and Firefox for Android < 88.1.3. CVE-2021-29955:A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and may have also enabled JIT type confusion attacks. (A related vulnerability, Speculative Code Store Bypass (SCSB), did not affect Firefox.). This vulnerability affects Firefox ESR < 78.9 and Firefox < 87. CVE-2021-29959:When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89. CVE-2021-29960:Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89. CVE-2021-29961:When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89. CVE-2021-29964:A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. CVE-2021-29965:A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89. CVE-2021-29966:Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89. CVE-2021-29967:Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11. CVE-2021-29970:A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29972:A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library resolved the issue, and may have remediated other, unknown security vulnerabilities as well. This vulnerability affects Firefox < 90. CVE-2021-29974:When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security (which implies that the error should not be override-able.) This issue did not affect the network connections, and they were correctly upgraded to HTTPS automatically. This vulnerability affects Firefox < 90. CVE-2021-29975:Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlaid on top of another domain (with the new domain correctly shown in the address bar) resulting in possible user confusion. This vulnerability affects Firefox < 90. CVE-2021-29976:Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29977:Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 90. CVE-2021-29980:Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29981:An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29982:Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29984:Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29985:A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29986:A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29987:After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. *This bug only affects Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29988:Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29989:Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29990:Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91. CVE-2021-29991:Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1. CVE-2021-30547:Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. CVE-2021-32810:crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. CVE-2021-38491:Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. This vulnerability affects Firefox < 92. CVE-2021-38493:Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.14, Thunderbird < 78.14, and Firefox < 92. CVE-2021-38494:Mozilla developers reported memory safety bugs present in Firefox 91. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 92. CVE-2021-38496:During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38497:Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38498:During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38499:Mozilla developers reported memory safety bugs present in Firefox 92. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93. CVE-2021-38500:Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38501:Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38503:The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38504:When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38505:Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. *This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38506:Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user. This could lead to spoofing attacks on the browser UI including phishing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38507:The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while retaining the visual properties of an HTTP connection, including being same-origin with unencrypted connections on port 80. However, if a second encrypted port on the same IP address (e.g. port 8443) did not opt-in to opportunistic encryption; a network attacker could forward a connection from the browser to port 443 to port 8443, causing the browser to treat the content of port 8443 as same-origin with HTTP. This was resolved by disabling the Opportunistic Encryption feature, which had low usage. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38508:By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolocation), the validity message could have obscured the prompt, resulting in the user potentially being tricked into granting the permission. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38509:Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker's choosing. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-38510:The executable file warning was not presented when downloading .inetloc files, which, due to a flaw in Mac OS, can run commands on a user's computer.*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-4140:It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2021-43531:When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element clicked. If the Web Extension lacked the WebRequest permission for the hosts involved in the redirect, this would be a same-origin-violation leaking data the Web Extension should have access to. This was fixed to provide the pre-redirect URL. This is related to CVE-2021-43532 but in the context of Web Extensions. This vulnerability affects Firefox < 94. CVE-2021-43532:The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an authentication token used to takeover a user account. If a website tricked a user into copy and pasting the image link back to the page, the page would be able to steal the authentication tokens. This was fixed by making the action return the original URL, before any redirects. This vulnerability affects Firefox < 94. CVE-2021-43533:When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting in inconsistencies that could lead to user confusion or attacks such as phishing. This vulnerability affects Firefox < 94. CVE-2021-43534:Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-43535:A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.3, and Firefox ESR < 91.3. CVE-2021-43536:Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43537:An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43538:By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43539:Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43540:WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95. CVE-2021-43541:When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43542:Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43543:Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43545:Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43546:It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2022-0511:Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97. CVE-2022-0843:Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 98. CVE-2022-1097:<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-1196:After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8. CVE-2022-1529:An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. CVE-2022-1802:If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. CVE-2022-1919:Use after free in Codecs in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2022-2200:If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-22737:Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22738:Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22739:Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22740:Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22741:When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22742:When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22743:When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22745:Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22747:After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22748:Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. CVE-2022-22753:A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22754:If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22755:By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97. CVE-2022-22756:If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22757:Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97. CVE-2022-22759:If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22760:When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22761:Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-22763:When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. CVE-2022-24713:regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. CVE-2022-26381:An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26382:While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98. CVE-2022-26383:When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26384:If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26385:In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 98. CVE-2022-26386:Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7. CVE-2022-26387:When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. CVE-2022-26485:Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVE-2022-26486:An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. CVE-2022-28281:If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28282:By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28283:The sourceMapURL feature in devtools was missing security checks that would have allowed a webpage to attempt to include local files or other files that should have been inaccessible. This vulnerability affects Firefox < 99. CVE-2022-28284:SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99. CVE-2022-28285:When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28286:Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-28287:In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. CVE-2022-28289:Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. CVE-2022-29909:Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the existing prompt and wrongfully inheriting the top-level permissions. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29911:An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could lead to script execution without <code>allow-scripts</code> being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29912:Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29914:When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have enabled browser spoofing attacks. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29915:The Performance API did not properly hide the fact whether a request cross-origin resource has observed redirects. This vulnerability affects Firefox < 100. CVE-2022-29916:Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. CVE-2022-29918:Mozilla developers Gabriele Svelto, Randell Jesup and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 100. CVE-2022-31736:A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31737:A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31738:When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31740:On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31741:A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31742:An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. CVE-2022-31743:Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101. CVE-2022-31744:An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101. CVE-2022-31745:If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101. CVE-2022-31748:Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 101. CVE-2022-3266:An out-of-bounds read can occur when decoding H264 video. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-34468:An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34469:When a TLS Certificate error occurs on a domain protected by the HSTS header, the browser should not allow the user to bypass the certificate error. On Firefox for Android, the user was presented with the option to bypass the error; this could only have been done by the user explicitly. <br>*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102. CVE-2022-34470:Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34471:When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102. CVE-2022-34472:If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34473:The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code>&lt;use&gt;</code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes. This vulnerability affects Firefox < 102. CVE-2022-34474:Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external protocol the browser would process the redirect and prompt the user as appropriate. This vulnerability affects Firefox < 102. CVE-2022-34475:SVG <code>&lt;use&gt;</code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102. CVE-2022-34476:ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnerability affects Firefox < 102. CVE-2022-34477:The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cross-origin resource, the message could have leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 102. CVE-2022-34479:A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. <br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34480:Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated. This vulnerability affects Firefox < 102. CVE-2022-34481:In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34482:An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102. CVE-2022-34483:An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102. CVE-2022-34484:The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. CVE-2022-34485:Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 102. CVE-2022-36318:When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. CVE-2022-36319:When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. CVE-2022-38472:An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-38473:A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-38477:Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.2, Thunderbird < 102.2, and Firefox < 104. CVE-2022-38478:Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. CVE-2022-40956:When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40957:Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<br>*This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40958:By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40959:During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40960:Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-40962:Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 104 and Firefox ESR 102.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. CVE-2022-42928:Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. CVE-2022-43680:In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-45408:Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45409:The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45410:When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45411:Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45412:When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing unitialized memory in the buffer. <br>*This bug only affects Thunderbird on Unix-based operated systems (Android, Linux, MacOS). Windows is unaffected.*. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45416:Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have possibly figured out which keys were being pressed. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45418:If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45420:Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-45421:Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. CVE-2022-46871:An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. CVE-2022-46874:A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6. CVE-2022-46875:The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46878:Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46882:A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2023-0767:An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-1945:Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.10 and Firefox ESR < 102.10. CVE-2023-1999:There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. CVE-2023-23598:Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to <code>DataTransfer.setData</code>. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23599:When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23601:Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23602:A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-23603:Regular expressions used to filter out forbidden properties and values from style directives in calls to <code>console.log</code> weren't accounting for external URLs. Data could then be potentially exfiltrated from the browser. This vulnerability affects Firefox < 109, Thunderbird < 102.7, and Firefox ESR < 102.7. CVE-2023-25728:The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25729:Permission prompts for opening external schemes were only shown for <code>ContentPrincipals</code> resulting in extensions being able to open them without user interaction via <code>ExpandedPrincipals</code>. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25730:A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25732:When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25735:Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25737:An invalid downcast from <code>nsTextNode</code> to <code>SVGElement</code> could have lead to undefined behavior. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25739:Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in <code>ScriptLoadContext</code>. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25742:When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8. CVE-2023-25751:Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-25752:When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28162:While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28164:Dragging a URL from a cross-origin iframe that was removed during the drag could have led to user confusion and website spoofing attacks. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-28176:Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 111, Firefox ESR < 102.9, and Thunderbird < 102.9. CVE-2023-29531:An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. *This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29532:A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29533:A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29535:Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced. This resulted in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29536:An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29539:When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29541:Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29542:A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29545:Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10. CVE-2023-29548:A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-29550:Mozilla developers Randell Jesup, Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. CVE-2023-32205:In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32206:An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32207:A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32211:A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32212:An attacker could have positioned a <code>datalist</code> element to obscure the address bar. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32213:When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32214:Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-32215:Mozilla developers and community members Gabriele Svelto, Andrew Osmond, Emily McDonough, Sebastian Hengst, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 113, Firefox ESR < 102.11, and Thunderbird < 102.11. CVE-2023-34414:The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user clicks in precise locations immediately before navigating to a site with a certificate error and made the renderer extremely busy at the same time, it could create a gap between when the error page was loaded and when the display actually refreshed. With the right timing the elicited clicks could land in that gap and activate the button that overrides the certificate error for that site. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. CVE-2023-34416:Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 102.12, Firefox < 114, and Thunderbird < 102.12. CVE-2023-37201:An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37202:Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37207:A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37208:When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-37211:Memory safety bugs present in Firefox 114, Firefox ESR 102.12, and Thunderbird 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 115, Firefox ESR < 102.13, and Thunderbird < 102.13. CVE-2023-4045:Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4046:In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4047:A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4048:An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4049:Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4050:In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a potentially exploitable crash which could have led to a sandbox escape. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4054:When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1, Thunderbird < 102.14, and Thunderbird < 115.1. CVE-2023-4055:When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. CVE-2023-4056:Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1. FusionOS firefox-102.14.0-1.u3.fos23.x86_64.rpm firefox-102.14.0-1.u3.fos23.aarch64.rpm FusionOS-SA-2023-2240 Critical FusionOS CVE-2023-39350:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39351:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39352:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39353:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39354:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context->Planes` without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-39356:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect->numRectangles` is less than 45. Looping through `multi_opaque_rect->`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-40181:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40186:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40188:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. CVE-2023-40567:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. CVE-2023-40569:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability. CVE-2023-40589:FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue. FusionOS freerdp-2.11.1-1.fos23.x86_64.rpm freerdp-devel-2.11.1-1.fos23.x86_64.rpm libwinpr-2.11.1-1.fos23.x86_64.rpm libwinpr-devel-2.11.1-1.fos23.x86_64.rpm freerdp-help-2.11.1-1.fos23.x86_64.rpm freerdp-2.11.1-1.fos23.aarch64.rpm freerdp-devel-2.11.1-1.fos23.aarch64.rpm libwinpr-2.11.1-1.fos23.aarch64.rpm libwinpr-devel-2.11.1-1.fos23.aarch64.rpm freerdp-help-2.11.1-1.fos23.aarch64.rpm FusionOS-SA-2023-2241 Important FusionOS CVE-2023-36664:Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the %pipe% prefix or the | pipe character prefix). FusionOS ghostscript-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-devel-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-help-9.55.0-5.u3.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-5.u3.fos23.x86_64.rpm ghostscript-9.55.0-5.u3.fos23.aarch64.rpm ghostscript-devel-9.55.0-5.u3.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2242 Moderate FusionOS CVE-2023-39742:giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. FusionOS giflib-5.2.1-6.u1.fos23.x86_64.rpm giflib-devel-5.2.1-6.u1.fos23.x86_64.rpm giflib-utils-5.2.1-6.u1.fos23.x86_64.rpm giflib-help-5.2.1-6.u1.fos23.noarch.rpm giflib-5.2.1-6.u1.fos23.aarch64.rpm giflib-devel-5.2.1-6.u1.fos23.aarch64.rpm giflib-utils-5.2.1-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2243 Moderate FusionOS CVE-2023-29409:Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. FusionOS golang-1.20.5-3.u6.fos23.x86_64.rpm golang-help-1.20.5-3.u6.fos23.noarch.rpm golang-devel-1.20.5-3.u6.fos23.noarch.rpm golang-1.20.5-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2244 Important FusionOS CVE-2023-37329:Heap overwrite in PGS subtitle overlay decoder. FusionOS gstreamer1-plugins-bad-free-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-bad-free-1.16.2-5.u1.fos23.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2245 Important FusionOS CVE-2023-37327:Integer overflow leading to heap overwrite in FLAC image tag handling. CVE-2023-37328:Heap overwrite in subtitle parsing. FusionOS gstreamer1-plugins-base-1.18.4-3.u1.fos23.x86_64.rpm gstreamer1-plugins-base-devel-1.18.4-3.u1.fos23.x86_64.rpm gstreamer1-plugins-base-help-1.18.4-3.u1.fos23.noarch.rpm gstreamer1-plugins-base-1.18.4-3.u1.fos23.aarch64.rpm gstreamer1-plugins-base-devel-1.18.4-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2246 Important FusionOS CVE-2023-37327:Integer overflow leading to heap overwrite in FLAC image tag handling. FusionOS gstreamer1-plugins-good-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-good-gtk-1.16.2-5.u1.fos23.x86_64.rpm gstreamer1-plugins-good-help-1.16.2-5.u1.fos23.noarch.rpm gstreamer1-plugins-good-1.16.2-5.u1.fos23.aarch64.rpm gstreamer1-plugins-good-gtk-1.16.2-5.u1.fos23.aarch64.rpm FusionOS-SA-2023-2247 Important FusionOS CVE-2022-21549:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21830:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2023-21937:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. FusionOS java-1.8.0-openjdk-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.382.b05-8.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.382.b05-8.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.382.b05-8.u1.fos23.aarch64.rpm FusionOS-SA-2023-2248 Important FusionOS CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21835:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21937:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVE-2023-22006:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N). CVE-2023-22036:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22041:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. FusionOS java-11-openjdk-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-headless-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-devel-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-demo-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-src-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.20.8-2.fos23.x86_64.rpm java-11-openjdk-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-headless-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-devel-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-demo-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-src-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.20.8-2.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.20.8-2.fos23.aarch64.rpm FusionOS-SA-2023-2249 Important FusionOS CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2023-1436:An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown. FusionOS jettison-1.3.7-1.u3.fos23.noarch.rpm jettison-javadoc-1.3.7-1.u3.fos23.noarch.rpm FusionOS-SA-2023-2250 Critical FusionOS CVE-2023-1206:A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%. CVE-2023-20593:An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-34319:A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw allows an unprivileged guest to cause a denial of service (DoS) of the host by sending network packets to the backend, causing the backend to crash. CVE-2023-38432:An issue was discovered in the Linux kernel before 6.3.10. fs/smb/server/smb2misc.c in ksmbd does not validate the relationship between the command payload size and the RFC1002 length specification, leading to an out-of-bounds read. CVE-2023-40283:An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled. CVE-2023-4194:A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate. CVE-2023-32250:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-32252:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_LOGOFF commands. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32257:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-3865:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication may or may not be required to exploit this vulnerability, depending upon configuration. Furthermore, only systems with ksmbd enabled are vulnerable. CVE-2023-4273:A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. CVE-2023-32247:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. CVE-2023-32249:Linux Kernel ksmbd Multichannel Improper Authentication Session Hijack Vulnerability. CVE-2023-32251:A vulnerability classified as problematic has been found in Linux Kernel up to 6.3 (Operating System). Affected is the function smb2_sess_setup of the file fs/ksmbd/smb2pdu.c of the component ksmbd. The manipulation with an unknown input leads to a improper authentication vulnerability. CVE-2023-32253:Linux Kernel ksmbd Session Deadlock Denial-of-Service Vulnerability CVE-2023-3777:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain's owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. CVE-2023-3866:A vulnerability classified as critical was found in Linux Kernel (Operating System) (version now known). This vulnerability affects some unknown processing of the component ksmbd. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CVE-2023-4015:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. CVE-2023-4622:A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free. CVE-2023-4623:A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. CVE-2022-45884:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2022-45887:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2023-2156:A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system. FusionOS kernel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-headers-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-devel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-tools-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm perf-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm python3-perf-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm bpftool-5.10.0-136.49.0.127.u85.fos23.x86_64.rpm kernel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-headers-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-devel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-tools-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm perf-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm python3-perf-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm bpftool-5.10.0-136.49.0.127.u85.fos23.aarch64.rpm FusionOS-SA-2023-2251 Important FusionOS CVE-2020-21469:An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the vendor because untrusted users cannot send SIGHUP signals; they can only be sent by a PostgreSQL superuser, a user with pg_reload_conf access, or a user with sufficient privileges at the OS level (the postgres account or the root account). CVE-2023-2454:schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. CVE-2023-2455:Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. CVE-2023-39417:IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. CVE-2023-39418:A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. If UPDATE and SELECT policies forbid some rows that INSERT policies do not forbid, a user could store such rows. FusionOS libpq-13.12-1.u1.fos23.x86_64.rpm libpq-devel-13.12-1.u1.fos23.x86_64.rpm libpq-13.12-1.u1.fos23.aarch64.rpm libpq-devel-13.12-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2252 Important FusionOS CVE-2023-38710:An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20. CVE-2023-38711:An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. CVE-2023-38712:An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart. FusionOS libreswan-4.12-1.u1.fos23.x86_64.rpm libreswan-help-4.12-1.u1.fos23.x86_64.rpm libreswan-4.12-1.u1.fos23.aarch64.rpm libreswan-help-4.12-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2253 Moderate FusionOS CVE-2022-34526:A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities. FusionOS libtiff-4.3.0-33.u9.fos23.x86_64.rpm libtiff-devel-4.3.0-33.u9.fos23.x86_64.rpm libtiff-static-4.3.0-33.u9.fos23.x86_64.rpm libtiff-tools-4.3.0-33.u9.fos23.x86_64.rpm libtiff-help-4.3.0-33.u9.fos23.noarch.rpm libtiff-4.3.0-33.u9.fos23.aarch64.rpm libtiff-devel-4.3.0-33.u9.fos23.aarch64.rpm libtiff-static-4.3.0-33.u9.fos23.aarch64.rpm libtiff-tools-4.3.0-33.u9.fos23.aarch64.rpm FusionOS-SA-2023-2254 Critical FusionOS CVE-2023-36328:Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS). FusionOS libtommath-1.2.0-4.u2.fos23.x86_64.rpm libtommath-devel-1.2.0-4.u2.fos23.x86_64.rpm libtommath-help-1.2.0-4.u2.fos23.x86_64.rpm libtommath-1.2.0-4.u2.fos23.aarch64.rpm libtommath-devel-1.2.0-4.u2.fos23.aarch64.rpm libtommath-help-1.2.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2255 Moderate FusionOS CVE-2022-33196:Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2022-38090:Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access. CVE-2022-40982:Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. FusionOS microcode_ctl-2.1-41.fos23.x86_64.rpm FusionOS-SA-2023-2256 Moderate FusionOS CVE-2020-21528:A Segmentation Fault issue discovered in in ieee_segment function in outieee.c in nasm 2.14.03 and 2.15 allows remote attackers to cause a denial of service via crafted assembly file. FusionOS nasm-2.15.05-6.u3.fos23.x86_64.rpm nasm-help-2.15.05-6.u3.fos23.noarch.rpm nasm-2.15.05-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2257 Important FusionOS CVE-2022-41881:Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder. FusionOS netty-4.1.13-19.u1.fos23.x86_64.rpm netty-help-4.1.13-19.u1.fos23.noarch.rpm netty-4.1.13-19.u1.fos23.aarch64.rpm FusionOS-SA-2023-2258 Critical FusionOS CVE-2022-25881:This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. CVE-2022-32212:A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks. CVE-2022-32213:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS). CVE-2022-32214:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). CVE-2022-32215:The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS). CVE-2022-35256:The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. CVE-2023-23918:A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. CVE-2023-23920:An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. CVE-2023-30581:The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition. CVE-2023-30589:The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 CVE-2023-30590:A vulnerability has been identified in the Node.js, where a generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet. CVE-2023-32002:The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32006:The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32559:A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. FusionOS nodejs-12.22.11-5.u2.fos23.x86_64.rpm nodejs-devel-12.22.11-5.u2.fos23.x86_64.rpm nodejs-libs-12.22.11-5.u2.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-5.u2.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.5.u2.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.5.u2.fos23.x86_64.rpm nodejs-docs-12.22.11-5.u2.fos23.noarch.rpm nodejs-12.22.11-5.u2.fos23.aarch64.rpm nodejs-devel-12.22.11-5.u2.fos23.aarch64.rpm nodejs-libs-12.22.11-5.u2.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-5.u2.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.5.u2.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2259 Important FusionOS CVE-2023-20867:A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. CVE-2023-20900:A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . FusionOS open-vm-tools-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-desktop-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-sdmp-12.0.5-3.u1.fos23.x86_64.rpm open-vm-tools-12.0.5-3.u1.fos23.aarch64.rpm open-vm-tools-desktop-12.0.5-3.u1.fos23.aarch64.rpm open-vm-tools-sdmp-12.0.5-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2260 Critical FusionOS CVE-2022-31631:A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote() of PDO_SQLite returning an improperly quoted string. With the implementation of sqlite3_snprintf(), it is possible to force the function to return a single apostrophe if the function is called on user-supplied input without any length restrictions in place. CVE-2023-0567:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. CVE-2023-0568:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification. CVE-2023-0662:In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space. CVE-2023-3823:In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down. CVE-2023-3824:In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE. FusionOS php-8.0.30-1.fos23.x86_64.rpm php-cli-8.0.30-1.fos23.x86_64.rpm php-dbg-8.0.30-1.fos23.x86_64.rpm php-fpm-8.0.30-1.fos23.x86_64.rpm php-common-8.0.30-1.fos23.x86_64.rpm php-devel-8.0.30-1.fos23.x86_64.rpm php-opcache-8.0.30-1.fos23.x86_64.rpm php-ldap-8.0.30-1.fos23.x86_64.rpm php-pdo-8.0.30-1.fos23.x86_64.rpm php-mysqlnd-8.0.30-1.fos23.x86_64.rpm php-pgsql-8.0.30-1.fos23.x86_64.rpm php-process-8.0.30-1.fos23.x86_64.rpm php-odbc-8.0.30-1.fos23.x86_64.rpm php-soap-8.0.30-1.fos23.x86_64.rpm php-snmp-8.0.30-1.fos23.x86_64.rpm php-xml-8.0.30-1.fos23.x86_64.rpm php-mbstring-8.0.30-1.fos23.x86_64.rpm php-gd-8.0.30-1.fos23.x86_64.rpm php-bcmath-8.0.30-1.fos23.x86_64.rpm php-gmp-8.0.30-1.fos23.x86_64.rpm php-dba-8.0.30-1.fos23.x86_64.rpm php-tidy-8.0.30-1.fos23.x86_64.rpm php-embedded-8.0.30-1.fos23.x86_64.rpm php-intl-8.0.30-1.fos23.x86_64.rpm php-enchant-8.0.30-1.fos23.x86_64.rpm php-sodium-8.0.30-1.fos23.x86_64.rpm php-ffi-8.0.30-1.fos23.x86_64.rpm php-help-8.0.30-1.fos23.x86_64.rpm php-8.0.30-1.fos23.aarch64.rpm php-cli-8.0.30-1.fos23.aarch64.rpm php-dbg-8.0.30-1.fos23.aarch64.rpm php-fpm-8.0.30-1.fos23.aarch64.rpm php-common-8.0.30-1.fos23.aarch64.rpm php-devel-8.0.30-1.fos23.aarch64.rpm php-opcache-8.0.30-1.fos23.aarch64.rpm php-ldap-8.0.30-1.fos23.aarch64.rpm php-pdo-8.0.30-1.fos23.aarch64.rpm php-mysqlnd-8.0.30-1.fos23.aarch64.rpm php-pgsql-8.0.30-1.fos23.aarch64.rpm php-process-8.0.30-1.fos23.aarch64.rpm php-odbc-8.0.30-1.fos23.aarch64.rpm php-soap-8.0.30-1.fos23.aarch64.rpm php-snmp-8.0.30-1.fos23.aarch64.rpm php-xml-8.0.30-1.fos23.aarch64.rpm php-mbstring-8.0.30-1.fos23.aarch64.rpm php-gd-8.0.30-1.fos23.aarch64.rpm php-bcmath-8.0.30-1.fos23.aarch64.rpm php-gmp-8.0.30-1.fos23.aarch64.rpm php-dba-8.0.30-1.fos23.aarch64.rpm php-tidy-8.0.30-1.fos23.aarch64.rpm php-embedded-8.0.30-1.fos23.aarch64.rpm php-intl-8.0.30-1.fos23.aarch64.rpm php-enchant-8.0.30-1.fos23.aarch64.rpm php-sodium-8.0.30-1.fos23.aarch64.rpm php-ffi-8.0.30-1.fos23.aarch64.rpm php-help-8.0.30-1.fos23.aarch64.rpm FusionOS-SA-2023-2261 Important FusionOS CVE-2020-23804:Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. CVE-2022-37050:In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes with SIGABRT) by crafting a PDF file in which the xref data structure is mishandled in getCatalog processing. Note that this vulnerability is caused by the incomplete patch of CVE-2018-20662. CVE-2022-37051:An issue was discovered in Poppler 22.07.0. There is a reachable abort which leads to denial of service because the main function in pdfunite.cc lacks a stream check before saving an embedded file. CVE-2022-37052:A reachable Object::getString assertion in Poppler 22.07.0 allows attackers to cause a denial of service due to a failure in markObject. CVE-2022-38349:An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file. FusionOS poppler-0.90.0-6.u3.fos23.x86_64.rpm poppler-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-glib-doc-0.90.0-6.u3.fos23.noarch.rpm poppler-qt5-0.90.0-6.u3.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-cpp-0.90.0-6.u3.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-6.u3.fos23.x86_64.rpm poppler-utils-0.90.0-6.u3.fos23.x86_64.rpm poppler-help-0.90.0-6.u3.fos23.noarch.rpm poppler-0.90.0-6.u3.fos23.aarch64.rpm poppler-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-glib-0.90.0-6.u3.fos23.aarch64.rpm poppler-glib-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-qt5-0.90.0-6.u3.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-cpp-0.90.0-6.u3.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-6.u3.fos23.aarch64.rpm poppler-utils-0.90.0-6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2262 Important FusionOS CVE-2022-2625:A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser. CVE-2023-2454:schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code. CVE-2023-2455:Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy. CVE-2023-39417:IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. FusionOS postgresql-13.3-7.u1.fos23.x86_64.rpm postgresql-server-13.3-7.u1.fos23.x86_64.rpm postgresql-docs-13.3-7.u1.fos23.x86_64.rpm postgresql-contrib-13.3-7.u1.fos23.x86_64.rpm postgresql-server-devel-13.3-7.u1.fos23.x86_64.rpm postgresql-test-rpm-macros-13.3-7.u1.fos23.noarch.rpm postgresql-static-13.3-7.u1.fos23.x86_64.rpm postgresql-plperl-13.3-7.u1.fos23.x86_64.rpm postgresql-plpython3-13.3-7.u1.fos23.x86_64.rpm postgresql-pltcl-13.3-7.u1.fos23.x86_64.rpm postgresql-test-13.3-7.u1.fos23.x86_64.rpm postgresql-llvmjit-13.3-7.u1.fos23.x86_64.rpm postgresql-13.3-7.u1.fos23.aarch64.rpm postgresql-server-13.3-7.u1.fos23.aarch64.rpm postgresql-docs-13.3-7.u1.fos23.aarch64.rpm postgresql-contrib-13.3-7.u1.fos23.aarch64.rpm postgresql-server-devel-13.3-7.u1.fos23.aarch64.rpm postgresql-static-13.3-7.u1.fos23.aarch64.rpm postgresql-plperl-13.3-7.u1.fos23.aarch64.rpm postgresql-plpython3-13.3-7.u1.fos23.aarch64.rpm postgresql-pltcl-13.3-7.u1.fos23.aarch64.rpm postgresql-test-13.3-7.u1.fos23.aarch64.rpm postgresql-llvmjit-13.3-7.u1.fos23.aarch64.rpm FusionOS-SA-2023-2263 Important FusionOS CVE-2015-5237:protobuf allows remote authenticated attackers to cause a heap-based buffer overflow. CVE-2021-22570:Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater. FusionOS protobuf2-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-compiler-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-devel-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-static-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-devel-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-lite-static-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-vim-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-emacs-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-emacs-el-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-java-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-javadoc-2.5.0-4.u2.fos23.x86_64.rpm protobuf2-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-compiler-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-devel-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-static-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-devel-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-lite-static-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-vim-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-emacs-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-emacs-el-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-java-2.5.0-4.u2.fos23.aarch64.rpm protobuf2-javadoc-2.5.0-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2264 Important FusionOS CVE-2022-45198:Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). FusionOS python3-pillow-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-devel-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-help-9.0.1-3.u1.fos23.noarch.rpm python3-pillow-tk-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-qt-9.0.1-3.u1.fos23.x86_64.rpm python3-pillow-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-devel-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-tk-9.0.1-3.u1.fos23.aarch64.rpm python3-pillow-qt-9.0.1-3.u1.fos23.aarch64.rpm FusionOS-SA-2023-2265 Moderate FusionOS CVE-2023-40217:An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) FusionOS python3-3.9.9-25.u7.fos23.x86_64.rpm python3-unversioned-command-3.9.9-25.u7.fos23.x86_64.rpm python3-devel-3.9.9-25.u7.fos23.x86_64.rpm python3-debug-3.9.9-25.u7.fos23.x86_64.rpm python3-help-3.9.9-25.u7.fos23.noarch.rpm python3-3.9.9-25.u7.fos23.aarch64.rpm python3-unversioned-command-3.9.9-25.u7.fos23.aarch64.rpm python3-devel-3.9.9-25.u7.fos23.aarch64.rpm python3-debug-3.9.9-25.u7.fos23.aarch64.rpm FusionOS-SA-2023-2266 Critical FusionOS CVE-2022-36648:The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. FusionOS qemu-6.2.0-80.u9.fos23.x86_64.rpm qemu-guest-agent-6.2.0-80.u9.fos23.x86_64.rpm qemu-help-6.2.0-80.u9.fos23.noarch.rpm qemu-img-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-rbd-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-ssh-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-80.u9.fos23.x86_64.rpm qemu-block-curl-6.2.0-80.u9.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-80.u9.fos23.x86_64.rpm qemu-seabios-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-arm-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-80.u9.fos23.x86_64.rpm qemu-system-riscv-6.2.0-80.u9.fos23.x86_64.rpm qemu-6.2.0-80.u9.fos23.aarch64.rpm qemu-guest-agent-6.2.0-80.u9.fos23.aarch64.rpm qemu-img-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-rbd-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-ssh-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-80.u9.fos23.aarch64.rpm qemu-block-curl-6.2.0-80.u9.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-arm-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-80.u9.fos23.aarch64.rpm qemu-system-riscv-6.2.0-80.u9.fos23.aarch64.rpm FusionOS-SA-2023-2267 Important FusionOS CVE-2023-32763:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. When a SVG file with an image inside it is rendered, a QTextLayout buffer overflow can be triggered. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. FusionOS qt-4.8.7-54.u5.fos23.x86_64.rpm qt-devel-4.8.7-54.u5.fos23.x86_64.rpm qt-4.8.7-54.u5.fos23.aarch64.rpm qt-devel-4.8.7-54.u5.fos23.aarch64.rpm FusionOS-SA-2023-2268 Important FusionOS CVE-2023-32762:An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security (HSTS) header, allowing unencrypted connections to be established, even when explicitly prohibited by the server. This happens if the case used for this header does not exactly match. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. CVE-2023-33285:An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. CVE-2023-34410:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. FusionOS qt5-qtbase-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-9.u4.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-9.u4.fos23.x86_64.rpm qt5-qtbase-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-9.u4.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2269 Moderate FusionOS CVE-2022-35977:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. The problem is fixed in Redis versions 7.0.8, 6.2.9 and 6.0.17. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2022-3647:** DISPUTED ** A vulnerability, which was classified as problematic, was found in Redis. Affected is the function sigsegvHandler of the file debug.c of the component Crash Report. The manipulation leads to denial of service. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 0bf90d944313919eb8e63d3588bf63a367f020a3. It is recommended to apply a patch to fix this issue. VDB-211962 is the identifier assigned to this vulnerability. NOTE: The vendor claims that this is not a DoS because it applies to the crash logging mechanism which is triggered after a crash has occurred. CVE-2023-22458:Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-25155:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. FusionOS redis6-6.2.7-3.u5.fos23.x86_64.rpm redis6-devel-6.2.7-3.u5.fos23.x86_64.rpm redis6-doc-6.2.7-3.u5.fos23.noarch.rpm redis6-6.2.7-3.u5.fos23.aarch64.rpm redis6-devel-6.2.7-3.u5.fos23.aarch64.rpm FusionOS-SA-2023-2270 Low FusionOS CVE-2023-38037:An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system. FusionOS rubygem-activesupport-6.1.4.1-6.u3.fos23.noarch.rpm rubygem-activesupport-doc-6.1.4.1-6.u3.fos23.noarch.rpm FusionOS-SA-2023-2271 Low FusionOS CVE-2023-38037:An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system. FusionOS rubygem-railties-6.1.4.1-2.u1.fos23.noarch.rpm rubygem-railties-doc-6.1.4.1-2.u1.fos23.noarch.rpm FusionOS-SA-2023-2272 Moderate FusionOS CVE-2023-41080:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. FusionOS tomcat-9.0.10-31.u8.fos23.noarch.rpm tomcat-jsvc-9.0.10-31.u8.fos23.noarch.rpm tomcat-help-9.0.10-31.u8.fos23.noarch.rpm FusionOS-SA-2023-2273 Important FusionOS CVE-2023-4733:Use After Free in GitHub repository vim/vim prior to 9.0.1840. CVE-2023-4734:Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846. CVE-2023-4735:Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847. CVE-2023-4736:Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. CVE-2023-4738:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848. CVE-2023-4750:Use After Free in GitHub repository vim/vim prior to 9.0.1857. CVE-2023-4752:Use After Free in GitHub repository vim/vim prior to 9.0.1858. CVE-2023-4781:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. FusionOS vim-common-9.0-17.u9.fos23.x86_64.rpm vim-minimal-9.0-17.u9.fos23.x86_64.rpm vim-enhanced-9.0-17.u9.fos23.x86_64.rpm vim-filesystem-9.0-17.u9.fos23.noarch.rpm vim-X11-9.0-17.u9.fos23.x86_64.rpm vim-common-9.0-17.u9.fos23.aarch64.rpm vim-minimal-9.0-17.u9.fos23.aarch64.rpm vim-enhanced-9.0-17.u9.fos23.aarch64.rpm vim-X11-9.0-17.u9.fos23.aarch64.rpm FusionOS-SA-2023-2274 Important FusionOS CVE-2023-2906:Due to a failure in validating the length provided by an attacker-crafted CP2179 packet, Wireshark versions 2.0.0 through 4.0.7 is susceptible to a divide by zero allowing for a denial of service attack. CVE-2023-3649:iSCSI dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file CVE-2023-4511:BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file CVE-2023-4513:BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-3.u6.fos23.x86_64.rpm wireshark-devel-3.6.14-3.u6.fos23.x86_64.rpm wireshark-help-3.6.14-3.u6.fos23.x86_64.rpm wireshark-3.6.14-3.u6.fos23.aarch64.rpm wireshark-devel-3.6.14-3.u6.fos23.aarch64.rpm wireshark-help-3.6.14-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2275 Important FusionOS CVE-2022-40152:Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. FusionOS woodstox-core-5.0.3-1.u1.fos23.noarch.rpm woodstox-core-javadoc-5.0.3-1.u1.fos23.noarch.rpm FusionOS-SA-2023-2276 Moderate FusionOS CVE-2023-5341:A vulnerability was found in ImageMagick <=7.1.1, where heap use-after-free was found in coders/bmp.c.References:https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1 FusionOS ImageMagick-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-devel-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-help-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-perl-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-c++-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-c++-devel-7.1.1.8-5.u6.fos23.x86_64.rpm ImageMagick-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-devel-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-help-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-perl-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-c++-7.1.1.8-5.u6.fos23.aarch64.rpm ImageMagick-c++-devel-7.1.1.8-5.u6.fos23.aarch64.rpm FusionOS-SA-2023-2277 Moderate FusionOS CVE-2023-38469:A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. CVE-2023-38470:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. CVE-2023-38471:A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. CVE-2023-38472:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. CVE-2023-38473:A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. FusionOS avahi-0.8-17.u3.fos23.x86_64.rpm avahi-tools-0.8-17.u3.fos23.x86_64.rpm avahi-ui-0.8-17.u3.fos23.x86_64.rpm avahi-autoipd-0.8-17.u3.fos23.x86_64.rpm avahi-dnsconfd-0.8-17.u3.fos23.x86_64.rpm avahi-compat-howl-0.8-17.u3.fos23.x86_64.rpm avahi-compat-howl-devel-0.8-17.u3.fos23.x86_64.rpm avahi-compat-libdns_sd-0.8-17.u3.fos23.x86_64.rpm avahi-compat-libdns_sd-devel-0.8-17.u3.fos23.x86_64.rpm avahi-devel-0.8-17.u3.fos23.x86_64.rpm avahi-glib-0.8-17.u3.fos23.x86_64.rpm avahi-glib-devel-0.8-17.u3.fos23.x86_64.rpm avahi-gobject-0.8-17.u3.fos23.x86_64.rpm avahi-gobject-devel-0.8-17.u3.fos23.x86_64.rpm avahi-ui-gtk3-0.8-17.u3.fos23.x86_64.rpm avahi-ui-devel-0.8-17.u3.fos23.x86_64.rpm avahi-libs-0.8-17.u3.fos23.x86_64.rpm avahi-help-0.8-17.u3.fos23.noarch.rpm avahi-0.8-17.u3.fos23.aarch64.rpm avahi-tools-0.8-17.u3.fos23.aarch64.rpm avahi-ui-0.8-17.u3.fos23.aarch64.rpm avahi-autoipd-0.8-17.u3.fos23.aarch64.rpm avahi-dnsconfd-0.8-17.u3.fos23.aarch64.rpm avahi-compat-howl-0.8-17.u3.fos23.aarch64.rpm avahi-compat-howl-devel-0.8-17.u3.fos23.aarch64.rpm avahi-compat-libdns_sd-0.8-17.u3.fos23.aarch64.rpm avahi-compat-libdns_sd-devel-0.8-17.u3.fos23.aarch64.rpm avahi-devel-0.8-17.u3.fos23.aarch64.rpm avahi-glib-0.8-17.u3.fos23.aarch64.rpm avahi-glib-devel-0.8-17.u3.fos23.aarch64.rpm avahi-gobject-0.8-17.u3.fos23.aarch64.rpm avahi-gobject-devel-0.8-17.u3.fos23.aarch64.rpm avahi-ui-gtk3-0.8-17.u3.fos23.aarch64.rpm avahi-ui-devel-0.8-17.u3.fos23.aarch64.rpm avahi-libs-0.8-17.u3.fos23.aarch64.rpm FusionOS-SA-2023-2278 Important FusionOS CVE-2022-38398:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protocol. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-38648:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-40146:Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14. CVE-2022-44729:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. CVE-2022-44730:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL. FusionOS batik-1.17-1.u2.fos23.noarch.rpm batik-help-1.17-1.u2.fos23.noarch.rpm FusionOS-SA-2023-2279 Important FusionOS CVE-2023-3341:The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1. FusionOS bind-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-libs-9.16.23-20.u6.fos23.x86_64.rpm bind-pkcs11-devel-9.16.23-20.u6.fos23.x86_64.rpm bind-libs-9.16.23-20.u6.fos23.x86_64.rpm bind-license-9.16.23-20.u6.fos23.noarch.rpm bind-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-dnssec-utils-9.16.23-20.u6.fos23.x86_64.rpm bind-dnssec-doc-9.16.23-20.u6.fos23.noarch.rpm bind-devel-9.16.23-20.u6.fos23.x86_64.rpm bind-chroot-9.16.23-20.u6.fos23.x86_64.rpm python3-bind-9.16.23-20.u6.fos23.noarch.rpm bind-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-libs-9.16.23-20.u6.fos23.aarch64.rpm bind-pkcs11-devel-9.16.23-20.u6.fos23.aarch64.rpm bind-libs-9.16.23-20.u6.fos23.aarch64.rpm bind-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-dnssec-utils-9.16.23-20.u6.fos23.aarch64.rpm bind-devel-9.16.23-20.u6.fos23.aarch64.rpm bind-chroot-9.16.23-20.u6.fos23.aarch64.rpm FusionOS-SA-2023-2280 Moderate FusionOS CVE-2022-38533:In GNU Binutils before 2.40, there is a heap-buffer-overflow in the error function bfd_getl32 when called from the strip_main function in strip-new via a crafted file. FusionOS binutils-2.37-24.u11.fos23.x86_64.rpm binutils-devel-2.37-24.u11.fos23.x86_64.rpm binutils-help-2.37-24.u11.fos23.x86_64.rpm binutils-2.37-24.u11.fos23.aarch64.rpm binutils-devel-2.37-24.u11.fos23.aarch64.rpm binutils-help-2.37-24.u11.fos23.aarch64.rpm FusionOS-SA-2023-2281 Moderate FusionOS CVE-2022-3854:A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service. CVE-2023-43040:A flaw was found in rgw. This flaw allows an unprivileged user to write to any bucket(s) accessible by a given key if a POST s form-data contains a key called bucket with a value matching the bucket s name used to sign the request. This issue results in a user being able to upload to any bucket accessible by the specified access key as long as the bucket in the POST policy matches the bucket in the said POST form part. FusionOS ceph-16.2.7-19.u8.fos23.x86_64.rpm ceph-base-16.2.7-19.u8.fos23.x86_64.rpm cephadm-16.2.7-19.u8.fos23.noarch.rpm ceph-common-16.2.7-19.u8.fos23.x86_64.rpm ceph-mds-16.2.7-19.u8.fos23.x86_64.rpm ceph-mon-16.2.7-19.u8.fos23.x86_64.rpm ceph-mgr-16.2.7-19.u8.fos23.x86_64.rpm ceph-mgr-dashboard-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-diskprediction-local-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-modules-core-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-rook-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-k8sevents-16.2.7-19.u8.fos23.noarch.rpm ceph-mgr-cephadm-16.2.7-19.u8.fos23.noarch.rpm ceph-fuse-16.2.7-19.u8.fos23.x86_64.rpm cephfs-mirror-16.2.7-19.u8.fos23.x86_64.rpm rbd-fuse-16.2.7-19.u8.fos23.x86_64.rpm rbd-mirror-16.2.7-19.u8.fos23.x86_64.rpm ceph-immutable-object-cache-16.2.7-19.u8.fos23.x86_64.rpm rbd-nbd-16.2.7-19.u8.fos23.x86_64.rpm ceph-radosgw-16.2.7-19.u8.fos23.x86_64.rpm cephfs-top-16.2.7-19.u8.fos23.noarch.rpm ceph-resource-agents-16.2.7-19.u8.fos23.x86_64.rpm ceph-osd-16.2.7-19.u8.fos23.x86_64.rpm librados2-16.2.7-19.u8.fos23.x86_64.rpm librados-devel-16.2.7-19.u8.fos23.x86_64.rpm libradospp-devel-16.2.7-19.u8.fos23.x86_64.rpm librgw2-16.2.7-19.u8.fos23.x86_64.rpm librgw-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-rgw-16.2.7-19.u8.fos23.x86_64.rpm python3-rados-16.2.7-19.u8.fos23.x86_64.rpm libcephsqlite-16.2.7-19.u8.fos23.x86_64.rpm libcephsqlite-devel-16.2.7-19.u8.fos23.x86_64.rpm libradosstriper1-16.2.7-19.u8.fos23.x86_64.rpm libradosstriper-devel-16.2.7-19.u8.fos23.x86_64.rpm librbd1-16.2.7-19.u8.fos23.x86_64.rpm librbd-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-rbd-16.2.7-19.u8.fos23.x86_64.rpm libcephfs2-16.2.7-19.u8.fos23.x86_64.rpm libcephfs-devel-16.2.7-19.u8.fos23.x86_64.rpm python3-cephfs-16.2.7-19.u8.fos23.x86_64.rpm python3-ceph-argparse-16.2.7-19.u8.fos23.x86_64.rpm python3-ceph-common-16.2.7-19.u8.fos23.x86_64.rpm ceph-test-16.2.7-19.u8.fos23.x86_64.rpm rados-objclass-devel-16.2.7-19.u8.fos23.x86_64.rpm ceph-selinux-16.2.7-19.u8.fos23.x86_64.rpm ceph-grafana-dashboards-16.2.7-19.u8.fos23.noarch.rpm ceph-prometheus-alerts-16.2.7-19.u8.fos23.noarch.rpm ceph-16.2.7-19.u8.fos23.aarch64.rpm ceph-base-16.2.7-19.u8.fos23.aarch64.rpm ceph-common-16.2.7-19.u8.fos23.aarch64.rpm ceph-mds-16.2.7-19.u8.fos23.aarch64.rpm ceph-mon-16.2.7-19.u8.fos23.aarch64.rpm ceph-mgr-16.2.7-19.u8.fos23.aarch64.rpm ceph-fuse-16.2.7-19.u8.fos23.aarch64.rpm cephfs-mirror-16.2.7-19.u8.fos23.aarch64.rpm rbd-fuse-16.2.7-19.u8.fos23.aarch64.rpm rbd-mirror-16.2.7-19.u8.fos23.aarch64.rpm ceph-immutable-object-cache-16.2.7-19.u8.fos23.aarch64.rpm rbd-nbd-16.2.7-19.u8.fos23.aarch64.rpm ceph-radosgw-16.2.7-19.u8.fos23.aarch64.rpm ceph-resource-agents-16.2.7-19.u8.fos23.aarch64.rpm ceph-osd-16.2.7-19.u8.fos23.aarch64.rpm librados2-16.2.7-19.u8.fos23.aarch64.rpm librados-devel-16.2.7-19.u8.fos23.aarch64.rpm libradospp-devel-16.2.7-19.u8.fos23.aarch64.rpm librgw2-16.2.7-19.u8.fos23.aarch64.rpm librgw-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-rgw-16.2.7-19.u8.fos23.aarch64.rpm python3-rados-16.2.7-19.u8.fos23.aarch64.rpm libcephsqlite-16.2.7-19.u8.fos23.aarch64.rpm libcephsqlite-devel-16.2.7-19.u8.fos23.aarch64.rpm libradosstriper1-16.2.7-19.u8.fos23.aarch64.rpm libradosstriper-devel-16.2.7-19.u8.fos23.aarch64.rpm librbd1-16.2.7-19.u8.fos23.aarch64.rpm librbd-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-rbd-16.2.7-19.u8.fos23.aarch64.rpm libcephfs2-16.2.7-19.u8.fos23.aarch64.rpm libcephfs-devel-16.2.7-19.u8.fos23.aarch64.rpm python3-cephfs-16.2.7-19.u8.fos23.aarch64.rpm python3-ceph-argparse-16.2.7-19.u8.fos23.aarch64.rpm python3-ceph-common-16.2.7-19.u8.fos23.aarch64.rpm ceph-test-16.2.7-19.u8.fos23.aarch64.rpm rados-objclass-devel-16.2.7-19.u8.fos23.aarch64.rpm ceph-selinux-16.2.7-19.u8.fos23.aarch64.rpm FusionOS-SA-2023-2282 Important FusionOS CVE-2023-39325:A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. FusionOS containerd-1.6.22-5.u6.fos23.x86_64.rpm containerd-stress-1.6.22-5.u6.fos23.x86_64.rpm containerd-1.6.22-5.u6.fos23.aarch64.rpm containerd-stress-1.6.22-5.u6.fos23.aarch64.rpm FusionOS-SA-2023-2283 Important FusionOS CVE-2023-4504:Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been fixed in CUPS version 2.4.7, released in September of 2023. FusionOS cups-2.4.0-10.u4.fos23.x86_64.rpm cups-client-2.4.0-10.u4.fos23.x86_64.rpm cups-devel-2.4.0-10.u4.fos23.x86_64.rpm cups-libs-2.4.0-10.u4.fos23.x86_64.rpm cups-filesystem-2.4.0-10.u4.fos23.noarch.rpm cups-lpd-2.4.0-10.u4.fos23.x86_64.rpm cups-ipptool-2.4.0-10.u4.fos23.x86_64.rpm cups-printerapp-2.4.0-10.u4.fos23.x86_64.rpm cups-help-2.4.0-10.u4.fos23.noarch.rpm cups-2.4.0-10.u4.fos23.aarch64.rpm cups-client-2.4.0-10.u4.fos23.aarch64.rpm cups-devel-2.4.0-10.u4.fos23.aarch64.rpm cups-libs-2.4.0-10.u4.fos23.aarch64.rpm cups-lpd-2.4.0-10.u4.fos23.aarch64.rpm cups-ipptool-2.4.0-10.u4.fos23.aarch64.rpm cups-printerapp-2.4.0-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2284 Low FusionOS CVE-2023-38545:This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. CVE-2023-38546:This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. FusionOS curl-7.79.1-24.u11.fos23.x86_64.rpm libcurl-7.79.1-24.u11.fos23.x86_64.rpm libcurl-devel-7.79.1-24.u11.fos23.x86_64.rpm curl-help-7.79.1-24.u11.fos23.noarch.rpm curl-7.79.1-24.u11.fos23.aarch64.rpm libcurl-7.79.1-24.u11.fos23.aarch64.rpm libcurl-devel-7.79.1-24.u11.fos23.aarch64.rpm FusionOS-SA-2023-2285 Critical FusionOS CVE-2022-48337:GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input. FusionOS emacs-27.2-11.u3.fos23.x86_64.rpm emacs-devel-27.2-11.u3.fos23.x86_64.rpm emacs-lucid-27.2-11.u3.fos23.x86_64.rpm emacs-nox-27.2-11.u3.fos23.x86_64.rpm emacs-common-27.2-11.u3.fos23.x86_64.rpm emacs-terminal-27.2-11.u3.fos23.noarch.rpm emacs-filesystem-27.2-11.u3.fos23.noarch.rpm emacs-help-27.2-11.u3.fos23.noarch.rpm emacs-27.2-11.u3.fos23.aarch64.rpm emacs-devel-27.2-11.u3.fos23.aarch64.rpm emacs-lucid-27.2-11.u3.fos23.aarch64.rpm emacs-nox-27.2-11.u3.fos23.aarch64.rpm emacs-common-27.2-11.u3.fos23.aarch64.rpm FusionOS-SA-2023-2286 Important FusionOS CVE-2023-4573:When receiving rendering data over IPC `mStream` could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4574:When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4575:When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4576:On Windows, an integer overflow could occur in `RecordedSourceSurfaceCreation` which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4581:Excel `.xll` add-in files did not have a blocklist entry in Firefox's executable blocklist which allowed them to be downloaded without any warning of their potential harm. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4584:Memory safety bugs present in Firefox 116, Firefox ESR 102.14, Firefox ESR 115.1, Thunderbird 102.14, and Thunderbird 115.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 117, Firefox ESR < 102.15, Firefox ESR < 115.2, Thunderbird < 102.15, and Thunderbird < 115.2. CVE-2023-4863:Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) CVE-2023-5217:Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) FusionOS firefox-102.15.0-3.u4.fos23.x86_64.rpm firefox-102.15.0-3.u4.fos23.aarch64.rpm FusionOS-SA-2023-2287 Moderate FusionOS CVE-2023-4039:A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. FusionOS gcc-10.3.1-25.u9.fos23.x86_64.rpm libgcc-10.3.1-25.u9.fos23.x86_64.rpm gcc-c++-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-devel-10.3.1-25.u9.fos23.x86_64.rpm libstdc++-static-10.3.1-25.u9.fos23.x86_64.rpm gcc-objc-10.3.1-25.u9.fos23.x86_64.rpm gcc-objc++-10.3.1-25.u9.fos23.x86_64.rpm libobjc-10.3.1-25.u9.fos23.x86_64.rpm gcc-gfortran-10.3.1-25.u9.fos23.x86_64.rpm libgfortran-10.3.1-25.u9.fos23.x86_64.rpm libgfortran-static-10.3.1-25.u9.fos23.x86_64.rpm libgomp-10.3.1-25.u9.fos23.x86_64.rpm gcc-gdb-plugin-10.3.1-25.u9.fos23.x86_64.rpm libgccjit-10.3.1-25.u9.fos23.x86_64.rpm libgccjit-devel-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-devel-10.3.1-25.u9.fos23.x86_64.rpm libquadmath-static-10.3.1-25.u9.fos23.x86_64.rpm libitm-10.3.1-25.u9.fos23.x86_64.rpm libitm-devel-10.3.1-25.u9.fos23.x86_64.rpm libitm-static-10.3.1-25.u9.fos23.x86_64.rpm libatomic-10.3.1-25.u9.fos23.x86_64.rpm libatomic-static-10.3.1-25.u9.fos23.x86_64.rpm libasan-10.3.1-25.u9.fos23.x86_64.rpm libasan-static-10.3.1-25.u9.fos23.x86_64.rpm libtsan-10.3.1-25.u9.fos23.x86_64.rpm libtsan-static-10.3.1-25.u9.fos23.x86_64.rpm libubsan-10.3.1-25.u9.fos23.x86_64.rpm libubsan-static-10.3.1-25.u9.fos23.x86_64.rpm liblsan-10.3.1-25.u9.fos23.x86_64.rpm liblsan-static-10.3.1-25.u9.fos23.x86_64.rpm cpp-10.3.1-25.u9.fos23.x86_64.rpm gcc-plugin-devel-10.3.1-25.u9.fos23.x86_64.rpm gcc-10.3.1-25.u9.fos23.aarch64.rpm libgcc-10.3.1-25.u9.fos23.aarch64.rpm gcc-c++-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-devel-10.3.1-25.u9.fos23.aarch64.rpm libstdc++-static-10.3.1-25.u9.fos23.aarch64.rpm gcc-objc-10.3.1-25.u9.fos23.aarch64.rpm gcc-objc++-10.3.1-25.u9.fos23.aarch64.rpm libobjc-10.3.1-25.u9.fos23.aarch64.rpm gcc-gfortran-10.3.1-25.u9.fos23.aarch64.rpm libgfortran-10.3.1-25.u9.fos23.aarch64.rpm libgfortran-static-10.3.1-25.u9.fos23.aarch64.rpm libgomp-10.3.1-25.u9.fos23.aarch64.rpm gcc-gdb-plugin-10.3.1-25.u9.fos23.aarch64.rpm libgccjit-10.3.1-25.u9.fos23.aarch64.rpm libgccjit-devel-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-devel-10.3.1-25.u9.fos23.aarch64.rpm libquadmath-static-10.3.1-25.u9.fos23.aarch64.rpm libitm-10.3.1-25.u9.fos23.aarch64.rpm libitm-devel-10.3.1-25.u9.fos23.aarch64.rpm libitm-static-10.3.1-25.u9.fos23.aarch64.rpm libatomic-10.3.1-25.u9.fos23.aarch64.rpm libatomic-static-10.3.1-25.u9.fos23.aarch64.rpm libasan-10.3.1-25.u9.fos23.aarch64.rpm libasan-static-10.3.1-25.u9.fos23.aarch64.rpm libtsan-10.3.1-25.u9.fos23.aarch64.rpm libtsan-static-10.3.1-25.u9.fos23.aarch64.rpm libubsan-10.3.1-25.u9.fos23.aarch64.rpm libubsan-static-10.3.1-25.u9.fos23.aarch64.rpm liblsan-10.3.1-25.u9.fos23.aarch64.rpm liblsan-static-10.3.1-25.u9.fos23.aarch64.rpm cpp-10.3.1-25.u9.fos23.aarch64.rpm gcc-plugin-devel-10.3.1-25.u9.fos23.aarch64.rpm FusionOS-SA-2023-2288 Moderate FusionOS CVE-2023-39129:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-read.c. FusionOS gdb-11.1-7.u3.fos23.x86_64.rpm gdb-headless-11.1-7.u3.fos23.x86_64.rpm gdb-gdbserver-11.1-7.u3.fos23.x86_64.rpm gdb-help-11.1-7.u3.fos23.noarch.rpm gdb-11.1-7.u3.fos23.aarch64.rpm gdb-headless-11.1-7.u3.fos23.aarch64.rpm gdb-gdbserver-11.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2289 Moderate FusionOS CVE-2023-39742:giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. FusionOS giflib-5.2.1-7.u2.fos23.x86_64.rpm giflib-devel-5.2.1-7.u2.fos23.x86_64.rpm giflib-utils-5.2.1-7.u2.fos23.x86_64.rpm giflib-help-5.2.1-7.u2.fos23.noarch.rpm giflib-5.2.1-7.u2.fos23.aarch64.rpm giflib-devel-5.2.1-7.u2.fos23.aarch64.rpm giflib-utils-5.2.1-7.u2.fos23.aarch64.rpm FusionOS-SA-2023-2290 Important FusionOS CVE-2023-4806:A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. CVE-2023-4813:A flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge. CVE-2023-4911:A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges. CVE-2023-5156:A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash. FusionOS glibc-2.34-140.u19.fos23.x86_64.rpm glibc-common-2.34-140.u19.fos23.x86_64.rpm glibc-all-langpacks-2.34-140.u19.fos23.x86_64.rpm glibc-locale-source-2.34-140.u19.fos23.x86_64.rpm glibc-locale-archive-2.34-140.u19.fos23.x86_64.rpm glibc-devel-2.34-140.u19.fos23.x86_64.rpm nscd-2.34-140.u19.fos23.x86_64.rpm nss_modules-2.34-140.u19.fos23.x86_64.rpm glibc-nss-devel-2.34-140.u19.fos23.x86_64.rpm libnsl-2.34-140.u19.fos23.x86_64.rpm glibc-debugutils-2.34-140.u19.fos23.x86_64.rpm glibc-help-2.34-140.u19.fos23.noarch.rpm glibc-compat-2.17-2.34-140.u19.fos23.x86_64.rpm glibc-2.34-140.u19.fos23.aarch64.rpm glibc-common-2.34-140.u19.fos23.aarch64.rpm glibc-all-langpacks-2.34-140.u19.fos23.aarch64.rpm glibc-locale-source-2.34-140.u19.fos23.aarch64.rpm glibc-locale-archive-2.34-140.u19.fos23.aarch64.rpm glibc-devel-2.34-140.u19.fos23.aarch64.rpm nscd-2.34-140.u19.fos23.aarch64.rpm nss_modules-2.34-140.u19.fos23.aarch64.rpm glibc-nss-devel-2.34-140.u19.fos23.aarch64.rpm libnsl-2.34-140.u19.fos23.aarch64.rpm glibc-debugutils-2.34-140.u19.fos23.aarch64.rpm glibc-compat-2.17-2.34-140.u19.fos23.aarch64.rpm FusionOS-SA-2023-2291 Important FusionOS CVE-2023-33953:gRPC contains a vulnerability that allows hpack table accounting errors could lead to unwanted disconnects between clients and servers in exceptional cases/ Three vectors were found that allow DOS attacks: CVE-2023-4785:Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms (ex. Linux) allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Java, and Go are NOT affected. FusionOS grpc-1.41.1-8.u3.fos23.x86_64.rpm grpc-devel-1.41.1-8.u3.fos23.x86_64.rpm grpc-plugins-1.41.1-8.u3.fos23.x86_64.rpm python3-grpcio-1.41.1-8.u3.fos23.x86_64.rpm grpc-1.41.1-8.u3.fos23.aarch64.rpm grpc-devel-1.41.1-8.u3.fos23.aarch64.rpm grpc-plugins-1.41.1-8.u3.fos23.aarch64.rpm python3-grpcio-1.41.1-8.u3.fos23.aarch64.rpm FusionOS-SA-2023-2292 Important FusionOS CVE-2023-4692:An out-of-bounds write flaw was found in grub2 s NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub s heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. CVE-2023-4693:An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk. FusionOS grub2-common-2.06-38.u12.fos23.noarch.rpm grub2-tools-2.06-38.u12.fos23.x86_64.rpm grub2-tools-minimal-2.06-38.u12.fos23.x86_64.rpm grub2-tools-extra-2.06-38.u12.fos23.x86_64.rpm grub2-tools-efi-2.06-38.u12.fos23.x86_64.rpm grub2-efi-x64-2.06-38.u12.fos23.x86_64.rpm grub2-efi-x64-modules-2.06-38.u12.fos23.noarch.rpm grub2-efi-x64-cdboot-2.06-38.u12.fos23.x86_64.rpm grub2-efi-ia32-2.06-38.u12.fos23.x86_64.rpm grub2-efi-ia32-modules-2.06-38.u12.fos23.noarch.rpm grub2-efi-ia32-cdboot-2.06-38.u12.fos23.x86_64.rpm grub2-pc-2.06-38.u12.fos23.x86_64.rpm grub2-pc-modules-2.06-38.u12.fos23.noarch.rpm grub2-help-2.06-38.u12.fos23.noarch.rpm grub2-tools-2.06-38.u12.fos23.aarch64.rpm grub2-tools-minimal-2.06-38.u12.fos23.aarch64.rpm grub2-tools-extra-2.06-38.u12.fos23.aarch64.rpm FusionOS-SA-2023-2293 Important FusionOS CVE-2023-40474:gstreamer-plugins-bad: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability CVE-2023-40475:gstreamer-plugins-bad: GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability CVE-2023-40476:gstreamer-plugins-bad: GStreamer H265 Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability FusionOS gstreamer1-plugins-bad-free-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-6.u2.fos23.x86_64.rpm gstreamer1-plugins-bad-free-1.16.2-6.u2.fos23.aarch64.rpm gstreamer1-plugins-bad-free-devel-1.16.2-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2294 Important FusionOS CVE-2023-31122:Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-45802:When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. FusionOS httpd-2.4.51-20.u9.fos23.x86_64.rpm httpd-devel-2.4.51-20.u9.fos23.x86_64.rpm httpd-help-2.4.51-20.u9.fos23.noarch.rpm httpd-filesystem-2.4.51-20.u9.fos23.noarch.rpm httpd-tools-2.4.51-20.u9.fos23.x86_64.rpm mod_ssl-2.4.51-20.u9.fos23.x86_64.rpm mod_md-2.4.51-20.u9.fos23.x86_64.rpm mod_proxy_html-2.4.51-20.u9.fos23.x86_64.rpm mod_ldap-2.4.51-20.u9.fos23.x86_64.rpm mod_session-2.4.51-20.u9.fos23.x86_64.rpm httpd-2.4.51-20.u9.fos23.aarch64.rpm httpd-devel-2.4.51-20.u9.fos23.aarch64.rpm httpd-tools-2.4.51-20.u9.fos23.aarch64.rpm mod_ssl-2.4.51-20.u9.fos23.aarch64.rpm mod_md-2.4.51-20.u9.fos23.aarch64.rpm mod_proxy_html-2.4.51-20.u9.fos23.aarch64.rpm mod_ldap-2.4.51-20.u9.fos23.aarch64.rpm mod_session-2.4.51-20.u9.fos23.aarch64.rpm FusionOS-SA-2023-2295 Critical FusionOS CVE-2022-21549:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.3.1; Oracle GraalVM Enterprise Edition: 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2022-40433:An issue was discovered in function ciMethodBlocks::make_block_at in Oracle JDK (HotSpot VM) 11, 17 and OpenJDK (HotSpot VM) 8, 11, 17, allows attackers to cause a denial of service. CVE-2023-21830:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf; Oracle GraalVM Enterprise Edition: 20.3.8 and 21.3.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21835:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DTLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21843:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). Supported versions that are affected are Oracle Java SE: 8u351, 8u351-perf, 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-2193:Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token. CVE-2023-21930:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE-2023-21938:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21939:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21954:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). CVE-2023-21967:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21968:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u361, 8u361-perf, 11.0.18, 17.0.6, 20; Oracle GraalVM Enterprise Edition: 20.3.9, 21.3.5 and 22.3.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22006:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22025:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22036:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Utility). Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-22041:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK executes to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22043:Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u371. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVE-2023-22044:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371-perf, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22045:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22049:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle GraalVM for JDK: 17.0.7 and 20.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). FusionOS java-latest-openjdk-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-headless-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-devel-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-jmods-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-demo-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-src-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-javadoc-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-javadoc-zip-21.0.0.35-1.rolling.u1.fos23.x86_64.rpm java-latest-openjdk-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-headless-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-devel-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-jmods-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-demo-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-src-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-javadoc-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm java-latest-openjdk-javadoc-zip-21.0.0.35-1.rolling.u1.fos23.aarch64.rpm FusionOS-SA-2023-2296 Important FusionOS CVE-2022-40982:Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2022-4379:A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial CVE-2022-45887:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call. CVE-2022-45919:An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2023-20588:A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. CVE-2023-21400:In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation. CVE-2023-4881:CVE-2023-4881 was wrongly assigned to a bug that was deemed to be a non-security issue by the Linux kernel security team. CVE-2023-4921:A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). FusionOS kernel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-headers-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-devel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-tools-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm perf-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm python3-perf-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm bpftool-5.10.0-136.50.0.129.u88.fos23.x86_64.rpm kernel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-headers-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-devel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-tools-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm perf-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm python3-perf-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm bpftool-5.10.0-136.50.0.129.u88.fos23.aarch64.rpm FusionOS-SA-2023-2297 Moderate FusionOS CVE-2021-33634:Isula uses the lxc runtime (default) to run malicious images, which can cause DOS. FusionOS lcr-2.0.9-7.u4.fos23.x86_64.rpm lcr-devel-2.0.9-7.u4.fos23.x86_64.rpm lcr-2.0.9-7.u4.fos23.aarch64.rpm lcr-devel-2.0.9-7.u4.fos23.aarch64.rpm FusionOS-SA-2023-2298 Important FusionOS CVE-2023-43785:A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system. CVE-2023-43786:A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43787:A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. FusionOS libX11-1.7.2-8.u2.fos23.x86_64.rpm libX11-devel-1.7.2-8.u2.fos23.x86_64.rpm libX11-help-1.7.2-8.u2.fos23.noarch.rpm libX11-1.7.2-8.u2.fos23.aarch64.rpm libX11-devel-1.7.2-8.u2.fos23.aarch64.rpm FusionOS-SA-2023-2299 Important FusionOS CVE-2023-43786:A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition. CVE-2023-43787:A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. CVE-2023-43788:A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local to trigger an out-of-bounds read error and read the contents of memory on the system. CVE-2023-43789:A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system. FusionOS libXpm-3.5.13-5.u2.fos23.x86_64.rpm libXpm-devel-3.5.13-5.u2.fos23.x86_64.rpm libXpm-help-3.5.13-5.u2.fos23.noarch.rpm libXpm-3.5.13-5.u2.fos23.aarch64.rpm libXpm-devel-3.5.13-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2300 Important FusionOS CVE-2022-33065:Multiple signed integers overflow in function au_read_header in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in Libsndfile, allows an attacker to cause Denial of Service or other unspecified impacts. FusionOS libsndfile-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-devel-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-utils-1.0.31-4.u2.fos23.x86_64.rpm libsndfile-utils-help-1.0.31-4.u2.fos23.noarch.rpm libsndfile-1.0.31-4.u2.fos23.aarch64.rpm libsndfile-devel-1.0.31-4.u2.fos23.aarch64.rpm libsndfile-utils-1.0.31-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2301 Important FusionOS CVE-2023-44488:VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-5217:Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) FusionOS libvpx-1.7.0-10.u2.fos23.x86_64.rpm libvpx-devel-1.7.0-10.u2.fos23.x86_64.rpm libvpx-1.7.0-10.u2.fos23.aarch64.rpm libvpx-devel-1.7.0-10.u2.fos23.aarch64.rpm FusionOS-SA-2023-2302 Important FusionOS CVE-2023-4863:Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) CVE-2023-5129:This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863. FusionOS libwebp-1.2.1-3.u2.fos23.x86_64.rpm libwebp-tools-1.2.1-3.u2.fos23.x86_64.rpm libwebp-devel-1.2.1-3.u2.fos23.x86_64.rpm libwebp-java-1.2.1-3.u2.fos23.x86_64.rpm libwebp-help-1.2.1-3.u2.fos23.noarch.rpm libwebp-1.2.1-3.u2.fos23.aarch64.rpm libwebp-tools-1.2.1-3.u2.fos23.aarch64.rpm libwebp-devel-1.2.1-3.u2.fos23.aarch64.rpm libwebp-java-1.2.1-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2303 Moderate FusionOS CVE-2023-45322:libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is "I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail." FusionOS libxml2-2.9.14-9.u4.fos23.x86_64.rpm libxml2-devel-2.9.14-9.u4.fos23.x86_64.rpm python3-libxml2-2.9.14-9.u4.fos23.x86_64.rpm libxml2-help-2.9.14-9.u4.fos23.noarch.rpm libxml2-2.9.14-9.u4.fos23.aarch64.rpm libxml2-devel-2.9.14-9.u4.fos23.aarch64.rpm python3-libxml2-2.9.14-9.u4.fos23.aarch64.rpm FusionOS-SA-2023-2304 Important FusionOS CVE-2023-23583:Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access. FusionOS microcode_ctl-2.1-42.fos23.x86_64.rpm FusionOS-SA-2023-2305 Moderate FusionOS CVE-2023-4874:Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 CVE-2023-4875:Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 FusionOS mutt-2.2.12-1.fos23.x86_64.rpm mutt-help-2.2.12-1.fos23.noarch.rpm mutt-2.2.12-1.fos23.aarch64.rpm FusionOS-SA-2023-2306 Important FusionOS CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS nghttp2-1.46.0-5.u3.fos23.x86_64.rpm libnghttp2-1.46.0-5.u3.fos23.x86_64.rpm libnghttp2-devel-1.46.0-5.u3.fos23.x86_64.rpm nghttp2-help-1.46.0-5.u3.fos23.noarch.rpm nghttp2-1.46.0-5.u3.fos23.aarch64.rpm libnghttp2-1.46.0-5.u3.fos23.aarch64.rpm libnghttp2-devel-1.46.0-5.u3.fos23.aarch64.rpm FusionOS-SA-2023-2307 Important FusionOS CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS nginx-1.21.5-6.u2.fos23.x86_64.rpm nginx-all-modules-1.21.5-6.u2.fos23.noarch.rpm nginx-filesystem-1.21.5-6.u2.fos23.noarch.rpm nginx-mod-http-image-filter-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-http-perl-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-http-xslt-filter-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-mail-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-stream-1.21.5-6.u2.fos23.x86_64.rpm nginx-mod-devel-1.21.5-6.u2.fos23.x86_64.rpm nginx-help-1.21.5-6.u2.fos23.noarch.rpm nginx-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-image-filter-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-perl-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-http-xslt-filter-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-mail-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-stream-1.21.5-6.u2.fos23.aarch64.rpm nginx-mod-devel-1.21.5-6.u2.fos23.aarch64.rpm FusionOS-SA-2023-2308 Important FusionOS CVE-2023-23918:A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. FusionOS nodejs-12.22.11-6.u3.fos23.x86_64.rpm nodejs-devel-12.22.11-6.u3.fos23.x86_64.rpm nodejs-libs-12.22.11-6.u3.fos23.x86_64.rpm nodejs-full-i18n-12.22.11-6.u3.fos23.x86_64.rpm v8-devel-7.8.279.23-1.12.22.11.6.u3.fos23.x86_64.rpm npm-6.14.16-1.12.22.11.6.u3.fos23.x86_64.rpm nodejs-docs-12.22.11-6.u3.fos23.noarch.rpm nodejs-12.22.11-6.u3.fos23.aarch64.rpm nodejs-devel-12.22.11-6.u3.fos23.aarch64.rpm nodejs-libs-12.22.11-6.u3.fos23.aarch64.rpm nodejs-full-i18n-12.22.11-6.u3.fos23.aarch64.rpm v8-devel-7.8.279.23-1.12.22.11.6.u3.fos23.aarch64.rpm npm-6.14.16-1.12.22.11.6.u3.fos23.aarch64.rpm FusionOS-SA-2023-2309 Important FusionOS CVE-2023-34058:VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html  in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html . CVE-2023-34059:open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack the /dev/uinput file descriptor allowing them to simulate user inputs. FusionOS open-vm-tools-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-desktop-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-sdmp-12.0.5-4.u2.fos23.x86_64.rpm open-vm-tools-12.0.5-4.u2.fos23.aarch64.rpm open-vm-tools-desktop-12.0.5-4.u2.fos23.aarch64.rpm open-vm-tools-sdmp-12.0.5-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2310 Moderate FusionOS CVE-2023-3446:Checking excessively long DH keys or parameters may be very slow. FusionOS openresty-openssl111-asan-1.1.1h-2.u3.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u3.fos23.aarch64.rpm FusionOS-SA-2023-2311 Critical FusionOS CVE-2023-45853:MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. FusionOS openresty-zlib-asan-1.2.11-14.fos23.x86_64.rpm openresty-zlib-asan-1.2.11-14.fos23.aarch64.rpm FusionOS-SA-2023-2312 Important FusionOS CVE-2023-2977:A vulnerbility was found in OpenSC. This security flaw cause a buffer overrun vulnerability in pkcs15 cardos_have_verifyrc_package. The attacker can supply a smart card package with malformed ASN1 context. The cardos_have_verifyrc_package function scans the ASN1 buffer for 2 tags, where remaining length is wrongly caculated due to moved starting pointer. This leads to possible heap-based buffer oob read. In cases where ASAN is enabled while compiling this causes a crash. Further info leak or more damage is possible. FusionOS opensc-0.21.0-6.u1.fos23.x86_64.rpm opensc-help-0.21.0-6.u1.fos23.noarch.rpm opensc-0.21.0-6.u1.fos23.aarch64.rpm FusionOS-SA-2023-2313 Moderate FusionOS CVE-2023-5678:Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. Likewise, applications that use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS openssl-1.1.1m-29.u13.fos23.x86_64.rpm openssl-libs-1.1.1m-29.u13.fos23.x86_64.rpm openssl-perl-1.1.1m-29.u13.fos23.x86_64.rpm openssl-devel-1.1.1m-29.u13.fos23.x86_64.rpm openssl-help-1.1.1m-29.u13.fos23.noarch.rpm openssl-1.1.1m-29.u13.fos23.aarch64.rpm openssl-libs-1.1.1m-29.u13.fos23.aarch64.rpm openssl-perl-1.1.1m-29.u13.fos23.aarch64.rpm openssl-devel-1.1.1m-29.u13.fos23.aarch64.rpm FusionOS-SA-2023-2314 Moderate FusionOS CVE-2023-5366:A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses. FusionOS openvswitch-2.12.4-5.u4.fos23.x86_64.rpm openvswitch-devel-2.12.4-5.u4.fos23.x86_64.rpm openvswitch-help-2.12.4-5.u4.fos23.x86_64.rpm python3-openvswitch-2.12.4-5.u4.fos23.noarch.rpm openvswitch-2.12.4-5.u4.fos23.aarch64.rpm openvswitch-devel-2.12.4-5.u4.fos23.aarch64.rpm openvswitch-help-2.12.4-5.u4.fos23.aarch64.rpm FusionOS-SA-2023-2315 Important FusionOS CVE-2023-41915:OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. FusionOS pmix-4.2.6-1.fos23.x86_64.rpm pmix-devel-4.2.6-1.fos23.x86_64.rpm pmix-tools-4.2.6-1.fos23.x86_64.rpm pmix-4.2.6-1.fos23.aarch64.rpm pmix-devel-4.2.6-1.fos23.aarch64.rpm pmix-tools-4.2.6-1.fos23.aarch64.rpm FusionOS-SA-2023-2316 Critical FusionOS CVE-2023-41419:An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component. FusionOS python-gevent-help-21.1.2-2.u1.fos23.noarch.rpm python3-gevent-21.1.2-2.u1.fos23.x86_64.rpm python3-gevent-21.1.2-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2317 Important FusionOS CVE-2023-44271:An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. FusionOS python3-pillow-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-devel-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-help-9.0.1-4.u2.fos23.noarch.rpm python3-pillow-tk-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-qt-9.0.1-4.u2.fos23.x86_64.rpm python3-pillow-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-devel-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-tk-9.0.1-4.u2.fos23.aarch64.rpm python3-pillow-qt-9.0.1-4.u2.fos23.aarch64.rpm FusionOS-SA-2023-2318 Important FusionOS CVE-2023-43804:urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a `Cookie` header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. This issue has been patched in urllib3 version 1.26.17 or 2.0.5. CVE-2023-45803:urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. FusionOS python3-urllib3-1.26.12-6.u5.fos23.noarch.rpm FusionOS-SA-2023-2319 Important FusionOS CVE-2023-24329:An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-40217:An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) FusionOS python3-3.9.9-28.u8.fos23.x86_64.rpm python3-unversioned-command-3.9.9-28.u8.fos23.x86_64.rpm python3-devel-3.9.9-28.u8.fos23.x86_64.rpm python3-debug-3.9.9-28.u8.fos23.x86_64.rpm python3-help-3.9.9-28.u8.fos23.noarch.rpm python3-3.9.9-28.u8.fos23.aarch64.rpm python3-unversioned-command-3.9.9-28.u8.fos23.aarch64.rpm python3-devel-3.9.9-28.u8.fos23.aarch64.rpm python3-debug-3.9.9-28.u8.fos23.aarch64.rpm FusionOS-SA-2023-2320 Moderate FusionOS CVE-2023-3255:A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. CVE-2023-3255:A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard to the VNC server to trigger a denial of service. FusionOS qemu-6.2.0-83.u11.fos23.x86_64.rpm qemu-guest-agent-6.2.0-83.u11.fos23.x86_64.rpm qemu-help-6.2.0-83.u11.fos23.noarch.rpm qemu-img-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-rbd-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-ssh-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-83.u11.fos23.x86_64.rpm qemu-block-curl-6.2.0-83.u11.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-83.u11.fos23.x86_64.rpm qemu-seabios-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-arm-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-83.u11.fos23.x86_64.rpm qemu-system-riscv-6.2.0-83.u11.fos23.x86_64.rpm qemu-6.2.0-83.u11.fos23.aarch64.rpm qemu-guest-agent-6.2.0-83.u11.fos23.aarch64.rpm qemu-img-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-rbd-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-ssh-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-83.u11.fos23.aarch64.rpm qemu-block-curl-6.2.0-83.u11.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-arm-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-83.u11.fos23.aarch64.rpm qemu-system-riscv-6.2.0-83.u11.fos23.aarch64.rpm FusionOS-SA-2023-2321 Moderate FusionOS CVE-2023-33285:An issue was discovered in Qt 5.x before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. QDnsLookup has a buffer over-read via a crafted reply from a DNS server. CVE-2023-34410:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not always consider whether the root of a chain is a configured CA certificate. FusionOS qt5-qtbase-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-11.u5.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-11.u5.fos23.x86_64.rpm qt5-qtbase-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-11.u5.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-11.u5.fos23.aarch64.rpm FusionOS-SA-2023-2322 Low FusionOS CVE-2023-45145:Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. FusionOS redis6-6.2.7-3.u6.fos23.x86_64.rpm redis6-devel-6.2.7-3.u6.fos23.x86_64.rpm redis6-doc-6.2.7-3.u6.fos23.noarch.rpm redis6-6.2.7-3.u6.fos23.aarch64.rpm redis6-devel-6.2.7-3.u6.fos23.aarch64.rpm FusionOS-SA-2023-2323 Critical FusionOS CVE-2023-3961:A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR LSA or SPOOLSS, which Samba initiates on demand. However, due to inadequate sanitization of incoming client pipe names, allowing a client to send a pipe name containing Unix directory traversal characters (../). This could result in SMB clients connecting as root to Unix domain sockets outside the private directory. If an attacker or client managed to send a pipe name resolving to an external service using an existing Unix domain socket, it could potentially lead to unauthorized access to the service and consequential adverse events, including compromise or service crashes. CVE-2023-4091:A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files when the client requests read-only access but then implicitly truncates the opened file to 0 bytes if the client specifies a separate OVERWRITE create disposition request. The issue arises in configurations that bypass kernel file system permissions checks, relying solely on Samba's permissions. CVE-2023-4154:A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, including sensitive secrets and passwords. Even in a default setup, RODC DC accounts, which should only replicate some passwords, can gain access to all domain secrets, including the vital krbtgt, effectively eliminating the RODC / DC distinction. Furthermore, the vulnerability fails to account for error conditions (fail open), like out-of-memory situations, potentially granting access to secret attributes, even under low-privileged attacker influence. CVE-2023-42669:A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" service operates with only one worker in the main RPC task, allowing calls to the "rpcecho" server to be blocked for a specified time, causing service disruptions. This disruption is triggered by a "sleep()" call in the "dcesrv_echo_TestSleep()" function under specific conditions. Authenticated users or attackers can exploit this vulnerability to make calls to the "rpcecho" server, requesting it to block for a specified duration, effectively disrupting most services and leading to a complete denial of service on the AD DC. The DoS affects all other services as "rpcecho" runs in the main RPC task. CVE-2023-42670:A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non-AD DC purposes (for example, NT4-emulation "classic DCs") can erroneously start and compete for the same unix domain sockets. This issue leads to partial query responses from the AD DC, causing issues such as "The procedure number is out of range" when using tools like Active Directory Users. This flaw allows an attacker to disrupt AD DC services. FusionOS samba-4.17.5-8.u6.fos23.x86_64.rpm samba-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-client-4.17.5-8.u6.fos23.x86_64.rpm samba-client-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-common-4.17.5-8.u6.fos23.x86_64.rpm samba-common-tools-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-provision-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-libs-4.17.5-8.u6.fos23.x86_64.rpm samba-dc-bind-dlz-4.17.5-8.u6.fos23.x86_64.rpm samba-devel-4.17.5-8.u6.fos23.x86_64.rpm samba-vfs-glusterfs-4.17.5-8.u6.fos23.x86_64.rpm samba-krb5-printing-4.17.5-8.u6.fos23.x86_64.rpm libsmbclient-4.17.5-8.u6.fos23.x86_64.rpm libsmbclient-devel-4.17.5-8.u6.fos23.x86_64.rpm libwbclient-4.17.5-8.u6.fos23.x86_64.rpm libwbclient-devel-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-test-4.17.5-8.u6.fos23.x86_64.rpm python3-samba-dc-4.17.5-8.u6.fos23.x86_64.rpm samba-pidl-4.17.5-8.u6.fos23.noarch.rpm samba-test-4.17.5-8.u6.fos23.x86_64.rpm samba-usershares-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-clients-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-krb5-locator-4.17.5-8.u6.fos23.x86_64.rpm samba-winbind-modules-4.17.5-8.u6.fos23.x86_64.rpm ctdb-4.17.5-8.u6.fos23.x86_64.rpm samba-help-4.17.5-8.u6.fos23.x86_64.rpm samba-4.17.5-8.u6.fos23.aarch64.rpm samba-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-client-4.17.5-8.u6.fos23.aarch64.rpm samba-client-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-common-4.17.5-8.u6.fos23.aarch64.rpm samba-common-tools-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-provision-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-libs-4.17.5-8.u6.fos23.aarch64.rpm samba-dc-bind-dlz-4.17.5-8.u6.fos23.aarch64.rpm samba-devel-4.17.5-8.u6.fos23.aarch64.rpm samba-krb5-printing-4.17.5-8.u6.fos23.aarch64.rpm libsmbclient-4.17.5-8.u6.fos23.aarch64.rpm libsmbclient-devel-4.17.5-8.u6.fos23.aarch64.rpm libwbclient-4.17.5-8.u6.fos23.aarch64.rpm libwbclient-devel-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-test-4.17.5-8.u6.fos23.aarch64.rpm python3-samba-dc-4.17.5-8.u6.fos23.aarch64.rpm samba-test-4.17.5-8.u6.fos23.aarch64.rpm samba-usershares-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-clients-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-krb5-locator-4.17.5-8.u6.fos23.aarch64.rpm samba-winbind-modules-4.17.5-8.u6.fos23.aarch64.rpm ctdb-4.17.5-8.u6.fos23.aarch64.rpm samba-help-4.17.5-8.u6.fos23.aarch64.rpm FusionOS-SA-2023-2324 Important FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-3817:Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. CVE-2023-40546:A vulnerability classified as critical has been found in rhboot shim up to 15.7 on ARM. This affects the function mirror_one_esl of the file mok.c of the component mok. FusionOS shim-15.6-12.u8.fos23.x86_64.rpm shim-15.6-12.u8.fos23.aarch64.rpm FusionOS-SA-2023-2325 Important FusionOS CVE-2023-43642:snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources. FusionOS snappy-java-1.1.2.4-3.u2.fos23.x86_64.rpm snappy-java-javadoc-1.1.2.4-3.u2.fos23.noarch.rpm snappy-java-1.1.2.4-3.u2.fos23.aarch64.rpm FusionOS-SA-2023-2326 Critical FusionOS CVE-2023-32697:SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2. FusionOS sqlite-jdbc-3.15.1-2.u1.fos23.x86_64.rpm sqlite-jdbc-javadoc-3.15.1-2.u1.fos23.noarch.rpm sqlite-jdbc-3.15.1-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2327 Important FusionOS CVE-2023-46724:Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages. CVE-2023-46728:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests. CVE-2023-46846:SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems. CVE-2023-46847:Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. FusionOS squid-4.9-20.u1.fos23.x86_64.rpm squid-4.9-20.u1.fos23.aarch64.rpm FusionOS-SA-2023-2328 Moderate FusionOS CVE-2023-45648:Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. FusionOS tomcat-9.0.10-32.u9.fos23.noarch.rpm tomcat-jsvc-9.0.10-32.u9.fos23.noarch.rpm tomcat-help-9.0.10-32.u9.fos23.noarch.rpm FusionOS-SA-2023-2329 Moderate FusionOS CVE-2023-46316:In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. FusionOS traceroute-2.1.2-2.fos23.x86_64.rpm traceroute-help-2.1.2-2.fos23.noarch.rpm traceroute-2.1.2-2.fos23.aarch64.rpm FusionOS-SA-2023-2330 Important FusionOS CVE-2023-46246:Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068. CVE-2023-5344:Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1969. CVE-2023-5441:NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5535:Use After Free in GitHub repository vim/vim prior to v9.0.2010. FusionOS vim-common-9.0-21.u11.fos23.x86_64.rpm vim-minimal-9.0-21.u11.fos23.x86_64.rpm vim-enhanced-9.0-21.u11.fos23.x86_64.rpm vim-filesystem-9.0-21.u11.fos23.noarch.rpm vim-X11-9.0-21.u11.fos23.x86_64.rpm vim-common-9.0-21.u11.fos23.aarch64.rpm vim-minimal-9.0-21.u11.fos23.aarch64.rpm vim-enhanced-9.0-21.u11.fos23.aarch64.rpm vim-X11-9.0-21.u11.fos23.aarch64.rpm FusionOS-SA-2023-2331 Moderate FusionOS CVE-2023-5371:RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file FusionOS wireshark-3.6.14-4.u7.fos23.x86_64.rpm wireshark-devel-3.6.14-4.u7.fos23.x86_64.rpm wireshark-help-3.6.14-4.u7.fos23.x86_64.rpm wireshark-3.6.14-4.u7.fos23.aarch64.rpm wireshark-devel-3.6.14-4.u7.fos23.aarch64.rpm wireshark-help-3.6.14-4.u7.fos23.aarch64.rpm FusionOS-SA-2023-2332 Important FusionOS CVE-2023-5367:A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service. CVE-2023-5380:A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. CVE-2023-5574:A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service. CVE-2023-5574:A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service. FusionOS xorg-x11-server-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-common-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xnest-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xdmx-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xvfb-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-Xephyr-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-devel-1.20.11-23.u10.fos23.x86_64.rpm xorg-x11-server-help-1.20.11-23.u10.fos23.noarch.rpm xorg-x11-server-source-1.20.11-23.u10.fos23.noarch.rpm xorg-x11-server-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-common-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xnest-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xdmx-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xvfb-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-Xephyr-1.20.11-23.u10.fos23.aarch64.rpm xorg-x11-server-devel-1.20.11-23.u10.fos23.aarch64.rpm FusionOS-SA-2023-2333 Critical FusionOS CVE-2023-45853:MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. FusionOS zlib-1.2.11-24.u1.fos23.x86_64.rpm zlib-devel-1.2.11-24.u1.fos23.x86_64.rpm zlib-help-1.2.11-24.u1.fos23.noarch.rpm minizip-1.2.11-24.u1.fos23.x86_64.rpm minizip-devel-1.2.11-24.u1.fos23.x86_64.rpm zlib-1.2.11-24.u1.fos23.aarch64.rpm zlib-devel-1.2.11-24.u1.fos23.aarch64.rpm minizip-1.2.11-24.u1.fos23.aarch64.rpm minizip-devel-1.2.11-24.u1.fos23.aarch64.rpm FusionOS-SA-2023-2334 Critical FusionOS CVE-2023-44981:Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. FusionOS zookeeper-3.6.2-2.4.u1.fos23.noarch.rpm FusionOS-SA-2023-2335 Moderate FusionOS CVE-2021-37533:Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This may lead to leakage of information about services running on the private network of the client. The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See https://issues.apache.org/jira/browse/NET-711. FusionOS apache-commons-net-3.6-7.u3.fos23.noarch.rpm apache-commons-net-help-3.6-7.u3.fos23.noarch.rpm FusionOS-SA-2023-2336 Moderate FusionOS CVE-2023-46218:This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain. CVE-2023-46219:When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. FusionOS curl-7.79.1-25.u12.fos23.x86_64.rpm libcurl-7.79.1-25.u12.fos23.x86_64.rpm libcurl-devel-7.79.1-25.u12.fos23.x86_64.rpm curl-help-7.79.1-25.u12.fos23.noarch.rpm curl-7.79.1-25.u12.fos23.aarch64.rpm libcurl-7.79.1-25.u12.fos23.aarch64.rpm libcurl-devel-7.79.1-25.u12.fos23.aarch64.rpm FusionOS-SA-2023-2337 Moderate FusionOS CVE-2023-39130:GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c. FusionOS gdb-11.1-8.u4.fos23.x86_64.rpm gdb-headless-11.1-8.u4.fos23.x86_64.rpm gdb-gdbserver-11.1-8.u4.fos23.x86_64.rpm gdb-help-11.1-8.u4.fos23.noarch.rpm gdb-11.1-8.u4.fos23.aarch64.rpm gdb-headless-11.1-8.u4.fos23.aarch64.rpm gdb-gdbserver-11.1-8.u4.fos23.aarch64.rpm FusionOS-SA-2023-2338 Important FusionOS CVE-2023-46751:An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to crash the application via a dangling pointer. FusionOS ghostscript-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-devel-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-help-9.55.0-5.u4.fos23.noarch.rpm ghostscript-tools-dvipdf-9.55.0-5.u4.fos23.x86_64.rpm ghostscript-9.55.0-5.u4.fos23.aarch64.rpm ghostscript-devel-9.55.0-5.u4.fos23.aarch64.rpm ghostscript-tools-dvipdf-9.55.0-5.u4.fos23.aarch64.rpm FusionOS-SA-2023-2339 Important FusionOS CVE-2023-48161:Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2rgb.c FusionOS giflib-5.2.1-7.u3.fos23.x86_64.rpm giflib-devel-5.2.1-7.u3.fos23.x86_64.rpm giflib-utils-5.2.1-7.u3.fos23.x86_64.rpm giflib-help-5.2.1-7.u3.fos23.noarch.rpm giflib-5.2.1-7.u3.fos23.aarch64.rpm giflib-devel-5.2.1-7.u3.fos23.aarch64.rpm giflib-utils-5.2.1-7.u3.fos23.aarch64.rpm FusionOS-SA-2023-2340 Moderate FusionOS CVE-2023-5981:A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. FusionOS gnutls-3.7.2-10.u4.fos23.x86_64.rpm gnutls-devel-3.7.2-10.u4.fos23.x86_64.rpm gnutls-utils-3.7.2-10.u4.fos23.x86_64.rpm gnutls-help-3.7.2-10.u4.fos23.noarch.rpm gnutls-3.7.2-10.u4.fos23.aarch64.rpm gnutls-devel-3.7.2-10.u4.fos23.aarch64.rpm gnutls-utils-3.7.2-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2341 Important FusionOS CVE-2023-0836:An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way. CVE-2023-45539:HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end rule, such as routing index.html#.png to a static server. FusionOS haproxy-2.6.6-8.u6.fos23.x86_64.rpm haproxy-help-2.6.6-8.u6.fos23.noarch.rpm haproxy-2.6.6-8.u6.fos23.aarch64.rpm FusionOS-SA-2023-2342 Critical FusionOS CVE-2022-41853:Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled. FusionOS hsqldb-2.4.0-5.u1.fos23.noarch.rpm hsqldb-lib-2.4.0-5.u1.fos23.noarch.rpm hsqldb-manual-2.4.0-5.u1.fos23.noarch.rpm hsqldb-javadoc-2.4.0-5.u1.fos23.noarch.rpm hsqldb-demo-2.4.0-5.u1.fos23.noarch.rpm FusionOS-SA-2023-2343 Moderate FusionOS CVE-2023-22067:Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf; Oracle GraalVM Enterprise Edition: 20.3.11 and 21.3.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via CORBA to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). FusionOS java-1.8.0-openjdk-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-javadoc-1.8.0.392.b08-2.u1.fos23.noarch.rpm java-1.8.0-openjdk-javadoc-zip-1.8.0.392.b08-2.u1.fos23.noarch.rpm java-1.8.0-openjdk-accessibility-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.x86_64.rpm java-1.8.0-openjdk-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-headless-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-demo-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-src-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-accessibility-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm java-1.8.0-openjdk-openjfx-devel-slowdebug-1.8.0.392.b08-2.u1.fos23.aarch64.rpm FusionOS-SA-2023-2344 Moderate FusionOS CVE-2023-22081:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u381, 8u381-perf, 11.0.20, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 20.3.11, 21.3.7 and 22.3.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2023-22025:Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u381-perf, 17.0.8, 21; Oracle GraalVM for JDK: 17.0.8, 21; Oracle GraalVM Enterprise Edition: 21.3.7 and 22.3.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). FusionOS java-11-openjdk-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-headless-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-headless-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-devel-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-devel-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-jmods-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-jmods-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-demo-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-demo-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-src-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-src-slowdebug-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-javadoc-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-javadoc-zip-11.0.21.9-1.fos23.x86_64.rpm java-11-openjdk-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-headless-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-headless-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-devel-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-devel-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-jmods-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-jmods-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-demo-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-demo-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-src-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-src-slowdebug-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-javadoc-11.0.21.9-1.fos23.aarch64.rpm java-11-openjdk-javadoc-zip-11.0.21.9-1.fos23.aarch64.rpm FusionOS-SA-2023-2345 Important FusionOS CVE-2022-40149:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. CVE-2022-40150:Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by Out of memory. This effect may support a denial of service attack. CVE-2022-45685:A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. CVE-2022-45693:Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. CVE-2023-1436:An infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements. This leads to a StackOverflowError exception being thrown. FusionOS jettison-1.5.4-1.u3.fos23.noarch.rpm jettison-javadoc-1.5.4-1.u3.fos23.noarch.rpm FusionOS-SA-2023-2346 Critical FusionOS CVE-2023-42755:A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service. CVE-2023-5197:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. CVE-2023-1193:A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could allow an attacker to crash the system by accessing freed work. CVE-2023-25775:Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an unauthenticated user to potentially enable escalation of privilege via network access. CVE-2023-47233:The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. CVE-2023-6176:A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system. CVE-2023-39197:An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. CVE-2023-5197:A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free. CVE-2023-42753:An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-39194:A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure. CVE-2023-45871:An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. CVE-2023-42754:A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system. CVE-2023-39192:A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure. CVE-2023-39193:A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. CVE-2023-39189:A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure. CVE-2023-31085:An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0. CVE-2023-5717:A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. CVE-2023-45862:An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation. CVE-2022-45919:An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. CVE-2023-31083:An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur. CVE-2023-2593:VUL-0: CVE-2023-2593: kernel: Linux Kernel ksmbd Memory Exhaustion Denial-of-Service Vulnerability CVE-2023-32256:This vulnerability allows remote attackers to disclose sensitive information on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable.The specific flaw exists within the processing of SMB2_QUERY_INFO and SMB2_LOGOFF commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. CVE-2023-32258:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2023-32246:VUL-0: CVE-2023-32246: kernel: Linux Kernel ksmbd RCU Callback Race Condition Local Privilege Escalation Vulnerability CVE-2023-32254:A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel. CVE-2022-44033:An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach(). CVE-2023-34324:Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable.A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device. CVE-2023-2898:There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem. CVE-2023-46862:An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur. CVE-2023-37453:An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in read_descriptors in drivers/usb/core/sysfs.c. CVE-2023-5178:A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a malicious local privileged user to cause a use-after-free and double-free problem, which may permit remote code execution or lead to local privilege escalation problem. CVE-2023-46813:An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it. CVE-2022-45884:An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. CVE-2023-39198:A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation. FusionOS kernel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-headers-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-devel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-tools-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-tools-devel-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm perf-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm python3-perf-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm bpftool-5.10.0-136.57.0.136.u94.fos23.x86_64.rpm kernel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-headers-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-devel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-tools-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm kernel-tools-devel-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm perf-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm python3-perf-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm bpftool-5.10.0-136.57.0.136.u94.fos23.aarch64.rpm FusionOS-SA-2023-2347 Moderate FusionOS CVE-2023-6277:An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. CVE-2023-6277:An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft input with size smaller than 379 KB. CVE-2023-6228:An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. FusionOS libtiff-4.3.0-36.u12.fos23.x86_64.rpm libtiff-devel-4.3.0-36.u12.fos23.x86_64.rpm libtiff-static-4.3.0-36.u12.fos23.x86_64.rpm libtiff-tools-4.3.0-36.u12.fos23.x86_64.rpm libtiff-help-4.3.0-36.u12.fos23.noarch.rpm libtiff-4.3.0-36.u12.fos23.aarch64.rpm libtiff-devel-4.3.0-36.u12.fos23.aarch64.rpm libtiff-static-4.3.0-36.u12.fos23.aarch64.rpm libtiff-tools-4.3.0-36.u12.fos23.aarch64.rpm FusionOS-SA-2023-2348 Important FusionOS CVE-2022-1941:A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. FusionOS sgxsdk-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-qe3-2.15.1-9.u1.fos23.x86_64.rpm libsgx-pce-logic-2.15.1-9.u1.fos23.x86_64.rpm libsgx-qe3-logic-2.15.1-9.u1.fos23.x86_64.rpm sgx-aesm-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-epid-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-le-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-pce-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-ecdsa-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-epid-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-launch-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-pce-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-aesm-quote-ex-plugin-2.15.1-9.u1.fos23.x86_64.rpm libsgx-epid-2.15.1-9.u1.fos23.x86_64.rpm libsgx-epid-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-launch-2.15.1-9.u1.fos23.x86_64.rpm libsgx-launch-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-quote-ex-2.15.1-9.u1.fos23.x86_64.rpm libsgx-quote-ex-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-uae-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-enclave-common-2.15.1-9.u1.fos23.x86_64.rpm libsgx-enclave-common-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-urts-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-default-qpl-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-default-qpl-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-dcap-pccs-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-ql-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-ql-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ae-qve-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-quote-verify-2.15.1-9.u1.fos23.x86_64.rpm libsgx-dcap-quote-verify-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-pck-id-retrieval-tool-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-uefi-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-uefi-devel-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-network-2.15.1-9.u1.fos23.x86_64.rpm libsgx-ra-network-devel-2.15.1-9.u1.fos23.x86_64.rpm sgx-ra-service-2.15.1-9.u1.fos23.x86_64.rpm libsgx-headers-2.15.1-9.u1.fos23.x86_64.rpm FusionOS-SA-2023-2349 Important FusionOS CVE-2023-5157:A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service. CVE-2022-47015:MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. CVE-2022-38791:In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock. CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). CVE-2022-32087:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_args::walk_args. CVE-2022-32091:MariaDB v10.7 was discovered to contain an use-after-poison in in __interceptor_memset at /libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc. CVE-2022-32085:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Item_func_in::cleanup/Item::cleanup_processor. CVE-2022-32084:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component sub_select. CVE-2022-32088:MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Exec_time_tracker::get_loops/Filesort_tracker::report_use/filesort. CVE-2022-32083:MariaDB v10.2 to v10.6.1 was discovered to contain a segmentation fault via the component Item_subselect::init_expr_cache_tracker. CVE-2020-28912:With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between the client and the server, and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 10.3.x before 10.3.26, 10.4.x before 10.4.16, and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB, and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503. CVE-2021-2144:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). FusionOS mariadb-10.5.22-1.fos23.x86_64.rpm mariadb-config-10.5.22-1.fos23.x86_64.rpm mariadb-common-10.5.22-1.fos23.x86_64.rpm mariadb-errmsg-10.5.22-1.fos23.x86_64.rpm mariadb-server-galera-10.5.22-1.fos23.x86_64.rpm mariadb-server-10.5.22-1.fos23.x86_64.rpm mariadb-oqgraph-engine-10.5.22-1.fos23.x86_64.rpm mariadb-backup-10.5.22-1.fos23.x86_64.rpm mariadb-gssapi-server-10.5.22-1.fos23.x86_64.rpm mariadb-pam-10.5.22-1.fos23.x86_64.rpm mariadb-server-utils-10.5.22-1.fos23.x86_64.rpm mariadb-devel-10.5.22-1.fos23.x86_64.rpm mariadb-embedded-10.5.22-1.fos23.x86_64.rpm mariadb-embedded-devel-10.5.22-1.fos23.x86_64.rpm mariadb-test-10.5.22-1.fos23.x86_64.rpm mariadb-10.5.22-1.fos23.aarch64.rpm mariadb-config-10.5.22-1.fos23.aarch64.rpm mariadb-common-10.5.22-1.fos23.aarch64.rpm mariadb-errmsg-10.5.22-1.fos23.aarch64.rpm mariadb-server-galera-10.5.22-1.fos23.aarch64.rpm mariadb-server-10.5.22-1.fos23.aarch64.rpm mariadb-oqgraph-engine-10.5.22-1.fos23.aarch64.rpm mariadb-backup-10.5.22-1.fos23.aarch64.rpm mariadb-gssapi-server-10.5.22-1.fos23.aarch64.rpm mariadb-pam-10.5.22-1.fos23.aarch64.rpm mariadb-server-utils-10.5.22-1.fos23.aarch64.rpm mariadb-devel-10.5.22-1.fos23.aarch64.rpm mariadb-embedded-10.5.22-1.fos23.aarch64.rpm mariadb-embedded-devel-10.5.22-1.fos23.aarch64.rpm mariadb-test-10.5.22-1.fos23.aarch64.rpm FusionOS-SA-2023-2350 Important FusionOS CVE-2023-23583:Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access. FusionOS microcode_ctl-2.1-42.fos23.x86_64.rpm FusionOS-SA-2023-2351 Critical FusionOS CVE-2023-22068:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-38545:This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with. CVE-2023-22079:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22084:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22064:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22078:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22066:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22113:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). CVE-2023-22026:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22015:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.42 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22032:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22059:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22070:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22115:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22028:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.43 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22104:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22114:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22097:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22110:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22065:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22112:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22092:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22111:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22103:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22058:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22046:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22038:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). CVE-2023-22053:Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.42 and prior and 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server and unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). CVE-2023-22008:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22057:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22005:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22054:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22033:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22048:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.33 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). CVE-2023-22056:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.33 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-22007:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. CVE-2022-43551:A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded. CVE-2023-21946:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21963:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.40 and prior and 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21912:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.41 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21945:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21933:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21935:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21982:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21955:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21929:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21966:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21913:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21980:Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affected are 5.7.41 and prior and 8.0.32 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). CVE-2023-21947:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21919:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21972:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21962:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21917:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21977:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21940:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). Supported versions that are affected are 8.0.32 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21911:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21976:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21953:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21920:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-32221:When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST. CVE-2023-21836:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21871:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21865:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21872:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21867:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21873:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21864:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21870:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21874:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L). CVE-2023-21868:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21863:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21869:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21882:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N). CVE-2023-21881:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21883:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21887:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21880:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21879:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21875:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.31 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H). CVE-2023-21876:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2023-21877:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2023-21878:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21592:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.39 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized read access to a subset of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). CVE-2022-21641:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21638:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21635:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). CVE-2022-21611:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21625:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21599:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21632:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21633:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39400:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21640:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21608:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21594:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21617:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21637:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21604:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39410:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-39408:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21569:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21526:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21528:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21525:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21531:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21537:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21538:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). CVE-2022-21539:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Server accessible data as well as unauthorized read access to a subset of MySQL Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). CVE-2022-21509:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21553:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21529:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21534:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21515:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 5.7.38 and prior and 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21547:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Federated). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21522:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.29 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21527:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H). CVE-2022-21530:Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). CVE-2022-21517:Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). FusionOS mysql-8.0.35-1.u1.fos23.x86_64.rpm mysql-libs-8.0.35-1.u1.fos23.x86_64.rpm mysql-config-8.0.35-1.u1.fos23.x86_64.rpm mysql-common-8.0.35-1.u1.fos23.x86_64.rpm mysql-errmsg-8.0.35-1.u1.fos23.x86_64.rpm mysql-server-8.0.35-1.u1.fos23.x86_64.rpm mysql-devel-8.0.35-1.u1.fos23.x86_64.rpm mysql-test-8.0.35-1.u1.fos23.x86_64.rpm mysql-help-8.0.35-1.u1.fos23.x86_64.rpm mysql-8.0.35-1.u1.fos23.aarch64.rpm mysql-libs-8.0.35-1.u1.fos23.aarch64.rpm mysql-config-8.0.35-1.u1.fos23.aarch64.rpm mysql-common-8.0.35-1.u1.fos23.aarch64.rpm mysql-errmsg-8.0.35-1.u1.fos23.aarch64.rpm mysql-server-8.0.35-1.u1.fos23.aarch64.rpm mysql-devel-8.0.35-1.u1.fos23.aarch64.rpm mysql-test-8.0.35-1.u1.fos23.aarch64.rpm mysql-help-8.0.35-1.u1.fos23.aarch64.rpm FusionOS-SA-2023-2352 Critical FusionOS CVE-2023-0464:A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-2650:Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. CVE-2020-1971:The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). CVE-2021-23840:Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). CVE-2021-23841:The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). CVE-2021-3449:An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). CVE-2021-3450:The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a purpose for the certificate verification or, in the case of TLS client or server applications, override the default purpose. OpenSSL versions 1.1.1h and newer are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1h-1.1.1j). CVE-2021-3711:In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). CVE-2021-3712:ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y). CVE-2021-4160:There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including some of the TLS 1.3 default curves. Impact was not analyzed in detail, because the pre-requisites for attack are considered unlikely and include reusing private keys. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH private key among multiple clients, which is no longer an option since CVE-2016-0701. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0.0. It was addressed in the releases of 1.1.1m and 3.0.1 on the 15th of December 2021. For the 1.0.2 release it is addressed in git commit 6fc1aaaf3 that is available to premium support customers only. It will be made available in 1.0.2zc when it is released. The issue only affects OpenSSL on MIPS platforms. Fixed in OpenSSL 3.0.1 (Affected 3.0.0). Fixed in OpenSSL 1.1.1m (Affected 1.1.1-1.1.1l). Fixed in OpenSSL 1.0.2zc-dev (Affected 1.0.2-1.0.2zb). CVE-2022-0778:The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). CVE-2022-1292:The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). CVE-2022-2068:In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). CVE-2022-2097:AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p). CVE-2022-4450:The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack. CVE-2023-0215:The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications. The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash. CVE-2023-3817:Checking excessively long DH keys or parameters may be very slow. Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. CVE-2023-5678:Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Applications that use the functions DH_generate_key() togenerate an X9.42 DH key may experience long delays. Likewise, applicationsthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42 DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS openresty-openssl111-asan-1.1.1h-2.u4.fos23.x86_64.rpm openresty-openssl111-asan-1.1.1h-2.u4.fos23.aarch64.rpm FusionOS-SA-2023-2353 Important FusionOS CVE-2023-43907:OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c. FusionOS optipng-0.7.8-1.fos23.x86_64.rpm optipng-0.7.8-1.fos23.aarch64.rpm FusionOS-SA-2023-2354 Important FusionOS CVE-2023-47038:A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. FusionOS perl-5.34.0-10.u4.fos23.x86_64.rpm perl-libs-5.34.0-10.u4.fos23.x86_64.rpm perl-devel-5.34.0-10.u4.fos23.x86_64.rpm perl-help-5.34.0-10.u4.fos23.noarch.rpm perl-5.34.0-10.u4.fos23.aarch64.rpm perl-libs-5.34.0-10.u4.fos23.aarch64.rpm perl-devel-5.34.0-10.u4.fos23.aarch64.rpm FusionOS-SA-2023-2355 Moderate FusionOS CVE-2020-36023:An issue was discovered in freedesktop poppler version 20.12.1, allows remote attackers to cause a denial of service (DoS) via crafted .pdf file to FoFiType1C::cvtGlyph function. FusionOS poppler-0.90.0-7.u4.fos23.x86_64.rpm poppler-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-glib-doc-0.90.0-7.u4.fos23.noarch.rpm poppler-qt5-0.90.0-7.u4.fos23.x86_64.rpm poppler-qt5-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-cpp-0.90.0-7.u4.fos23.x86_64.rpm poppler-cpp-devel-0.90.0-7.u4.fos23.x86_64.rpm poppler-utils-0.90.0-7.u4.fos23.x86_64.rpm poppler-help-0.90.0-7.u4.fos23.noarch.rpm poppler-0.90.0-7.u4.fos23.aarch64.rpm poppler-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-glib-0.90.0-7.u4.fos23.aarch64.rpm poppler-glib-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-qt5-0.90.0-7.u4.fos23.aarch64.rpm poppler-qt5-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-cpp-0.90.0-7.u4.fos23.aarch64.rpm poppler-cpp-devel-0.90.0-7.u4.fos23.aarch64.rpm poppler-utils-0.90.0-7.u4.fos23.aarch64.rpm FusionOS-SA-2023-2356 Important FusionOS CVE-2023-49083:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. CVE-2023-49083:cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs7_certificates` could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6. FusionOS python3-cryptography-36.0.1-6.u5.fos23.x86_64.rpm python-cryptography-help-36.0.1-6.u5.fos23.noarch.rpm python3-cryptography-36.0.1-6.u5.fos23.aarch64.rpm FusionOS-SA-2023-2357 Important FusionOS CVE-2023-46136:Werkzeug is a comprehensive WSGI web application library. If an upload of a file that starts with CR or LF and then is followed by megabytes of data without these characters: all of these bytes are appended chunk by chunk into internal bytearray and lookup for boundary is performed on growing buffer. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. This vulnerability has been patched in version 3.0.1. FusionOS python3-werkzeug-2.0.3-4.u3.fos23.noarch.rpm python-werkzeug-help-2.0.3-4.u3.fos23.noarch.rpm FusionOS-SA-2023-2358 Moderate FusionOS CVE-2023-1544:A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU. FusionOS qemu-6.2.0-86.u12.fos23.x86_64.rpm qemu-guest-agent-6.2.0-86.u12.fos23.x86_64.rpm qemu-help-6.2.0-86.u12.fos23.noarch.rpm qemu-img-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-rbd-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-ssh-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-iscsi-6.2.0-86.u12.fos23.x86_64.rpm qemu-block-curl-6.2.0-86.u12.fos23.x86_64.rpm qemu-hw-usb-host-6.2.0-86.u12.fos23.x86_64.rpm qemu-seabios-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-aarch64-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-arm-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-x86_64-6.2.0-86.u12.fos23.x86_64.rpm qemu-system-riscv-6.2.0-86.u12.fos23.x86_64.rpm qemu-6.2.0-86.u12.fos23.aarch64.rpm qemu-guest-agent-6.2.0-86.u12.fos23.aarch64.rpm qemu-img-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-rbd-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-ssh-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-iscsi-6.2.0-86.u12.fos23.aarch64.rpm qemu-block-curl-6.2.0-86.u12.fos23.aarch64.rpm qemu-hw-usb-host-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-aarch64-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-arm-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-x86_64-6.2.0-86.u12.fos23.aarch64.rpm qemu-system-riscv-6.2.0-86.u12.fos23.aarch64.rpm FusionOS-SA-2023-2359 Important FusionOS CVE-2023-43114:An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks. CVE-2023-38197:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2023-37369:In Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2, there can be an application crash in QXmlStreamReader via a crafted XML string that triggers a situation in which a prefix is greater than a length. FusionOS qt-4.8.7-58.u7.fos23.x86_64.rpm qt-devel-4.8.7-58.u7.fos23.x86_64.rpm qt-4.8.7-58.u7.fos23.aarch64.rpm qt-devel-4.8.7-58.u7.fos23.aarch64.rpm FusionOS-SA-2023-2360 Important FusionOS CVE-2023-38197:An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3. There are infinite loops in recursive entity expansion. CVE-2023-43114:An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks. FusionOS qt5-qtbase-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-common-5.15.2-13.u6.fos23.noarch.rpm qt5-qtbase-devel-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-private-devel-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-examples-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-static-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-mysql-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-odbc-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-postgresql-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-gui-5.15.2-13.u6.fos23.x86_64.rpm qt5-qtbase-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-devel-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-private-devel-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-examples-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-static-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-mysql-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-odbc-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-postgresql-5.15.2-13.u6.fos23.aarch64.rpm qt5-qtbase-gui-5.15.2-13.u6.fos23.aarch64.rpm FusionOS-SA-2023-2361 Moderate FusionOS CVE-2023-25155:Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` commands can trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process. This problem affects all Redis versions. Patches were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9. CVE-2023-45145:Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. FusionOS redis5-5.0.7-6.u6.fos23.x86_64.rpm redis5-devel-5.0.7-6.u6.fos23.x86_64.rpm redis5-doc-5.0.7-6.u6.fos23.noarch.rpm redis5-5.0.7-6.u6.fos23.aarch64.rpm redis5-devel-5.0.7-6.u6.fos23.aarch64.rpm FusionOS-SA-2023-2362 Critical FusionOS CVE-2023-29824:A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0. NOTE: the vendor and discoverer indicate that this is not a security issue. FusionOS python3-scipy-1.6.2-2.u2.fos23.x86_64.rpm python3-scipy-1.6.2-2.u2.fos23.aarch64.rpm FusionOS-SA-2023-2363 Moderate FusionOS CVE-2023-0465:Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. CVE-2023-2650:Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a Denial of Service. CVE-2023-3446:Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. FusionOS shim-15.6-12.u9.fos23.x86_64.rpm shim-15.6-12.u9.fos23.aarch64.rpm FusionOS-SA-2023-2364 Moderate FusionOS CVE-2018-11039:Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. CVE-2022-22950:n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition. FusionOS springframework-3.2.18-12.u2.fos23.noarch.rpm springframework-help-3.2.18-12.u2.fos23.noarch.rpm springframework-aop-3.2.18-12.u2.fos23.noarch.rpm springframework-beans-3.2.18-12.u2.fos23.noarch.rpm springframework-context-3.2.18-12.u2.fos23.noarch.rpm springframework-expression-3.2.18-12.u2.fos23.noarch.rpm springframework-instrument-3.2.18-12.u2.fos23.noarch.rpm springframework-jdbc-3.2.18-12.u2.fos23.noarch.rpm springframework-jms-3.2.18-12.u2.fos23.noarch.rpm springframework-orm-3.2.18-12.u2.fos23.noarch.rpm springframework-orm-hibernate4-3.2.18-12.u2.fos23.noarch.rpm springframework-oxm-3.2.18-12.u2.fos23.noarch.rpm springframework-tx-3.2.18-12.u2.fos23.noarch.rpm springframework-web-3.2.18-12.u2.fos23.noarch.rpm FusionOS-SA-2023-2365 Important FusionOS CVE-2023-49285:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-49286:Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS squid-4.9-21.u2.fos23.x86_64.rpm squid-4.9-21.u2.fos23.aarch64.rpm FusionOS-SA-2023-2366 Low FusionOS CVE-2023-39804:A stack overflow vulnerability exists in GNU Tar up to including v1.34. The bug exists in the function xattr_decoder() in xheader.c, where alloca() is used and it may overflow the stack if a sufficiently long xattr key is used. The vulnerability can be triggered when extracting a tar/pax archive that contains such a long xattr key. FusionOS tar-1.34-5.u2.fos23.x86_64.rpm tar-help-1.34-5.u2.fos23.noarch.rpm tar-1.34-5.u2.fos23.aarch64.rpm FusionOS-SA-2023-2367 Important FusionOS CVE-2023-46589:Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. CVE-2023-42795:Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. CVE-2023-44487:The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. FusionOS tomcat-9.0.10-32.u11.fos23.noarch.rpm tomcat-jsvc-9.0.10-32.u11.fos23.noarch.rpm tomcat-help-9.0.10-32.u11.fos23.noarch.rpm FusionOS-SA-2023-2368 Moderate FusionOS CVE-2023-48706:Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue. CVE-2023-48231:Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit `25aabc2b` which has been included in release version 9.0.2106. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48233:Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `ac6378773` which has been included in release version 9.0.2108. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48234:Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `58f9befca1` which has been included in release version 9.0.2109. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48235:Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONG_MAX - lnum will cause the overflow. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `060623e` which has been included in release version 9.0.2110. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48236:Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user interaction is required and a crash may not even happen in all situations. This vulnerability has been addressed in commit `73b2d379` which has been included in release version 9.0.2111. Users are advised to upgrade. There are no known workarounds for this vulnerability. CVE-2023-48237:Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer. Impact is low, user interaction is required and a crash may not even happen in all situations. This issue has been addressed in commit `6bf131888` which has been included in version 9.0.2112. Users are advised to upgrade. There are no known workarounds for this vulnerability. FusionOS vim-common-9.0-23.u13.fos23.x86_64.rpm vim-minimal-9.0-23.u13.fos23.x86_64.rpm vim-enhanced-9.0-23.u13.fos23.x86_64.rpm vim-filesystem-9.0-23.u13.fos23.noarch.rpm vim-X11-9.0-23.u13.fos23.x86_64.rpm vim-common-9.0-23.u13.fos23.aarch64.rpm vim-minimal-9.0-23.u13.fos23.aarch64.rpm vim-enhanced-9.0-23.u13.fos23.aarch64.rpm vim-X11-9.0-23.u13.fos23.aarch64.rpm FusionOS-SA-2023-2369 Moderate FusionOS CVE-2023-6175:A heap-based buffer overflow was found in Wireshark's NetScreen file parser. This issue may allow local arbitrary code execution via a crafted capture file. FusionOS wireshark-3.6.14-5.u8.fos23.x86_64.rpm wireshark-devel-3.6.14-5.u8.fos23.x86_64.rpm wireshark-help-3.6.14-5.u8.fos23.x86_64.rpm wireshark-3.6.14-5.u8.fos23.aarch64.rpm wireshark-devel-3.6.14-5.u8.fos23.aarch64.rpm wireshark-help-3.6.14-5.u8.fos23.aarch64.rpm